Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

As someone coming from the US to the UK I can say that the feeling is mutual. Some things are suboptimal in the US system but

> * No chip and pin. You still sign credit card slips.

There are two systems at work here, the credit system and the ATM system. The latter uses a PIN (no chip, so basically online verification) but the primary difference is related to chargebacks and fraud. Like in the UK, in a PIN system if I know your PIN and get your card I can loot your account and you are SOL. In the US a credit card transaction with a signature but no PIN means that the merchant is on the hook for fraud. If I get your card number and go on a spending spree you are not going to take a hit for any of the charges, the merchants are.

> * You have to interact with the branch where you set up your account for a bewildering array of things.

You can, but you seldom need to. I have several online-only accounts that I still maintain for making US payments and except for cases where I was taking out a loan to buy a house or car I think that I did not actually step inside my bank (any branch) for over ten years.[]

OTOH, I have needed to note down the exact UK branch in which I opened my account in on at least five different occasions in the last month as I opened various business relationships or established services. In the US no one ever asked for the name of my bank let alone the specific branch.

> Bank account numbers are treated as secret information - they are starred out in the online banking interface! Apparently, it I know your bank account number I can take your money?

ACH (automated check handling) is the pseudo direct-payment system we have over here. It kind of sucks, but it is basically an electronic form of the silly checques that you mention later. With the bank routing number and your account number I can write a check on your behalf. OTOH, with a couple of clicks online I can also order paper checks for your account and start making payments. They will eventually (and hopefully pretty quickly...) fail out as fraud, but when you get things set up between your account and companies you deal with on a regular basis there is a fairly seamless flow from your paycheck direct-deposit to your rent/mortgage and utilities, etc. It is just a crufty legacy system that gets tweaks every decade or two but will lumber on for a while because there is so much infrastructure built around it.

> * As a general rule, paying someone some money (for rent, for example) is fraught with difficulty, especially if you hold a non-US bank account.

And why should the system optimize for non-US bank accounts when the percentage of people a merchant will interact with who fit in this category are 0%? Part of the thing to consider here is that the US retail/merchant payments and banking system does not need to interact with anyone outside of the US; yes, there are some exceptions but they are so dwarfed by the internal transaction volume that they effectively do not exist and if you do need that rare service you can use a third-party like western union or the admittedly onerous wire transfer process. The goal is to make internal transactions easy and limit the exposure to fraud (except when it conflicts with the first goal) with the bonus of all operations being under what is for all intents and purposes a single legal jurisdiction.

Everyone has thoughts on how to fix the system or what cool ideas should be applied from other countries but most of these people fail to grasp the concept that for most people the system is not broken and so you are fighting consumer indifference and an entrenched incumbent that makes telcos look like pushovers.

[*] One interesting thing about US banking is that the local branch interactions that you complain about are actually one of the few things that most bank customers want more of. Specifically, if you press people on what is wrong with retail banking it is that there were a huge set of mergers in the past twenty years that effectively eliminated the local retail bank where people knew who you were, cared about you, and looked after you in a way that is simply not possible in a modern world of retail banking giants.



> There are two systems at work here, the credit system and the ATM system. The latter uses a PIN (no chip, so basically online verification) but the primary difference is related to chargebacks and fraud. Like in the UK, in a PIN system if I know your PIN and get your card I can loot your account and you are SOL. In the US a credit card transaction with a signature but no PIN means that the merchant is on the hook for fraud. If I get your card number and go on a spending spree you are not going to take a hit for any of the charges, the merchants are.

That is absolutely true. However thanks to chip, cards cannot be copied or forged. Therefore merchants are paying lower commissions on debit/credit card payments as there are fewer fraudulent transactions. Some merchants are even declining to accept non chip-and-pin cards (not sure if is legal though).


Be careful about using works like "cannot" in terms of what is possible to trust regarding hardware that is in possession of a potentially adversarial party and systems that assume said cards are secure. There are a variety of attacks that are possible (pre-play, attacks that can make a stolen card work without a PIN, etc.) and it is likely that in the future it will be easier to perform these attacks. It is a standard risk/convenience continuum and everyone has staked out a different portion of that zone. In the US the merchant pays a lower commission on debit card (e.g. with PIN) transactions as well for the same reasons, which is why they will tend to suggest that option or offer it up as the default when you use a card that can be either debit or credit. When I suggested that there were only two systems I was simplifying a bit too much and you definitely caught me on that one.

In most places it seems that there are two (and sometimes three depending on how mobile phone payments are cleared) dominant e-payment formats, one which puts the fraud burden on the merchant and one that puts it on the customer. The size of the burden is usually set by regulation and the level that this is set at tends to inform the nature of the security at the endpoints vs. what happens at the middle when clearing and reconciling transactions.


"Some merchants are even declining to accept non chip-and-pin cards (not sure if is legal though)."

If you travel to Sweden, you can't even use credit cards that are non chip-and-pin. I even went to one store that refused to accept cash: you had to use a chip-enabled credit card.

In Australia, NFC wireless transactions (Visa PayWave / Mastercard Paypass) are gaining traction for purchases under $100. It's very convenient & usually fast.


> in a PIN system if I know your PIN and get your card I can loot your account and you are SOL

That's not entirely true - legally the bank has to carry out an investigation and prove fraud or negligence on your part. Simple use of the PIN is not sufficient evidence. Sadly, however, this legislation is not always followed to the letter and many customers do not force the issue.


> Like in the UK, in a PIN system if I know your PIN and get your card I can loot your account and you are SOL.

This is not accurate (well, since 2009 at least). It has nothing to do with chip-and-pin, but with how the legal system distributes liabilities. Section 62 of the Payment Services Regulations 2009 [1] limits personal liability to £50 (except in cases of fraud or gross negligence).

Chip-and-pin is simply an authentication mechanism that reduces the risk of fraud; it does not address legal questions of liability.

[1] http://www.legislation.gov.uk/uksi/2009/209/regulation/62/ma...


> in a PIN system if I know your PIN and get your card I can loot your account and you are SOL

I guess, but if someone where to know a password to a sensitive online system they could do equal damage.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: