18 ms·

Site requests bank logins for online purchases

282 points by technion 10y ago

daurnimator 10y ago
mwave can be pretty shady... I know that their user email list has been either stolen or sold.
late2part 10y ago
Newegg recently did this when I used my American Express. It was a valid referral to Amex's website so I see how folks would fall for this.
- wmf 10y ago
  Newegg redirected to you the Amex site which asked you to enter your password (this is 3D Secure aka SafeKey) or Newegg asked you to enter your Amex password on Newegg's site?
  - 464192002d7fe1c 10y ago
    NewEgg does the former, for sure, with my corporate Amex. Oddly they don't do it with my personal one.
ThrustVectoring 10y ago
>Yes, I've spoken to them. They don't see an issue. This is exactly why the PCI Security Standards Council is a thing. They need to have someone straight up tell them something at least as serious as "fix this, or we will no longer take your credit card payments". Honestly, it's better off being "we aren't taking your credit card payments, you should know better. Fix this and go through a security audit and we might reinstate you".
- daurnimator 10y ago
  But this isn't a credit card payment. This is for direct debit. I've sadly seen all sorts of stuff spring up around this in australia, like https://polipayments.com/Buy https://polipayments.com/Buy (which e.g. is one of the only ways a normal person can pay for a jetstar flight without a credit card surcharge)
  - SyneRyder 10y ago
    It is for a credit card payment - the article mentions they paid via AmEx, their card was charged, and then a day later the website asked them to provide the login to their AmEx account as proof that they are the card holder. (Some/many AmEx cards come direct from AmEx itself, not via a bank.)
    - vacri 10y ago
      Adding to the semantic fun, Amex is a 'charge card', not a 'credit card'.
      - SyneRyder 10y ago
        Huh, so it is! https://www.americanexpress.com/au/content/credit-cards/about-credit-cards/what-is-a-charge-card/ https://www.americanexpress.com/au/content/credit-cards/abou... It appears that AmEx offers both, I have a credit card Amex via my bank that has both a spending limit & doesn't have to be paid off each month (though I always do anyway). But I learned something today, thank you!
      - madeofpalk 10y ago
        Actually, American Express offers both credit cards and charge cards, at least here in Australia. Here, Amex credit cards are far more common than charge cards, at least due to how regular banks can issue an Amex.
      - nommm-nommm 10y ago
        American Express offers something like 30+ products (there's like six versions of the Platinum card alone). Some are charge cards and some are credit cards, they offer a wide variety of both. Fun fact, they have a limit to how many credit cards you have have with them (6?) But no limit on the number of charge cards they will issue you. That's excluding AMEX cards issued by third parties.
  - PostOnce 10y ago
    What's wrong with just sending money from your acct# to their acct# with a reference number/code to identify that transaction as you, other businesses work this way (such as my power and phone bills from diff. companies), but the NZTA for example requires me to use either a credit card (which is fine) or POLi, which is garbage. "no one can see your bank details" it says on https://www.polipayments.com/security https://www.polipayments.com/security which is a fraudulent claim, yeah the hell you can, its being sent to your server, not my bank, this is crazy. It also says they don't cache anything -- all kinds of criminals claim they're up to no harm. POLi says they're up to no harm, why should I believe them? There is NO EXCUSE for using POLi vs. just paying with your bank, if a business offers POLi and not bank transfer directly or a credit card, i would never even remotely entertain doing business with them. NZTA is not a business though, it's a government agency. You can do it in person though (transfer ownership of a car for example), or by CC, so whatever, I don't understand who would ever use POLi, the naive? Hopefully they go bankrupt in the near future.
CGamesPlay 10y ago
> Mwave has identified online banking access as the quickest and easiest method to get access to your banking information. Well, that's certainly true... https://www.mwave.com.au/help/faq/view/76 https://www.mwave.com.au/help/faq/view/76
captncraig 10y ago
I'm confused. They think this is easiest? Either they have someone manually going into bank accounts and making transfers, or somebody actually programmed something to log in via the webpage and do stuff. Neither of those are "quick and easy". Is a paypal button really so hard? Also, how are they not shut down? It seems a single user sending that screenshot to Amex should be more than sufficient to close any merchant account they have.
- madeofpalk 10y ago
  There are services that give you programmatic access to bank accounts from multiple providers. Plaid and Yodlee are examples of these. Not sure exactly how they services work under the hood, but it wouldn't be too dissimilar to just screen scraping.
maerF0x0 10y ago
Pretty sure Expensify and Mint did/do this, no?
- fishtoaster 10y ago
  True, but they have a legitimate need to access your banking info: they need access to your transaction history to function. The absurdity here is asking for bank login info just to make a purchase.
- kjbflsudfb 10y ago
  Yea, but those are different services that utilize the history of your transactions. What reason does an online retailer have to access that level of detail? Shouldn't they simply be able to accept the information on the credit card for the sale?
  - jpalomaki 10y ago
    They can reduce their risk by doing this. For online retailer there is always risks in accepting card payments. (Not saying this is a good idea, just trying to find reasons).
    - kjbflsudfb 10y ago
      Whose risk is reduced? The retailer or the bank? Certainly not the cardholder.
      - 464192002d7fe1c 10y ago
        The retailer and only the retailer. It probably reduces fraud chargebacks to nearly 0.
- adambrenecki 10y ago
  Sites like Mint do this to retrieve your banking history. Asking for banking login details seems to be the standard way of doing that sort of thing. (Don't get me wrong, it's still terrible, but it's not like the banks provide an API you can log in to with oAuth or something.) This is different; mwave is a retailer, all they're doing is receiving a payment.
voycey 10y ago
I don't think PCI compliance is a factor here (unfortunately) - they literally only deal with the taking of cards, I would think Banks should be looking at this pretty skeptically! Although here in Australia there seems to be a lot more "access" available to your bank account than in many other countries (including my native UK), it makes things like integrations nicer but I do wonder just when it's all going to come crashing down!
- voycey 10y ago
  "Usernames and passwords to electronic accounts holding payment data are not sufficiently protected" I correct myself - maybe it does!
  - windowsworkstoo 10y ago
    That is more referring to the user/pass you might use to login retrieve card details say from a card vault for manual processing. Indeed PCI 3.1 (and actually from v2) has a strong requirement for MFA when connecting to the cardholder data environment network. I've lived PCI for a while - I don't think this particular issue would fall under their purview. As per PCI-DSS doc, it is primarily concerned with the secure "acceptance, transmission and storage" of cardholder data. If they use a 3rd party payment processor for their credit/debit card transactions, they will only have a very limited PCI scope (probably just SAQ-A) which will basically say "oh, make sure you send it to your processor over TLS" and don't peek. This particular instance is probably one for the regulatory body, which in our case in Aus would likely be APRA.
- joatmon-snoo 10y ago
  According to the PCI-DSS website, "[i]t is important to note that the payment brands and acquirers are responsible for enforcing compliance, not the PCI council." [1] No idea what the state of actual legally-enforceable penalties is. In the meantime I've tweeted @AmericanExpress about this. [1] https://www.pcicomplianceguide.org/pci-faqs-2/#1 https://www.pcicomplianceguide.org/pci-faqs-2/#1
  - 10y ago
russdill 10y ago
Is this the verified by visa thing? https://usa.visa.com/pay-with-visa/featured-technologies/verified-by-visa.html https://usa.visa.com/pay-with-visa/featured-technologies/ver... Bank passwords alone wouldn't work on any of my accounts because it would detect a different computer and request secondary authorization. It does this by looking at the information the browser sent...and...oh...oh. Geez I hate security theater. Is there anything less secure than the information sent by your browser?
