Opinion

Felix Salmon

WSJ vs PIN

By Felix Salmon
November 22, 2010

Gartner’s Avivah Litan knows what she’s talking about when it comes to the relative safety of signature debit and PIN-based transactions. PIN is much safer — to the point at which Bonneville Bancorp recently banned signature debit altogether, despite its higher fees:

“All I can think of is that the fraud was so high that the lost interchange revenue is worth it compared to the cost of issuing new accounts,” said Avivah Litan, a vice president and distinguished analyst at the Stamford, Conn., market research company Gartner Inc. “It’s a statement admitting PIN is more secure” …

Litan said there is no confusion about which is the more secure method.

“From a pure technical security standpoint, PIN is much more secure,” she said. “There’s no two ways about it.”

So how on earth did the WSJ’s Karen Blumenthal manage to report this over the weekend, in an article about ATM fraud?

Use your PIN sparingly at retailers, and choose the signature option—or a credit card—instead, Ms. Litan says.

This doesn’t make any sense. For one thing, the article is about ATM fraud, and says nothing about the possibility of fraud when using a retailer’s POS machine. And as Litan well knows, signature debit is much more prone to fraud than using a PIN.

More generally, Blumenthal seems weirdly wary of the most secure form of payment there is:

Chip-and-PIN technology isn’t foolproof, and experts say U.S. banks and retailers may instead leapfrog that technology, possibly by using the capabilities of smartphones to verify transactions or to actually make the transactions instead of using a card.

“Foolproof” is an impossible and silly standard to use when it comes to payments; I can guarantee you that if and when smartphones get involved, that won’t be foolproof either. And in any case, smartphone verification is still very much in the realm of science fiction, in stark contrast to chip-and-PIN technology, which is used by hundreds of millions of people every day.

The fact is that chip-and-PIN is safer than PIN, and PIN is safer than signature. But you’d never guess that from reading Blumenthal’s piece. And I’m genuinely puzzled about that quote from Litan.

Update: Litan clears things up in the comments. Signature debit is definitely more prone to fraud — so in order to incentivize their customers to still use it, the banks are much more generous when it comes to fraud coverage for signature debit than they are for PIN transactions. As a result, it makes sense for consumers to use the less secure payment method — because if they are a victim of fraud, they’ll be covered more quickly and easily.

Comments
9 comments so far | RSS Comments RSS

I have a Perkstreet debit card, which is owned by Bancorp. Given that one gets 1-2% cashback on signature debit purchases, there is a strong incentive to use signature. Are there two different Bancorps in question?

Posted by boobalah | Report as abusive
 

I think the question here is “safer for whom?” PIN-based transactions may be safer for banks and less safe for consumers if it is more difficult for customers to dispute PIN-authorized transactions.

Posted by jeremym | Report as abusive
 

I agree that there is some question as to the beneficiary of the safer transaction. I rarely use my debit card, because if the number is stolen and used, the money will come directly from my bank balance. Even if I get the bank to refund the fraudulent charges, I’ll be at risk of overdrafts until it is fixed, possibly weeks later. So, even though the legal framework for fraud protection is the same, in practice credit is more consumer-friendly.

As for PIN vs. signature debit, whether I use a PIN or not, if the signature option is available, then someone else can use it. Also, if someone gets my PIN, (which isn’t all that hard. It’s a small search space, and it’s easy to look over shoulders as the PIN is entered) then I would imagine it would be harder to prove fraud. After all, a known PIN is easier to forge than a signature. So while PIN-only debit may be safer in some ways for the bank, and in fewer ways for the consumer, I’ll stick with credit until retailers are able/willing to reimburse me for the added risk I’d take on with debit.

