Truevisions rejected U.S.-issued Visa credit card with security chip

[NancyL]

Last month our U.S. credit union cancelled everyone's Visa credit cards and re-issued new cards with security chips and new account numbers. It was a PITA because they sent the new cards a week before cancelling the old cards -- not enough time for our U.S. mail forwarding service to get them to us and then I discovered just how many services I had set up on auto-pay with that old Visa account number when I got rejection emails during the next few weeks! But, OK never mind, I'll take them at their word that the new cards, with the new account numbers and little chips are somehow better.

So far, Hubby and I have continued our boring retiree life in Chiang Mai using the new cards at Central Dept Store, Rim Ping and Tops Supermarkets, CM Ram Hospital, a couple of places to buy electronics, etc. But, I hit a snag today. I went to pay our monthly bill at Truevisions and the new card was rejected by the card reader. They said the Thai message said "not enough money". It's not a debit card! I had just used the card at Tops! No prob!

I went home and checked on-line to be sure our June payment hit the Visa account. Sure, no problem. We pay off the Visa card every month, in full.

This is the first month I've tried to use the new card with the chip at Truevisions.

I called the Visa people and they were no help. They said our account was just fine, there was "enough money".

Has anyone else tried to use a credit card with a smart chip for security and encountered problems?

[Soutpeel]

Has anyone else tried to use a credit card with a smart chip for security and encountered problems?

I use one all the time issued in Singapore and never had an issue, suspect its the card reader that's the problem

[NancyL]

Yup, done a little poking around the internet and discovered some nice info on a Frequent Flyer forum. Not about Truevisions, per se, but about this issue. Sigh. I guess I'll return to the Truevisions office tomorrow and do them a favor by getting them up to speed, either in using their card readers properly or in changing out their outmoded card readers.

Here's what we used back when I ran a retail business. Worked just great!

Edited June 22, 2015 by NancyL

[Pib]

Sounds like it was probably just an issue with the TrueVisions Point of Service (POS) machine. Most of my U.S. cards now have chips and I use my chipped credit cards almost daily and my debit cards several times per month.

However, I will say when I got one of my Pentagon Federal Credit Union chipped card (the wife got hers also) the chipped portion would not work on my card at anywhere (Lotus, Big C, Foodland, PTT, etc.)...tried using it around 6 times...the chip would never work and then the checkout clerk would just swipe the card and it worked....when using the magnetic stripe it would worked no problem every where. The wife's chipped card (same number as mine) worked fine with the chip...checkout clerks never had to try using the magnetic stripe. And these PenFed cards default to Chip & Signature which means no PIN entry is required...just insert...receipt for signature prints out...you sign the receipt...done.

I called PenFed to bend their ear about my new card not working with the chipped portion...they said it's probably a bad chip....but I pressed them hard to check and ensure it was not just a setup problem on "their end." Was on the phone for around 20 minutes with them....they said the checked "on their end that the card was setup correctly" but will mail me a new card. Next day I gave the card another try and magically the chipped portion was now working...insert card into POS machine...receipt for signature prints out....to me that says something was setup wrong on their end, they didn't want to admit it, and the chip and magnetic stripe are managed differently. The replacement card did show up in the mail about 3 weeks later (same card number & PIN) but I never tested it...just note coded it as a spare card and locked it away in my safe.

And just last week my Schwab chipped debit card simply would not work in a Krungsri ATM...insert it...after 15 seconds of so waiting for the PIN entry screen to appear my card would be popped out. I reinserted several times with the same results. Put my St Farm chipped debit card in and it worked fine. I then went to another Krungsri ATM and the Schwab card worked fine in that ATM...don't know if that one Krungsri ATM that would not read my Schwab card had an issue (remember that same ATM read my SF chipped card no problem) or it's an issue with my Schwab card. Time will tell as I use the Schwab chipped debit card more...I have used it once again in another Krungsri ATM and it worked fine.

[NancyL]

Called the credit union that issued the Visa card after they opened for the day. They were more helpful that the "emergency" 800 number on the back of the Visa card.

