Mastercard debuts a credit card with a fingerprint sensor to fight fraud

The industry was supposed to move to chip+pin eventually. The idea being based on the founding principles of the three categories of multi-factor authentication which are 1) What you know, 2) What you have, and 3) What you are. So chip is what you have, PIN is what you know, and something like a fingerprint is what you are. The problem is that chip + signature is not multifactor. Those are both things you have. A signature only counts as "what you are" if there was some means to verify that the signature is the true cardholder's signature. No cashier is good enough to be the judge on that, plus that is overruled by contracts signed between merchants and VISA/MC, which simply state that "a signature" must be captured. But you are right that chip+pin would solve 99% of the fraud out there.

One thing that the chip card does do is combat the main problem of counterfeiting cards, but that's only good when the merchant opts not to accept the magnetic strip to capture the transaction. Most POS terminals have a setting to not accept magstrip if it's a PIN card, due to liability rules put in place that makes the merchant liable for fraud transactions if they chose to accept the mag strip over the chip.

The US has been slow to adopt the whole switch to EMV because banking in the US is very different from other countries. Most countries that initially switched had smaller infrastructure and one PIN network. Here in the US we have lots of different PIN networks and trying to orchestrate such a switch, plus add in all the rules and regulations that are now in place post-2008, it's just plain slow to adopt. Meanwhile all of the fraud has made its way into the US because we are behind on technology and relying on a 50 year old magstrip that contains plaintext track data.

I used to pull home depot gift cards out of card capture bins of ATMs and run them through my USB card reader to see that they had someone else's ATM card programmed onto it using our BIN and MMI. Good stuff.

/r/gadgets Thread Parent Link - zdnet.com