[altoz]

This seems a great way to steal other people's credit cards. You can literally duplicate someone's card on your "coin".

Now there's a super easy way for someone working in a restaurant to get your credit card information and sell it.

[CoffeeDregs]

Two notes:

1) This can already be done using a simple stripe reader.

2) Coin can identify, investigate and proactively block anyone who has more than the average number of cards, so Coin actually seems well positioned to reduce fraud. Also, Coin could identify that multiple Coin cards have the same credit/whatever cards on them and, the next day, prompt you to swipe your card again to confirm. [Provided that Coin uploads suitable data to its servers...] In fact, using a Coin card could be a signal to fraudsters not to commit fraud against your card.

[joshfraser]

Yes, credit card duplicators have been available for a long time, but the average minimum-wage worker doesn't know that. This changes the game -- kinda like how how the prevalence of high quality camera phones changed the game for sexting. You could do it before, but it happens a lot more now that it's so convenient and the technology is available to the masses.

[vklj]

And by using the location of your phone, and the timing of the swipes, Coin can learn a lot about your shopping habits.

Not as much as the credit card company (e.g. not the amount of the purchase), but still quite a lot.

[praxeologist]

You have to take pictures of the cards. I assume it would work similarly to how I can take photos of checks to deposit them where, within some tolerance, you have the check/card inside of a "frame" allowing the check to be read. Maybe they can also sort of OCR the card name and make sure it matches your own.

[fragmede]

Additionally: simple stripe readers have been available for years now, and fit quite easily in one hand.

http://www.baltimoresun.com/media/photo/2011-08/64038442.jpg

[raybeorn]

Just because I am using coins hardware doesn't necessarily mean I need to use their software. And if it does catch on in the main stream, I doubt many people will check to see if it is your card if a check actually exists.

[walshemj]

Yes I really want to have a reprogrammable CC that I hand to a waiter NOT - Why not just have the fed mandate Chip and Pin after a certain date like Europe did.

[andrewfong]

Because it's not worth the cost. On the consumer side, chargebacks are easy. Credit card companies bear the brunt of the cost of fraud. They all have the incentive in the world to start rolling out chip and pin technology. The fact that they haven't probably demonstrates that the math doesn't work out.

[silviogutierrez]

It's actually the end merchant (seller) that bears the cost of fraud. So credit card companies have little incentive to fix this, beyond customer support costs.

Say you sell a camera to someone using a stolen credit card.

The real owner of the card gets his money back after doing a chargeback. The thief keeps the camera. The merchant loses a camera, the money, and gets a ding in his credit card merchant reputation.

[andrewfong]

Seems like the legislative solution then would just be to shift (at least some of) the burden to the credit card processors then.

[silviogutierrez]

I agree. It's a tricky problem. Chargebacks are really easy for the consumer - too easy. There has to be a happy medium, but I can't quite think what it is.

Bitcoin, on the other hand, is sided on the other extreme. The merchant has almost all the power. However, the merchant still has a reputation, which might be sufficient incentive.

[largote]

Doesn't the merchant bear the cost of the fraud ONLY if they'r e using obsolete equipment?

[fragmede]

> Because it's not worth the cost.

Neither are airbags in cars, yet the government stepped in and made them mandatory.

> [Credit card companies] all have the incentive in the world to start rolling out chip and pin technology.

No, their incentive is to make sure people keep using credit cards.

They've done the math and concluded that the amount of user confusion resulting from chip and pin technology resulting in less credit card use is less than the cost of fraud. The fact that chip and pin works in Europe, and also that credit card processors still exist in Europe proves that implementing chip and pin isn't going to drive Visa and Mastercard out of business.

[serf]

>> because it's not worth the cost.

> Neither are airbags in cars, yet the government stepped in and made them mandatory.

that's simply untrue.

http://www.riskworld.com/news/97q1/nw7aa029.htm

this testimony is from 1997, and even with mostly first generation airbags in play at that time it's still wrong.

They are even more effective at saving lives now, and many of the problems with passenger side airbags have now been alleviated.

saved lives = saved money (unless you're looking at cost-to-state of an entire life rather than cost-to-state for medical/funeral costs, but that's outside the scope of this)

[chrislipa]

Dead customers can't be returning customers?

[JohnTHaller]

Merchants bear the brunt of the cost of fraud. Credit card companies and consumers bear none. And as the credit card company oligopoly currently* has no viable replacement, merchants are stuck bearing the cost of fraud.

* the replacement will be when folks like Square, PayPal, etc grow large enough that merchants can replace credit card systems with them for a decent % of customers

[fit2rule]

Only you are able to reprogram your Coin, it is paired with your phone. Two things which admittedly do get lost together, but still ..

[snitko]

Why not just pay with Bitcoin? Really, after Bitcoin, using credit cards seems like an invitation to be robbed.

[andrewfong]

Because chargebacks are relatively easy with credit cards and the merchant bank bears the cost of fraud. With Bitcoin, if you steals your coins, there's no way to undo that.

On top of that, there's all the convenience issues that plastic brings when out in the real world. Using bitcoin requires a computing device of some sort that's significantly less robust than Coin, a chip & pin card, or a piece of plastic.

[jes5199]

it takes too long to confirm a transaction with bitcoin. Also the risk of having your bitcoins stolen is high - the reason credit cards exist is because reversible transactions are preferred to using cash. The credit card company acts as an escrow system.

I could imagine someone making a credit card that was denominated in bitcoin, but that would be a whole different technology stack than using raw bitcoins.

[JohnTHaller]

Because Bitcoin as a replacement for credit cards is currently just a pipe dream since less than 0.01% of people even know what it is, let alone have it. That plus its insane volatility is why it's only accepted by a handful of online merchants, mostly only for virtual goods and mostly just for show.

[serf]

that insane volatility should drop with increased adoption.

[maxmcd]

Couldn't they just require the name/address to match for all cards? Including the one you used to pay for the device?

[berberous]

The FAQ says that they do indeed require the names to match.

[madsushi]

Easier than pen and paper? Or the camera on their phone?

[bnycum]

I assume it's easier in the sense that your waiter could add your card to his Coin, then immediately go buy a TV at the store with it. Not having to make a fake card or needing the address of the card holder to use it online.

[jerf]

As with some other people in cousins comments to your post, I think you may not realize that that attack is already perfectly feasible today. By "feasible" I mean real criminals already do this today, not merely that some academics hypothesize that it may be possible. It's all very off-the-shelf stuff. If you're worried about this attack, the solution isn't "don't use Coin someday in the future", it's "don't use anything with a magnetic strip, today".

[walshemj]

Its a bit hard to read the mag stripe by eye - unless your a mutant in which case call in Phil Coulson's team stat

[andrewfong]

The majority of credit cards still have actual numbers on them.

[q3k]

Except that the CVV from the magstripe is missing - wich means ypu can only use the printed CNP CVV, ie. only use the card data for internet transactions.

[tomasien]

It's so easy to steal someone's credit card that I can name at least 10 people off the top of my head who have had it done, and I'm not even trying. I myself have had it happen twice. The good news is, you just cancel it, there's a paper trail to track the people who did it, and you have fraud protection.

All of that can be done better though when you get off the credit card rail, which is what I'm working on. [e-mail] if you wanna talk

[MichaelGG]

Pretty sure a magstripe writer isn't really that hard to get.