- 464192002d7fe1c 10y ago
  It looks like their own ghetto implementation of Verified by Visa. Verified by Visa is secure because it uses a shared secret (not terribly unlike how JWT works) for the merchant to redirect you to the bank (with information on what card you used), who verifies your username and password and that that is your card, who then redirects you back to the merchant with something that says "Yep, we verified them"
  - 0x0 10y ago
    A big problem with VbV is that the VbV step is usually embedded as an iframe, making it near impossible to verify its authenticity in normal browsers.
    - rconti 10y ago
      I don't think I've EVER had a VBV or Mastercard Securecode transaction actually work. I avoided buying stuff from NewEgg for a couple of years because of this.
    - brazzledazzle 10y ago
      That's ridiculous. Why not just use redirects/posts the way SAML and OAuth does?
    - innocenat 10y ago
      My bank (Thailand) has VbV that requires me to set up personal phrase with the bank and that phrase is shown on VbV page. Also it sends SMS OTP to preregistered mobile number so I doubt any sites could fake that.
rajington 10y ago
This is how Venmo does it so they don't have to make you do the "verify two microdeposits" process, and it's getting more popular. I think because when you give your login you're giving over complete access so bank is not liable for fraud.
- fraserharris 10y ago
  Huh? Venmo requires a bank card - that's all.
- andrewguenther 10y ago
  I never had to do this for Venmo. Is this a recent change?
  - JadeNB 10y ago
    I had to do it when I signed up. That's why the history of my interaction with Venmo was (1) change bank password, (2) accept the money from the person who would only pay using Venmo, (3) change bank password back so that Venmo / late hackers into Venmo databases don't get any ideas.
- msk5293 10y ago
  I think you're referring to Plaid's Auth product, which is for verifying bank accounts. https://plaid.com/products/auth/ https://plaid.com/products/auth/
smaili 10y ago
Why do I need to provide my bank login information (username, password, security questions)? Mwave has identified online banking access as the quickest and easiest method to get access to your banking information. In order to access this information, it is required that you provide your username, password, and any security questions associated with your online banking account.
- mikestew 10y ago
  Mwave has identified online banking access as the quickest and easiest method to get access to your banking information. Well, one can't argue that they're wrong in making that statement. However, that's the reason we don't give random websites the credentials for our "online banking access". :-)
- brazzledazzle 10y ago
  Security questions too. Unbelievable. I wonder how much political good will some poor engineers wasted fighting this.
barbs 10y ago
Wow. And that's an Australian company, based in Sydney no less, not far from where I live... how embarassing.
yashwanthcp 10y ago
This page has a good explanation of why - https://www.mwave.com.au/help/faq/view/24 https://www.mwave.com.au/help/faq/view/24
- cyberferret 10y ago
  That link explains other security measures, but doesn't actually say that they need your bank/credit card login details though?!? (unless I missed it somewhere). "Please note: Due to the rise of credit card fraud and for your security all credit card orders will be subject to detailed security checks requiring further documentation; that may include Driver Licence, CreditCard or bank statements. If your order does not meet our security check requirements, you will be contacted and further credit card security procedures will be implemented. As part of our verification process we will utilise various procedures to ensure ultimate protection to the Credit Card holder. These processes may include but not limited to charging a small amount randomly under $2 requiring confirmation prior to approval; verbal verification via phone or a request for written Authorization, photo identification including valid Driver Licence, Utilities bill or the copy of the credit card or a request for your bank statement displaying the debit entry. Mwave may also use a verification service powered by BankStatements.com.au, the Australian leader in automated bank statement data retrieval. Since 2013 BankStatements.com.au has provided secure, automated data retrieval services to over a quarter of a million Australians as part of their credit applications. "
1ris 10y ago
This is common practice in germany. The whole payment methode "sofortüberweisung" or "sofort" is based on this. You give your login information and a single use password to sofort, they initiate a wire transfer and instantly guarantee the money will arive. (It will arrive 24h later, as banks are allowed to delay it this long and they use it as additional liquidity) Of course this is a security nightmare and or course the ToS of the Banks prohibit you from sharing your login details. But unfortunately they don't enforce their ToS. Recently the cartel office called for making this part of the Banks ToS void, as they would "hinder the adoption of innovative FinTec". But it illustrates how deeply flawed the whole banking sector is that people are willing to give up passwords to third parties or paying insane fees to paypal. IMHO we urgently need a law that makes wire transferees instant, or this dangerous and incredible expensive layers grow for the disadvantage of everybody (expect paypal and sofort).