Yes, it's a problem with the POS machine at Truevisions. And it's good I called because they'd put a hold on the card because of all the times that Truevisions kept ramming it into the machine and having it rejected. They pointed out that Truevisions should have the capability to swipe the magnetic strip, also. Come to think about it, there was a similar issue the first time I used the card at Tops Supermarket, but the cashier called in a customer service manager and she did some magic work on the cashier's screen and apparently enabled the register so that the magnetic strip reader would work. Rather than just continuing to ram the end of the card into the reader like it would somehow work THIS time, like every staff member was doing at Truevisions.

So today, I'm going back to Truevisions to have a look at their POS machines. I bet I'll find a magnetic strip reader on them -- that they just don't know how to use. This is going to be one of these Thai experiences where I'm just going to be patient and persistent -- tell them I'm doing them a favor and I'm not leaving until they figure out how to process my credit card.

Edited June 23, 2015 by NancyL

[Pib]

Yea, the Visa/Mastercard central phone number can only help with certain issues; other issues they need to refer you to the "card-issuing" bank/credit union/company.

I'm sure the the TrueVisions POS machines will have a card swipe also. And I would also bet they are using their machines frequently for chipped Thai credit cards since almost all Thai "credit cards" are already chipped; however, most Thai "debit" cards are not chipped with the exception of the Bangkok Bank Be1st Smart card with their non-smart Bt1st card not being chipped. Gosh, very, very frequently when I'm in a checkout line like at Lotus, Big C, Foodland, Tops, etc., when a Thai hands the clerk a card it is almost always inserted vs swiped, and the receipt for signature prints out almost immediately and depending on how the store has the POS machine setup they may not have to push any POS buttons at all. When I use my PenFed chipped credit card at Lotus and PTT for example they don't push any buttons....they just insert the card...and a few seconds later the receipt for signature prints out. At other stores the clerk may have to push a button or two or three....all depends on how the store has setup their POS machines like maybe defaulting to a DCC transaction for a foreign card and to tell the machine not to do a DCC transaction...select charge in Thai baht...the clerk needs to select the currency the transaction is to be charged in.

Also, chipped cards and POS machines must initially agree with the verification mode to be used...the mode that is acceptable to both....that is, Chip & Signature, Chip & PIN, Magnetic Strip & Signature, Magnetic Stripe & PIN, etc. From what I read most U.S. chipped cards are setup to default to Chip & Signature but will also happily use Chip & PIN if that is that the merchant wants to use for a purchase transaction. Thai credit cards apparently default to Chip and Signature also for purchases since I can count on one finger over the years I've been in a checkout line, a Thai credit card was used/inserted, and the customer needed to enter a PIN.

Now I mentioned the verification modes because "if" you credit union has setup your card up to use Chip & PIN vs also allowing Chip & Signature, then you are probably going to find few Thai POS machines like at Lotus, Big C, grocery stores, fuel stations, etc., that going to accept the card because the POS machine has been setup to only do Chip & Signature transactions with chipped cards...they will also do the magnetic stripe, but with a chip card if the card demands to use Chip & PIN mode but the POS machine say no I only want to do Chip & Signature mode then the transaction will fail since the two can't come to agreement. You've probably noticed that at Thai store checkout counters the POS machine is not setup for the customer to easily access in order to enter a PIN...usually the POS machine are on a very short cable next to the cash register only accessible by the clerk...that because the POS machines are setup for Chip & Signature and when the clerk inserts the card they get message along the lines of PIN REQD....they been trained that they don't do PIN entry transactions...so then they start reinserting, pushing buttons trying to get it to work, and then finally give up. You the customer ends up thinking your chipped card is bad when in fact it just a POS machine setup/use issue.

So, if you have failure again today with TrueVisions in trying to use the chip the problem could very well be your credit union has the chip setup to only use Chip & PIN but the TrueVisions POS machine don't want to have anything to do with a PIN entry. Then again, it could simply be a clerk training issue but with all the Thai chipped credit cards in use a person would thing they have been trained on the special button pushing required for a chipped card---unless maybe it's a farang card demanding a Chip & PIN transaction. Anyway, good luck.

[NancyL]

The card is set up for chip & signature. That's the way we've been using it all over Chiang Mai since the new cards arrived a couple weeks ago.

