If you can read this, either the style sheet didn't load or you have an older browser that doesn't support style sheets. Try clearing your browser cache and refreshing the page.

(The Consumerist)   About that whole "enter your zip code" security thing when swiping your credit card   (consumerist.com) divider line 70
    More: Fail, Redbox, credit cards, CBS Sacramento  
•       •       •

9340 clicks; posted to Business » on 19 Oct 2013 at 8:43 AM (1 year ago)   |  Favorite    |   share:  Share on Twitter share via Email Share on Facebook   more»



70 Comments   (+0 »)
   
View Voting Results: Smartest and Funniest

First | « | 1 | 2 | » | Last | Show all
 
2013-10-19 08:33:30 AM  
I always enter a bogus zipcode, and most of the time it never matters.

Gas pumps seem to catch it more than anything else.  But theaters, restaurants and most shops don't know the difference.
 
2013-10-19 08:48:58 AM  
That's to verify that you're you and not someone who picked up your credit card on the sidewalk and decided to go crazy renting DVDs for $1.20 per night.

Actually the first thing someone would do is go to something like a red box to see if the card has been cancelled already.

/too bad entering the zip isn't a layer of security tho
 
2013-10-19 08:53:08 AM  
I worked for a few years at a business where one of my jobs was manually typing in credit card information to handle payments. What I've found from my somewhat limited experience with it is that not all credit card companies do it. Sometimes it would ask for the zip code, sometimes not. Sometimes it would ask for the s-code, sometimes it wouldn't.

There's also the case where the card isn't actually being checked 'live', meaning that all it's doing is sending out a check for a quick pre-authorization (again, something I used to do for a different job). In most cases the pre-auth only checks that the funds are there, so it may not check the zip code against the companies' records at that point, but it may flag it later when the pre-authorized charge is settled (something we would do at closing time)

Of course there also remains the possibility that they're just collecting the zip codes for marketing purposes, in violation of the law in some states. But there's also a valid reason why the zip code check doesn't work in some cases.
 
2013-10-19 09:02:41 AM  
A viewer of CBS Sacramento discovered that he could type in pretty much any random five-digit number and the kiosk would let the credit card transaction go through. So why does Redbox ask for it?

Because it's a zero-cost deterrent for fraudulent credit card use.  Same reason city buses have fake cameras mounted on the inside of the roof.
 
2013-10-19 09:05:18 AM  
Would it kill them to fix this little gem of an interaction?:

Debit or Credit? Credit
<swipe card>
Debit?
FARK YOU DID I STUTTER?!?!?!?
 
2013-10-19 09:05:58 AM  
Another dysfunction of the American market place, another thing that means nothing except when it does, to someone, somewhere, but especially not us.
 
2013-10-19 09:29:26 AM  
It's not very strong security anyway. If you find a CC, it's most likely in a wallet with other ID that have your zip code on it already. If you find a CC just laying on the ground by itself, chances are good that entering the zip code of where you found it would be correct (or the next zip over). Three tries will probably net you access to most cards.
 
2013-10-19 09:35:47 AM  
Meh. Let them hold out a wrist, receive a tap, and go on with their lives.

Our laws have no teeth.
 
2013-10-19 09:59:32 AM  
Isn't it kind of silly to ask for a zip code when the microchip on the card already requires a PIN?

Oh wait, USA. Never mind, carry on.
 
2013-10-19 10:13:09 AM  
From now on, my zip code will be 80085.
 
2013-10-19 10:14:00 AM  
Canadian here. Whenever I'm in the states and try to fill up- well first of all why are ALL Your gas pumps pay before you pump?? Did everyone start stealing gas or something? There isn't one single pump where I DON'T have to pay first (none that I've found anyways, so that means it isn't available anywhere ;) )

Anyways, putting my card in, it never recognizes that it's Canadian, and then asks for a zip code. I enter 90210, and it comes back with an error. Then I try to enter my postal code hoping that it'll understand the alphanumerical-ness. No dice. So I have to walk my ass inside, pay at the cash, then go out and pump gas. However you better guess right, because they won't refund your card. You have to call and get your cc company to fight them for it.

/I had a point here somewhere...
 
2013-10-19 10:28:10 AM  

sure haven't: Anyways, putting my card in, it never recognizes that it's Canadian, and then asks for a zip code.


Enter the 3 numbers from your postal code (ignoring the letters) followed by '00'.
 
2013-10-19 10:29:36 AM  

sure haven't: Canadian here. Whenever I'm in the states and try to fill up- well first of all why are ALL Your gas pumps pay before you pump?? Did everyone start stealing gas or something?