- candiodari 10y ago
  From the merchant's perspective this works because bank transfers have to be free for both the source and the destination. So banks have an incentive to sabotage this and they will. By contrast bank fees on credit cards can go close to 6% now. That's why you get cashback offers, points, ... on credit card offers. I think a lot of people (but not banks) would be very keen on having regulated fees for transfers. Of course, not banks.
  - dublinben 10y ago
    Credit card transaction fees are regulated at a much lower level in Europe.
    - cmdrfred 10y ago
      I don't understand why we don't do that here. People like the rewards but that only works because the cost of those rewards is subsided by a price increase for everyone, even the people paying cash.
      - 10y ago
jaunkst 10y ago
No. Just no. Not necessary. Its amazing that this is successful by any means.
plantain 10y ago
This is very normal in Australia. All the major airlines do it via POLi[1] [1]https://en.wikipedia.org/wiki/POLi_Payments https://en.wikipedia.org/wiki/POLi_Payments
- abrookewood 10y ago
  I wouldn't say it is common - I've never seen it.
  - _kyran 10y ago
    It's usually the only option to avoid a $5-$70 credit card surcharge. Have you ever paid for a flight online with Jetstar, Tiger or Air Asia? With Jetstar, up until a few months ago, you could do your own bank transfer, but now poli is the only option.
    - fineline 10y ago
      Tiger used to not charge for Mastercard debit. It has changed recently, but still only a matter of cents.
polemic 10y ago
There is a similar system in use in New Zealand and Australia called POLi: https://en.wikipedia.org/wiki/POLi_Payments https://en.wikipedia.org/wiki/POLi_Payments It's discouraged by banks and you don't see it as much as you used to (in NZ anyway).
- elemenopy 10y ago
  It's still around for some things, eg Jetstar. You used to be able to do a manual online transfer to pay for flights but now POLi is the only way you can avoid the $5 credit card surcharge. Grinds on me every time I buy a flight.
- snikch 10y ago
  Poli now manage this via an API with Westpac at least, i.e. you go to Poli, redirect to Westpac and log in, then redirect back to Poli who pull in the info with an API. Very much like an OAuth flow, but I don't know the actual details of it. (I won't get into how oauth isn't a great solution, but at least I'm not exposing my creds to Poli).
cyberferret 10y ago
I am wondering about the legalities of them doing this. I remember back when we had a merchant account for a retail style business, we were repeatedly warned by the bank that we were legally on the hook if we took a customer's credit card information and it got somehow compromised or leaked. This was back in the pre-EFTPOS days when a store would have to keep a carbon copy of the customer card imprint (as well as their signature). We were told to guard those slips like gold, and dispose of them properly when not needed any longer, because with that information, we could in effect impersonate the customer elsewhere. I would say that things have changed markedly these days, but I wonder if the legislation, especially here in Australia, has kept up with that, seeing as a customer's login credentials are effectively the same as having their signature which can be copied?
netfreak111 10y ago
The way I handle this is, I have a dumb checking account which I transfer money to, when I do such transactions. This is more akin to giving a lame email address to websites you don't care.