Finally got issue resolved with Truevisions. I think it was a training issue with the local store. After three hours (most waiting on hold to several Visa numbers), finally got the security hold taken off the Visa card and was back in business with the card this afternoon. Tested the card at Tops (for the second time today) and determined it worked, so I marched into the Truevisions office and told them the problem was on their end, but don't keep ramming it into their reader time-and-time again because then Visa will think they're a thief and shut down the card like they did yesterday. Instead call someone higher up, a bigger boss, because they are using their POS terminal incorrectly.

The manager of the little six-station store begrudgingly told me to take a seat and she "called someone". Within 30 seconds, her frown disappeared and she was emitting that patented Thai "ahh ahh" sound they make when the fog lifts and the penny drops. She groped around the random electronics on her desk, I think to find a magnetic strip reader. Then she wrote down a phone number, made another call where she was walked thru some steps to do on her computer screen and before I knew it, I was presented with a credit card transaction slip to sign. It was smiles all around. Big apologies and wais to Khun Nancy. Up until then, she and the entire staff had acted like I was trying to use a stolen credit card to pay our TV bill.

Edited June 23, 2015 by NancyL

[Langsuan Man]

Sounds like it was probably just an issue with the TrueVisions Point of Service (POS) machine. Most of my U.S. cards now have chips and I use my chipped credit cards almost daily and my debit cards several times per month.

However, I will say when I got one of my Pentagon Federal Credit Union chipped card (the wife got hers also) the chipped portion would not work on my card at anywhere (Lotus, Big C, Foodland, PTT, etc.)...tried using it around 6 times...the chip would never work and then the checkout clerk would just swipe the card and it worked....when using the magnetic stripe it would worked no problem every where. The wife's chipped card (same number as mine) worked fine with the chip...checkout clerks never had to try using the magnetic stripe. And these PenFed cards default to Chip & Signature which means no PIN entry is required...just insert...receipt for signature prints out...you sign the receipt...done.

I called PenFed to bend their ear about my new card not working with the chipped portion...they said it's probably a bad chip....but I pressed them hard to check and ensure it was not just a setup problem on "their end." Was on the phone for around 20 minutes with them....they said the checked "on their end that the card was setup correctly" but will mail me a new card. Next day I gave the card another try and magically the chipped portion was now working...insert card into POS machine...receipt for signature prints out....to me that says something was setup wrong on their end, they didn't want to admit it, and the chip and magnetic stripe are managed differently. The replacement card did show up in the mail about 3 weeks later (same card number & PIN) but I never tested it...just note coded it as a spare card and locked it away in my safe.

And just last week my Schwab chipped debit card simply would not work in a Krungsri ATM...insert it...after 15 seconds of so waiting for the PIN entry screen to appear my card would be popped out. I reinserted several times with the same results. Put my St Farm chipped debit card in and it worked fine. I then went to another Krungsri ATM and the Schwab card worked fine in that ATM...don't know if that one Krungsri ATM that would not read my Schwab card had an issue (remember that same ATM read my SF chipped card no problem) or it's an issue with my Schwab card. Time will tell as I use the Schwab chipped debit card more...I have used it once again in another Krungsri ATM and it worked fine.

Pib did you get new "chipped" Schwab and State Farm cards when your old ones expired or were they newly issued because of the "chip" technology ?

[Pib]

I can't be sure based on memory since I got the cards about 6 months ago...but I'm fairly sure it was because both were expiring.

[JimGant]

LSM, based on my recent experience, my Schwab ATM/Debit card was replaced with a chipped card at my scheduled renewal time (5/15). However, if your card is not due to expire for a couple of years, they may just early renew with a chipped card per an accelerated schedule to get on board -- which really sucks, if your earlier-than-expected card arrives at your US mailbox as you step on the plane for Thailand. This happened with my Capital One Quicksilver credit card, and my USAA Visa credit card. Fortunately, I was left with my BofA Travel Rewards card, already chipped -- but only had a USAA debit card as a backup (since USAA has put chipping/early renewing their debit cards until later).