Yes, they did.  It depends, like many things here, on where you are.  The town I live in, small town, maybe 15k in city proper, you don't have to.  Next county over, town of 90k or so, its a local ordinance that you have to pay first.  I guess the city decided its better to deter than have cops chasing after people for petty shop lifiting.
 
ZAZ [TotalFark]
2013-10-19 10:31:38 AM  
It could be a buggy implementation of a legitimate fraud detection system. I remember a unix login program that forgot to verify the password. If you typed a bad password you could login to the computer but would not be authenticated to the network.
 
2013-10-19 10:36:13 AM  
If a zip code (any zip code) is entered for a credit transaction you will get a better rate for a kiosk based transaction, but only the proper zip code will protect the merchant from chargebacks. In this case redbox is paying less to the credit card company, but the customer could turn around and say they never authorized the charge and get their money back.
 
2013-10-19 10:43:00 AM  
Zip code is being collected for credit card validation; under some circumstances, though, it's not actually used.

Also, I'd guarantee that Redbox isn't storing any card info including zip code, thy just pass it through to their payment processor. Consumerist editors talking out their asses again.
 
2013-10-19 11:00:28 AM  

sure haven't: Canadian here. Whenever I'm in the states and try to fill up- well first of all why are ALL Your gas pumps pay before you pump?? Did everyone start stealing gas or something? There isn't one single pump where I DON'T have to pay first (none that I've found anyways, so that means it isn't available anywhere ;) )

Anyways, putting my card in, it never recognizes that it's Canadian, and then asks for a zip code. I enter 90210, and it comes back with an error. Then I try to enter my postal code hoping that it'll understand the alphanumerical-ness. No dice. So I have to walk my ass inside, pay at the cash, then go out and pump gas. However you better guess right, because they won't refund your card. You have to call and get your cc company to fight them for it.

/I had a point here somewhere...


You've never been to upstate New York or some places in Vermont then.

/ Stewart's is awesome.
 
2013-10-19 11:04:35 AM  

sure haven't: Canadian here. Whenever I'm in the states and try to fill up- well first of all why are ALL Your gas pumps pay before you pump?? Did everyone start stealing gas or something? There isn't one single pump where I DON'T have to pay first (none that I've found anyways, so that means it isn't available anywhere ;) )

Anyways, putting my card in, it never recognizes that it's Canadian, and then asks for a zip code. I enter 90210, and it comes back with an error. Then I try to enter my postal code hoping that it'll understand the alphanumerical-ness. No dice. So I have to walk my ass inside, pay at the cash, then go out and pump gas. However you better guess right, because they won't refund your card. You have to call and get your cc company to fight them for it.

/I had a point here somewhere...


Only thing I can think of is to ask your credit card company if they use a generic US zip code for all authentication based transactions when you head down south (or suggest they do, if they don't, since that's what's causing you frustration at the pump).
 
2013-10-19 11:12:15 AM  

Ivo Shandor: Enter the 3 numbers from your postal code (ignoring the letters) followed by '00'.


No sh*t eh, I'm gonna try that.

 

DarkSoulNoHope: Only thing I can think of is to ask your credit card company if they use a generic US zip code for all authentication based transactions when you head down south (or suggest they do, if they don't, since that's what's causing you frustration at the pump).


And this. Many thanks guys.
 
2013-10-19 11:12:26 AM  

sure haven't: Canadian here. Whenever I'm in the states and try to fill up- well first of all why are ALL Your gas pumps pay before you pump?? Did everyone start stealing gas or something? There isn't one single pump where I DON'T have to pay first (none that I've found anyways, so that means it isn't available anywhere ;) )

Anyways, putting my card in, it never recognizes that it's Canadian, and then asks for a zip code. I enter 90210, and it comes back with an error. Then I try to enter my postal code hoping that it'll understand the alphanumerical-ness. No dice. So I have to walk my ass inside, pay at the cash, then go out and pump gas. However you better guess right, because they won't refund your card. You have to call and get your cc company to fight them for it.

/I had a point here somewhere...


Better off paying inside anyways. Some gas stations will put a hold up to $150 on your card, even if you only get a few bucks worth of gas.
 
2013-10-19 11:13:26 AM  

Nuclear Monk: Would it kill them to fix this little gem of an interaction?:

Debit or Credit? Credit
<swipe card>
Debit?
FARK YOU DID I STUTTER?!?!?!?