- bathory 10y ago
  If only banks had a special login for these one-time transactions. One where the history isn't enabled either. In the Netherlands such a system exists, it's called iDEAL
deleted 10y ago
[deleted]
technion 10y ago
Author here. The post was put together in a bit of a rush - I've updated it based on a number of the queries I've seen. Overall, if attention to this issue can stop one other company doing this, I'll be pretty happy.
ctpide 10y ago
So, technically, everyone who does this (provides their login info) violates their terms with the bank I assume, as they probably told you not to share your password with any third party?
wolframhempel 10y ago
As the son of an otherwise amazing woman who falls for every credit card scam to ever hit her inbox I think this is another great reminder of the mindset disparity between techies and the wider public. While we obsess over end-to-end encryption and distributed ledgers the vast majority of people are perfectly happy typing online banking credentials and uploading pins to random websites.
SwellJoe 10y ago
I used to love MWave, many years ago. They were just a fantastic vendor back then. They shipped faster than anyone, handled returns fast and with zero hassle. But, I had a couple of mildly negative experiences (slow to ship, items listed as in stock weren't, etc.) and I stopped buying from them. This, though, is just crazy. I can't believe their merchant bank even allows them to do this.
BrandiATMuhkuh 10y ago
I've talked with a friend working in the IT department of one of Austrias biggest banks (black + yellow colour ;) ) about it. Apparently, banks want to become the identification services of the future. The idea is, that you can only (not sure if that is true) open a bank account with a valid ID, therefore the bank login can identify if a person is real or not. Example: creating a Twitter/FB account with you bank credentials would make your account automatically an approved account (you are you)
- gargarplex 10y ago
  This would solve a lot of problems with online fraud.... I welcome the innovation
- boredpudding 10y ago
  This is true. However, they will not let you enter the details on the page itself. In The Netherlands they are launching 'iDIN'. Which is a bit like OAuth 2.0, so it only provides the webshops with the things they need (and a bit more like age. So yay, privacy issues).
  - BrandiATMuhkuh 10y ago
    One of the problems is when this is done by companies instead of states. A company might remove your access for some, not obvious reasons. Just see current trending HN link http://www.dansdeals.com/archives/98444 http://www.dansdeals.com/archives/98444 where google suspended an account and with that the person could not use the google login anymore. Even for non-google pages. That is scary. A protocol like the EDUROAM system would be nice. In that case, credentials include a domain (usually a Uni name), and with that domain the home uni(bank) can be used as an authentication authority.
biafra 10y ago
> It's that they apply the charge to your card a day before giving you this prompt, leaving you begging for refunds when you refuse. That is strange. I never begged for a charge back with any of my credit cards. When I say the transaction is fraudulent or not authorized by me, I get my money back. Always. The merchant can then sue me, if he thinks different. Is that not what happens with all credit cards in all countries?
Biganon 10y ago
It wouldn't work for me (UBS, Switzerland), I need to punch a code into a special calculator thing in order to login.
celerrimus 10y ago
There was similar attempt here in Poland few years ago, i believe it was sofort used by few online shops owned by German parent companies. This ended very soon, because people here are quite sensitive for such practices and Financial Supervision Authority begin informative action as this was against the law. But what was more important, people quickly realized that they could abuse this process. After such payment, they log in again to bank account and cancelled wired transfer (in most banks we can cancel wired transfer unless it actually leave your account few hours later), and then change their bank password. From point of view of shop, payment was successfull, they process order, but never get cash for it. This was the reason such payment systems ended very soon. Like kybernetyk and other wrote, in Poland we have very modern banking system, there's no problem to make fast wire (up to 15min) using official banking systems or reliable payments systems - you authorize each transaction directly in your bank system without revealing your login details to the middleman.
- tener 10y ago
  Still an issue - tried to buy shoes from Deichmann, they requested my login credentials. WTF.
  - dx034 10y ago
    It's because Germany has a very low credit card penetration rate and the German debit cards cannot be used to guarantee a transaction. Direct debits can be cancelled without any reason for a while and aren't confirmed at all for several days. Unfortunately that doesn't seem to change. The big banking networks have their own debit system that's not compatible with many international online payment systems. There is thus little incentive to switch to sth like Visa/Mastercard debit cards.