Changing direction, the Schwab card is apparently both chip and pin, and chip and signature. This is good, if you plan to travel to chip and pin countries, e.g., EU and Australia. But many US banks seem to be issuing only chip and signature cards (see this example, post 55 http://www.thaivisa.com/forum/topic/828892-bangkok-bank-beworst-card/page-3) -- possibly because of uncertainty about chip and pin (offline) vs. chip and pin (online). But, if you're stuck in a train station that has only chip and pin (offline), you're out of luck if your pin is not embedded in your card's chip -- not a likely occurrence with US issuers. Schwab, at least, has the chip and pin (online) option built in:

The Schwab card is for Online PIN or Chip and Signature transactions. This should make the card work at purchases about 99% of the time, there aren't many offline only PIN systems left, and they are supposed to be converted to allow C&S or online PIN in the near future.

The Schwab card is one of the first USA Debit EMV cards that has multiple applications on it. Besides the usual Visa Application, it has a special US Debit Application that is for USA transactions only and meets the multiple network requirements of the Durbin amendment.

A card's chip can be programmed to prefer one method over another. From the USAA site:

Although USAA Bank chip cards are “signature-preferred,” the terminal may prompt you for a signature, a PIN or neither based on the dollar amount. You can create or change a PIN online on usaa.com or on the USAA Mobile App.

Ok, because all Thai POS machines are also "signature-preferred," I would assume this USAA transaction would be an easy handshake -- "yes, yes." And I would assume most US issued cards, that have both signature and pin options, are also "signature-preferred." So, another easy "yes, yes."

But Thai POS machines have been reading EU "PIN-preferred" cards for sometime now -- but apparently effortlessly defaulting to the backup "signature-preferred" mode in the algorithm. Why these problems with newly issued US cards? Probably some technical issues from a too-hurried (yeah, it's all relative) launch -- and some data distress in the chips from the Durbin amendment.

Question for the technically literate (not me!): I stick my Schwab Debit/ATM card into a Bangkok Bank ATM machine -- one that reads Be1st Smart ATM cards (i.e., the ones with the embedded chip) -- will this ATM machine only process my original card, with the Schwab chip -- or will a clone, having only the swipe information, also work?

[NancyL]

Yes, the U.S. credit-union issued the new chip-and-signature only card before the expiration of the card it replaced. I vaguely remember seeing some announcements on their website but it caught us by surprise in mid-May when we went to use our Visa cards and they were declined. We use them for routine purchases over 300 baht at retail stores, hospitals, etc. Places where the card doesn't leave our sight. One day in mid-May Hubby and I returned home from a hard day of consumerism in Chiang Mai to find we'd both been embarrassed in front of acquaintances by having our card refused. (Thank god there are Bangkok Bank ATMs everywhere and we have a local account.) That's when I returned to the credit union's website and had my own "ah ha" moment.

We have our mail forwarding service set up to send mail at the end of month, but obviously we couldn't wait until the end of May to get the new card. So, I had to send orders for the mail to come early and pull out the American Express cards from the safe.

It wasn't a big inconvenience, but it would have been if we were traveling. Just as having the card cut off because a the Truevisions clerk tried to use it nine ties the wrong way would also have been a major inconvenience if it had occurred while we were traveling. The "security" number at Visa was very user-unfriendly. I tried to call once and waited on hold for over an hour before I gave up. That was the 800 number which I used since I had an internet phone. Next I tried the "international" number which wasn't an 800 number and I figured maybe it would be quicker. I only had to wait 20 minutes on hold for that to be answered

Edited June 24, 2015 by NancyL

[Pib]

Question for the technically literate (not me!): I stick my Schwab Debit/ATM card into a Bangkok Bank ATM machine -- one that reads Be1st Smart ATM cards (i.e., the ones with the embedded chip) -- will this ATM machine only process my original card, with the Schwab chip -- or will a clone, having only the swipe information, also work?

It's all going to depend on how your card-issuing bank has the card setup and their verification rules/servers to handle a certain transaction such as a cash withdrawal or purchase. If like Bangkok Bank's Be1st Smart (chipped) card you can only get "cash issued" in Chip & PIN online mode because that is how Bangkok Bank has their card setup (and at the bank's transaction approval/verification server); however, a purchase can be accomplished by either using the chip or magnetic stripe if the merchant's POS machine allows a purchase using only the magnetic stripe. As long as the card and POS machine agree on the transaction method (ie., Chip & Signature, Chin & PIN, magnetic stripe, with online or offline modes thrown in the mix, etc) then the transaction can continue via chip or magnetic stripe....both the card & POS machine (and card-issuing bank transaction verification servers) must agree.