Me at Home Depot last night:
1 Swipe Debit card
2 Choose "Credit" because I never can remember my PIN
3 "Please enter your PIN"
- Thinking I pressed debit on accident, I hit cancel, and return to 1.  The same thing happened.  The cashier just stares blankly at me.  I sigh, pull out a credit card instead and complete the transaction.
 
2013-10-19 11:14:39 AM  

Saners: Better off paying inside anyways.


Thieves put card-readers on gas pumps. Pay inside.
 
2013-10-19 11:25:43 AM  

Nuclear Monk: Would it kill them to fix this little gem of an interaction?:

Debit or Credit? Credit
<swipe card>
Debit?
FARK YOU DID I STUTTER?!?!?!?


I suspect there's still a few banks that charge the customer a fee for one, but not the other.

I used to say "Whichever works better for you", which would usually be debit since the merchant gets charged a lot less.  But I found that debit transactions show up on my bank account as "POS Sale 12345 Main Street" and I'd have to go reverse search the address to figure out where I spent that money.  Credit transactions show up as "Checkcard:  Bob's Bait and Sex Toy Shop".
 
2013-10-19 11:29:24 AM  
Just implement chip and pin like the rest of the world then.
 
2013-10-19 11:29:59 AM  
Has anyone tried entering 17921 for a zip code? That was the zip for Centralia Pa.
 
2013-10-19 11:36:48 AM  

Nuclear Monk: Would it kill them to fix this little gem of an interaction?:

Debit or Credit? Credit
<swipe card>
Debit?
FARK YOU DID I STUTTER?!?!?!?


That's just them trying to avoid CC fees.  They really really want you to use your debit card.
 
2013-10-19 11:42:12 AM  
It's not just Redbox that does this. One of the local gas stations here requires that I enter my zip code. I've often wondered why do they need my zip code? They're in the same county as me. Are they planning on mailing literature to me in the future?
 
2013-10-19 11:53:01 AM  

sure haven't: Canadian here. Whenever I'm in the states and try to fill up- well first of all why are ALL Your gas pumps pay before you pump??


Yeah, drive-offs are an issue in some places.
 
2013-10-19 11:53:39 AM  
One of the gas stations I go to frequently asks for your zip code.  One time the guy entered it in wrong and had to ask me again.  When I got home there was a voice mail from my credit card company asking me to call them.  They wanted to alert me to possible fraud on my credit card and verify that it was actually me making the purchase.

So I guess it actually works sometimes?
 
2013-10-19 12:00:11 PM  

mrlewish: Nuclear Monk: Would it kill them to fix this little gem of an interaction?:

Debit or Credit? Credit
<swipe card>
Debit?
FARK YOU DID I STUTTER?!?!?!?

That's just them trying to avoid CC fees.  They really really want you to use your debit card.


Do people suddenly reconsider?

Ho-hum...I guess I'll do a credit card transaction.  Swipe....hmmm.....it's asking me again.  My god, what have I done?  My whole world view has suddenly been torn asunder by BP's gas pump begging me to reconsider.  That's it!  I shall go forth into this world as a debit disciple.  Praise be to BP, for they have truly shown me the way.

Frozboz: Nuclear Monk: Would it kill them to fix this little gem of an interaction?:

Debit or Credit? Credit
<swipe card>
Debit?
FARK YOU DID I STUTTER?!?!?!?

Me at Home Depot last night:
1 Swipe Debit card
2 Choose "Credit" because I never can remember my PIN
3 "Please enter your PIN"
- Thinking I pressed debit on accident, I hit cancel, and return to 1.  The same thing happened.  The cashier just stares blankly at me.  I sigh, pull out a credit card instead and complete the transaction.


And oh yes...this...the 2 color monty.  Is it green to proceed with a credit transaction, or red to cancel the debit transaction on the way to a credit transaction.
 
2013-10-19 12:09:19 PM  

mr_a: I always enter a bogus zipcode, and most of the time it never matters.

Gas pumps seem to catch it more than anything else.


They do, but it's meaningless if there's weakness elsewhere in the system. I moved a while back, and out of habit entered my old zip code at the pump, which caused it to refuse the sale. I went into the convenience shop and handed over my card, where the clerk happily sold me gas without asking for ID or for the correct zip code.
 
2013-10-19 12:21:11 PM  

sure haven't: Canadian here. Whenever I'm in the states and try to fill up- well first of all why are ALL Your gas pumps pay before you pump?? Did everyone start stealing gas or something? There isn't one single pump where I DON'T have to pay first (none that I've found anyways, so that means it isn't available anywhere ;) )

Anyways, putting my card in, it never recognizes that it's Canadian, and then asks for a zip code. I enter 90210, and it comes back with an error. Then I try to enter my postal code hoping that it'll understand the alphanumerical-ness. No dice. So I have to walk my ass inside, pay at the cash, then go out and pump gas. However you better guess right, because they won't refund your card. You have to call and get your cc company to fight them for it.

