5 ms·

> I can't win the complaint. The card was stolen, the £6 belongs to the original card owner, no question. This is so wrong. Business owners, on average, have l

> I can't win the complaint. The card was stolen, the £6 belongs to the original card owner, no question. This is so wrong. Business owners, on average, have little to no information or power to deal with this. The only agencies that have ultimate ability to deal with fraud are the card issuers and banks. IIRC, it was Bruce Schneier who first clearly articulated this for me. By placing all fraud risk on the issuers, they're fully incentivized to fix the problem as well as possible. But instead when small (or even large) business customers are subjected to ridiculous fraud charges as described in Remy's article, fraud is transformed into a kind of externalized cost imposed by these same issuers.

amelius 11y ago
Card issuers should make sure that cards are password-protected in the first place.
hughw 11y ago
Does Paypal ameliorate the problem? Is there less fraud if you accept Paypal only?
- cpncrunch 11y ago
  Yes, paypal seems to have very good fraud detection. I've been using them for the last 9 years for mostly $10 transactions (about $30k a year or so) and I don't think I've had a single fraudulent transaction in that time. Before paypal I used worldpay, and although their support is infinitely superior (paypal's support sucks balls), I did have a few fraudulent transactions a year. Also, paypal's refund fee is just $0.30. (Not sure if it costs any more for a chargeback).
fixermark 11y ago
But it's not in the interest of Stripe et. al. to subsidize fraud. The fact that they have the penalty set so high is because they don't want services like JSBin acting as basically defrauded card authentication gateways (as a side effect of their legitimate business). Unfortunately for Remy Sharp, he built a fraud enabling system that doubled as a pastebin, and the financial system responded as appropriate for an open fraud portal. It's a bit like calling foul when email gateways start mistrusting your server because it's a proven open-relay node for spam. Not fair, but the system has to protect itself and its users.

amelius 11y ago

Card issuers should make sure that cards are password-protected in the first place.

hughw 11y ago

Does Paypal ameliorate the problem? Is there less fraud if you accept Paypal only?

cpncrunch 11y ago
Yes, paypal seems to have very good fraud detection. I've been using them for the last 9 years for mostly $10 transactions (about $30k a year or so) and I don't think I've had a single fraudulent transaction in that time. Before paypal I used worldpay, and although their support is infinitely superior (paypal's support sucks balls), I did have a few fraudulent transactions a year. Also, paypal's refund fee is just $0.30. (Not sure if it costs any more for a chargeback).

fixermark 11y ago

But it's not in the interest of Stripe et. al. to subsidize fraud. The fact that they have the penalty set so high is because they don't want services like JSBin acting as basically defrauded card authentication gateways (as a side effect of their legitimate business). Unfortunately for Remy Sharp, he built a fraud enabling system that doubled as a pastebin, and the financial system responded as appropriate for an open fraud portal. It's a bit like calling foul when email gateways start mistrusting your server because it's a proven open-relay node for spam. Not fair, but the system has to protect itself and its users.