The bad guy is probably not going to be able to clone the chip portion of the card without some seriously expensive equipment and access to card encryption keys since the chip contains applications (software modules) & encrypted keys used to generate a cryptogram which flows through the Visa/Mastercard network to your card-issuing bank for verification when online verification is required whereas magnetic strip cards don't use applications & cryptogram. The transaction message generated during a chipped transaction is just different from a magnetic stripe transaction....night and day different.

So, if you lose your chipped card which also has a magnetic stripe and the bad guy clones the magnetic stripe porton then whether it's going to work for a cash withdrawal or purchase is all going to depend on how the card-issuing bank has the card and their transaction verification rules/systems setup...and also if the bad guy got your PIN somehow like peering over your shoulder, keypad heat image scan, hidden mini-camera. But even if he does know your PIN and somehow get the info from the magnetic stripe (he stole or found your loss card, got the data from a POS machine, a cloning device hidden in the ATM slot, etc) to make a cloned magnetic stripe, if the card-issuing bank has setup the card only to allow the chipped portion to be used for cash withdrawals then he won't be able to do a cash withdrawal since he couldn't clone the chip portion.

However, he'll probably still may be able to go a shopping spree with the card using the magnetic stripe portion as long as merchant don't get suspicious about why don't the card's chip portion work and only the magnetic stripe work. But like in my earlier post talking about how the chipped portion of my PenFed chipped credit card did not initially work but the magnetic stripe portion worked fine, when the Thai checkout clerk at around a half dozen different stores couldn't get the chip portion to work they simply swiped it to get it to work...swiped it without any apparent concern the card could be a cloned magnetic stripe card. Helping to prevent fraudulent transactions also depends on the merchant but I know the desire to make a sale probably overrides their concern about the small percentage of times a fraudulent transaction occurs with them.

So, I sure hope folks with chipped cards which also have a magnetic stripe (almost all still do as far as I know) don't fall into the mindset their card is now totally safe from fraudulent POS and ATM transactions because it will also depend on card-issuing bank and merchant rules regarding what kind of transaction is acceptable to both. And of course in a card not present transaction like an internet online purchase just having the card's account number and security code off the card is all that's needed to complete the purchase unless maybe the customer or merchant also require another authentication like used in the Verified by Visa or Mastercard Secure code process.

Preaching to the choir I know but just having a card with a chip don't get rid of all the different ways fraudulent card transactions can occur. The bad guys still have plenty of unlocked windows to be able to crawl into your credit/debit card house and sneak off with some of your money....but it's getting harder now as more previously opened windows are being barred-up with chip technology and two-factor verification. And once we get down to just the Chip & PIN window being available and with being pretty well secured, many of the bad guys will need to find a new line of thievery.

[JimGant]

Pib, have you used the chipped Schwab Debit/ATM card in an ATM machine? If so, isn't Bangkok Bank still the only Thai bank with EMV ATM machines? And, according to their on-line literature, the Schwab chipped ATM card, then, should nicely handshake at any Bangkok Bank ATM machine:

Any card featuring an EMV chip can be securely used at any Bangkok Bank ATM nationwide. (Bangkok Bank online info)

But is Bangkok Bank the only one with EMV machines? Maybe there are more EMV machines out there now -- at least there should be according to this Nation article of a few years ago: http://www.nationmultimedia.com/business/Banks-bid-to-thwart-ATM-fraudsters-30219413.html

Another curiosity is when you search for ATM machines in Thailand, using the Visa and MasterCard sites.

http://www.visa.com/atmlocator/index.jsp#%28page:home%29

http://www.mastercard.com/global/atmlocations/#

When you tick the box limiting the search to "chip enabled machines," nothing shows up for Visa, including any of the 9000 Bangkok Bank ATM machines. Same too for MasterCard -- no Bangkok Bank. But the MasterCard search for chip enabled machines did come up with two banks: Thanachart and Ayudhaya banks.