/I had a point here somewhere...


FWIW, it's been my experience that the stations closest to the highway (think interstate exists) tend to ask for a zip more than the ones farther away from it.  For instance, I-26 runs just a couple miles from my home, and some of the stations at the exits ask for it, but the two around the corner from me don't.

/YMMV
 
2013-10-19 12:33:03 PM  
I know my gas station checks it, since I mis-entered it one time and it refused the charge.
 
2013-10-19 12:34:58 PM  

Ivo Shandor: sure haven't: Anyways, putting my card in, it never recognizes that it's Canadian, and then asks for a zip code.

Enter the 3 numbers from your postal code (ignoring the letters) followed by '00'.


I've successfully used this method with Visa. MasterCard supports it now too. Not sure about Amex or others.

http://www.theglobeandmail.com/life/travel/travel-news/finally-canad ia ns-able-to-pay-at-us-pumps-with-credit-again/article13463053/
 
2013-10-19 12:35:10 PM  

mrlewish: Nuclear Monk: Would it kill them to fix this little gem of an interaction?:

Debit or Credit? Credit
<swipe card>
Debit?
FARK YOU DID I STUTTER?!?!?!?

That's just them trying to avoid CC fees.  They really really want you to use your debit card.


I've wondered what happens if you lie on that question. Might be fun to find out.
 
2013-10-19 12:43:24 PM  
I can't recall the last time I got gas at a station where the machine didn't ask for my zip.

When I first started encountering those types of pumps, I thought it was a little odd.  Asking for a zip just doesn't seem like it's a high barrier of security.  More of a speed bump that might stop a minute amount of unauthorized transactions.

But as has already been stated, if you were going to try and use a stolen or lost card, more likely than not, it seems like you'd have a good idea of what the zip code(s) in the area are.  It wouldn't take many tries to figure it out.  Hell, even if you didn't know the local zip code, at most gas stations, you might even be able to figure it out from the fact that those will be the number keys with the most evidence of wear and tear.
 
2013-10-19 12:50:49 PM  
I use 90125.  It always seems to work ;)

khongthe.com
 
2013-10-19 01:07:09 PM  
Its almost like they want to figure out where their customers are and deploy their kiosks appropriately.
 
2013-10-19 01:28:18 PM  

sure haven't: Canadian here. Whenever I'm in the states and try to fill up- well first of all why are ALL Your gas pumps pay before you pump?? Did everyone start stealing gas or something?


Yes

It pretty much became universal around 2008 when gas prices spiked and there was a huge nationwide wave of gas drive-offs.  Despite laws making that punishable by driver's license suspension, the easiest way to end the problem was to just make it so a gas pump doesn't work until it's already paid for.
 
2013-10-19 01:31:30 PM  
Also, I'm pretty sure that redbox doesn't actually charge the card until the DVD is returned; so it may be set up in a slightly dumb way to not check during the pre-auth phase when you actually get the DVD, but only when the charge actually goes through
 
2013-10-19 01:41:25 PM  

Gdiguy: Also, I'm pretty sure that redbox doesn't actually charge the card until the DVD is returned; so it may be set up in a slightly dumb way to not check during the pre-auth phase when you actually get the DVD, but only when the charge actually goes through


Any time I rent from Redbox, I see a pending transaction for the first night in a pre-authorization style entry on my bank account
 
2013-10-19 01:55:45 PM  
I used to work for a credit card processor.  The ZIP Code is just one layer of security that the cardholder's bank or merchant can use to deny a credit card transaction if it's incorrect - but, few do.  Credit card transaction rates (the percentage a merchant is charged on the transaction) are based on the level of security.  Just requiring a zip code alone will often give a merchant (Redbox) a better rate on the transaction.  Even if the ZIP doesn't match... just asking for it could help them save money b/c it's considered less risky.  If the ZIP matches what's on file, it could get them an even better rate.  The cardholder's bank knows what info was submitted and can deny the transaction if the ZIP is wrong.   The merchant knows when the transaction comes back whether the ZIP matches what the bank has on file or not (It's a simple Yes/No reply).  The merchant (Redbox) can choose not to take the card if the ZIP comes back as being incorrect.

If you're putting in the wrong ZIP to "fool the machines", that's fine... but most likely all they're doing is using address verification to get cheaper rates.
 