Posted by Podunk | Report as abusive
 

@boobalah Yep, that’s a different Bancorps. The Bancorp behind PerkStreet is this one: http://www.thebancorp.com/

Jennifer Spencer
Digital Communications Manager
PerkStreet Financial

Posted by PerkStreetJen | Report as abusive
 

Podunk, even the EXISTENCE of a debit card puts you at risk. If you lose your wallet, your account will be drained within two hours. Possibly before you even realize your wallet is missing. Then those checks you wrote last week? Overdraft fees when they hit the account.

Maybe I’m just old-fashioned, but I lived happily for many years before debit cards were invented. How exactly do they improve my life?

Twice (over many years) our credit card was stolen. Both times the dispute resolution was quick and straightforward, and all fraudulent charges were reversed at no cost to us. I would use a PIN/chip credit card, if one were available, but would never risk attaching a card to my checking account.

Posted by TFF | Report as abusive
 

Well, not quite TFF. The person has to have the pin and if you are crazy enought to have your pin in your purse, or someone look over your shoulder, then yes it can be drained.

You also can have limits on your account and the bank also has limits of transactions in a day so they can’t drain your account.

Whereas, as a traveler, the transactions on my credit card were much harder to verify and they seldom notified me if there were large items on it… even from outside the country, because it wasn’t abnormal.

In poorer economic times I would rather use a debit and have the amount o money I actually have available to spend be my guide, then have debt build up on my credit card. So in essence, I am actually more old fashioned! heheh

Posted by hsvkitty | Report as abusive
 

I suppose a transaction limit would help, though sometimes it doesn’t take much to drain my account. But do debit cards always require a PIN? Or can they also be used without? I was under the impression that the latter was the case.

Have never had a problem with budgeting (in good times or bad), so I don’t view credit cards as “debt”. Instead view credit balances as “money which will soon be removed from bank account” (and thus unavailable for other purposes). Not terribly different from a debit card in that regard, though the debit card dings the account more immediately.

Posted by TFF | Report as abusive
 

a PIN transaction is more secure for the bank. each time a customer uses a PIN transaction, however, they open themselves to the possibility that their PIN can be skimmed. i only use my PIN at ATMs, make purchases in only credit/cash and pay my favorite small businesses in cash. beyond simplicity, i see no value in making a debt transaction if i have credit.

Posted by soja | Report as abusive
 

Hi, sorry about the confusion. The press doesn’t have enough print room to give the full context.

Adding a PIN to a payment (e.g. PIN debit) is more secure than not having the PIN. So PIN debit is definitely more secure and less fraud prone than signature debit.

HOWEVER, the banks earn more interchange revenue on signature debit (since they can rightfully claim that they are riskier payments so they need the increase in revenue to offset the fraud costs). So they distort the market (in a sense) by incenting consumers to use the more risky debit transaction type – or signature debit.

The banks incent the cardholders to NOT ENTER THEIR PINs on debit transactions by:

a) covering them more generously in the case of fraud when they don’t enter their PIN
b) giving them loyalty (e.g. frequent flyer) points when they don’t enter their PIN.

Check out the fine print on the check card agreements from most banks.

So in sum, consumers are incented to use a less secure form of debit card payment – signature debit – so that the banks can make more money. Merchants pay banks less for PIN debit transactions even though they are more secure and they would much rather accept a PIN debit transactions. So merchant incentives are at odds with consumer incentives. (Walmart sued over a derivative of this issue years ago, which resulted in a $5 billion award for Walmart and other retailers that Visa and MasterCard had to pay out, and the convoluted concept we are stuck with now which is ‘using your debit card as a credit card’).

As a consumer, you are better off not entering your PIN on a debit card transaction since you will be covered much more quickly and easily in the event of fraud.

Hope this murky situation is clear.

Thanks.

Posted by Avivah | Report as abusive
 

Post Your Comment

We welcome comments that advance the story through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can flag it to our editors by using the report abuse links. Views expressed in the comments do not represent those of Reuters. For more information on our comment policy, see http://blogs.reuters.com/fulldisclosure/2010/09/27/toward-a-more-thoughtful-conversation-on-stories/
  •