I wonder if Ayudhaya and Thanachart ATMs would accept Visa logoed chipped cards, which both the Schwab and Be1st Smart cards are? Seem to recall that Bank of Ayudhaya does accept Visa cards, as they had different DCC criteria for Visa vice MC, both of which worked in their machines. And if their machine can read a MC/Cirrus chip, it should be able to read a Visa/Plus chip -- since by definition -- EMV -- it's all standardized technology, right? Or maybe not completely standardized.......

Oh well. Another mystery. Maybe your Schwab chipped card is restricted to only Bangkok Bank ATM machines -- at least for now. Of course the tourist coming to Thailand wouldn't know that by searching the Visa ATM location site. As far as he can tell, his new Visa Schwab Debit/ATM card won't work in Thailand. Oh, and I guess Schwab will now be stuck with reimbursing 180 baht ATM fees -- since Aeon, with its 150 baht fee, is apparently now a non player.

[Pib]

I use my chipped Schwab and St Farm debit cards in Krungsri and TMB ATMs since they will spit out Bt30K versus 20K or 25K like most other Thai bank ATMS...as far as I know they are not chipped enabled ATMs. So the card magnetic stripe must still be in use which I guess means if the stripe gets cloned/skimmed a bad guy could get cash and then also go on a shopping spree if desired. Apparently Schwab and St Farm chipped cards allow use of the chip or stripe for cash and purchases if the ATM or POS machine also agree.

Obviously still plenty of security gaps even if your card has a chip on it. Expect it will stay that way until system wide rule/policy changes from end to end are implemented worldwide. Then again the card issuing bank could put restrictions on the card now like how the Bangkok Bank Be1st Smart debit card is set up for getting cash.

[JimGant]

Pib, I guess that makes sense. If Schwab restricted their card to only chip-reading ATM machines (a la Be1st Smart Card), that would be too restrictive, as such machines, including in the US -- and Thailand -- aren't widespread yet. So, there's no added security with this card -- as it can be cloned same as a non chipped card. However, there is added utility, in that should you encounter a machine (like in the EU) that only accepts chipped cards, well, now you're good to go.

I wonder if you erased your magnetic stripe data, would your chipped ATM card then be akin to the Be1st Smart Card and thus now functional only in EMV ATM machines? (Pib, your mission, should you accept..... )

Or, even without erasing the magnetic stripe, if I used an EMV ATM machine -- would skimming be precluded since the ATM machine is sucking the data off the chip, not the stripe?

[Pib]

Pib, I guess that makes sense. If Schwab restricted their card to only chip-reading ATM machines (a la Be1st Smart Card), that would be too restrictive, as such machines, including in the US -- and Thailand -- aren't widespread yet. So, there's no added security with this card -- as it can be cloned same as a non chipped card. However, there is added utility, in that should you encounter a machine (like in the EU) that only accepts chipped cards, well, now you're good to go.

I wonder if you erased your magnetic stripe data, would your chipped ATM card then be akin to the Be1st Smart Card and thus now functional only in EMV ATM machines? (Pib, your mission, should you accept..... )

Or, even without erasing the magnetic stripe, if I used an EMV ATM machine -- would skimming be precluded since the ATM machine is sucking the data off the chip, not the stripe?

I'll let Tom Cruise consider that theme for his next Mission Impossible movie, but I expect your analysis is right in that you would have a card that would only work in an EMV capable ATM. However, on second thought, if you are lining up a Miss Universe type girl (or a Grade A Hooters Girl) to work this mission with me then maybe I can do the test now and let Tom come up with another theme.

Some (not all) of the data coming off a chip is in cryptogram form which won't do a skimmer any good unless they have the decryption codes/certifciates to decode the cryptogram...and only the card issuing bank (or their designee) has those codes/certificates. With portions of the chip encrypted without being able to decrypt in order to make a cloned chip the bad guy is just pissing into the wind. Kinda like some bad guy stealing your encrypted hard drive or cloud storage information...without the secret codes/authentication certificates the bad guy can't clone the chip. And for each chipped card transaction the cryptogram data changes. Anyway, there is some encrypted data and additional authentication going on with a chip which doesn't occur with a magnetic stripe.

A person might wonder then why don't they just store encrypted data on a magnetic stripe...well, a magnetic stripe can not store and run the applications (mini software routines) that is all part of the cryptogram generation process....a chip is really a mini computer circuit able to run the special apps.