2013-10-19 02:01:56 PM  

offmymeds: It's not just Redbox that does this. One of the local gas stations here requires that I enter my zip code. I've often wondered why do they need my zip code? They're in the same county as me. Are they planning on mailing literature to me in the future?


It's used in place of a signature.
 
2013-10-19 02:14:38 PM  

phillydrifter: Saners: Better off paying inside anyways.

Thieves put card-readers on gas pumps. Pay inside.


http://www.gobankingrates.com/credit-card-rates/5-tried-true-strateg ie s-protecting-credit-card-gas-pump/

relevant
 
2013-10-19 02:21:02 PM  

KingRamze: I used to work for a credit card processor.  The ZIP Code is just one layer of security that the cardholder's bank or merchant can use to deny a credit card transaction if it's incorrect - but, few do.  Credit card transaction rates (the percentage a merchant is charged on the transaction) are based on the level of security.  Just requiring a zip code alone will often give a merchant (Redbox) a better rate on the transaction.  Even if the ZIP doesn't match... just asking for it could help them save money b/c it's considered less risky.  If the ZIP matches what's on file, it could get them an even better rate.  The cardholder's bank knows what info was submitted and can deny the transaction if the ZIP is wrong.   The merchant knows when the transaction comes back whether the ZIP matches what the bank has on file or not (It's a simple Yes/No reply).  The merchant (Redbox) can choose not to take the card if the ZIP comes back as being incorrect.

If you're putting in the wrong ZIP to "fool the machines", that's fine... but most likely all they're doing is using address verification to get cheaper rates.


Yep. That is the correct answer. The same way that swiping a card gets a better rate than punching the numbers in.
 
2013-10-19 02:22:57 PM  
The Michaels craft store chain got in trouble in Massachusetts for collecting zip codes from in-person credit card transactions, recording zip with customer names, searching commercially available databases for mailing addresses and then mailing ads.  The highest court in that state said this year that the zip code is personal information and merchants can't collect it unless the transaction requires them to ship you your bait and sex toys.
 
2013-10-19 02:24:01 PM  

sure haven't: Canadian here. Whenever I'm in the states and try to fill up- well first of all why are ALL Your gas pumps pay before you pump?? Did everyone start stealing gas or something? There isn't one single pump where I DON'T have to pay first (none that I've found anyways, so that means it isn't available anywhere ;) )


Yes.  It got very, very bad here.  They'd get multiple ones a day at a lot of station.  Considering a lot of stations lose money on gas (the actual owners), if people are driving up and driving off, even a few can wipe out a small business' profits for the day.
 
2013-10-19 02:44:19 PM  

Nuclear Monk: mrlewish: Nuclear Monk: Would it kill them to fix this little gem of an interaction?:

Debit or Credit? Credit
<swipe card>
Debit?
FARK YOU DID I STUTTER?!?!?!?

That's just them trying to avoid CC fees. They really really want you to use your debit card.

Do people suddenly reconsider?

Ho-hum...I guess I'll do a credit card transaction. Swipe....hmmm.....it's asking me again. My god, what have I done? My whole world view has suddenly been torn asunder by BP's gas pump begging me to reconsider. That's it! I shall go forth into this world as a debit disciple. Praise be to BP, for they have truly shown me the way.


That annoys me too.

The next time it happens I'm going to scream at the machine FARK YOU DID I STUTTER?!?
 
2013-10-19 03:03:01 PM  

kolpanic: Ivo Shandor: sure haven't: Anyways, putting my card in, it never recognizes that it's Canadian, and then asks for a zip code.

Enter the 3 numbers from your postal code (ignoring the letters) followed by '00'.

I've successfully used this method with Visa. MasterCard supports it now too. Not sure about Amex or others.

http://www.theglobeandmail.com/life/travel/travel-news/finally-canad ia ns-able-to-pay-at-us-pumps-with-credit-again/article13463053/


I'll have to try that the next time we drive through the States.

I just realized that using that method, I'll be entering 00000 for my zip.
 
2013-10-19 03:05:06 PM  

SMB2811: offmymeds: It's not just Redbox that does this. One of the local gas stations here requires that I enter my zip code. I've often wondered why do they need my zip code? They're in the same county as me. Are they planning on mailing literature to me in the future?

It's used in place of a signature.


Okay, but if any five digit number can be punched in and accepted (as stated in the article) then that sort of defeats the purpose of having to enter your zip code as a security measure.
 
Displayed 50 of 70 comments

First | « | 1 | 2 | » | Last | Show all

View Voting Results: Smartest and Funniest


This thread is closed to new comments.

Continue Farking
Submit a Link »






Report