    - dozzie 10y ago
      >> Still an issue - tried to buy shoes from Deichmann, they requested my login credentials. WTF. > It's because Germany has a very low credit card penetration rate and the German debit cards cannot be used to guarantee a transaction. No, really: WHAT THE F&CK?!? In Poland we have instant payments services for years already. Each of the services directs the user to their own bank's website (login form). Payment clears instantly and confirmation of the payment (which is machine processable) is sent to the shop in a matter of minutes and with no human employee whatsoever. We have these systems working for years, and the use ranges from buying e-books through food to power tools and clothing in on-line auctions site.
ian0 10y ago
Typically the payment process is be managed by a dedicated payment gateway through an iframe and not the merchant so it should in principle be slightly more secure than it looks. Someone mentioned Poli, one such gateway in Oz. As being shut down is a genuine business risk they strive for legitimacy - id be surprised if it was in-country and operating without at least tacit agreement of banks. Even slow moving banks could counter against this type of browser automation technically - not to mention legal action. No large merchant would fancy negative security related PR either. Honestly speaking - the payments industry is full of hacks like this. Look at US p2p systems built on ACH refunds. Or using 3D Secure for identity verification. Or processing pre-auths of 1 cents and rolling back to add a card to a wallet. Banks are slow and competitive, schemes are just slow, central banks often take a wait-and-see approach. When they get their act together systems like this tend to be replaced or evolved into more sensible and durable solutions - but that can take awhile. And in the meantime everyone tries every avenue possible to reduce fees or provide a better UX (in this case at the expense of consumer protection).
codedokode 10y ago
Is that even legal? What is the difference between this company and phishers collecting bank logins? And doesn't it look suspicious if the logins into different accounts are made from the same IP belonging to the online shop? Some banks in my country even require SMS verification if you are logging in from new IP address.
Karupan 10y ago
There is something similar in India called netbanking. Typically, the site redirects you to a payment gateway, which then redirects you to the bank's site. You enter your username/password only on the bank's site and complete the transaction. It is used quite frequently due to convenience and security. When I moved to Oz and tried to buy something online, I was quite taken aback that I was being asked to enter bank login details on 3rd party sites directly. Felt completely unsafe, so haven't used it yet.
jaaames 10y ago
There's a few places doing this now. I've met the CEO of bankstatements.com.au at a trade conference. Currently it's hard to get data feeds from banks - these guys are logging in, scraping bank statements and then providing them as digestable feeds. Pocketbook is another Australian fintech that was recently acquired that do the same things with credentials. The banks know they're doing it, it's against terms of service, but seem to turn a blind eye. POLi seems to have more reputation but I still feel dirty the few times I've been strongarmed into using it.
sathackr 10y ago
Paypal does the same thing. I added a bank account, and Paypal requested my username and password to automatically verify the two test deposits they made.
- theobon 10y ago
  Is that new. When I signed up, admittedly a number of years ago, they just asked me to tell them the amounts of the two test deposits. No login creds provided.
  - sathackr 10y ago
    At first I thought so, as the first time I saw it was a couple of months ago when I added a new account, but then I googled and found [1] So I guess it's based on your routing number and whether your bank's online system has the proper framework to allow it. [1] http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2009/2/1235839118.html http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2009/2/12...

282 points by technion 10y ago

mwave can be pretty shady... I know that their user email list has been either stolen or sold.

Newegg recently did this when I used my American Express. It was a valid referral to Amex's website so I see how folks would fall for this.

wmf 10y ago
Newegg redirected to you the Amex site which asked you to enter your password (this is 3D Secure aka SafeKey) or Newegg asked you to enter your Amex password on Newegg's site?
- 464192002d7fe1c 10y ago
  NewEgg does the former, for sure, with my corporate Amex. Oddly they don't do it with my personal one.

ThrustVectoring 10y ago

>Yes, I've spoken to them. They don't see an issue. This is exactly why the PCI Security Standards Council is a thing. They need to have someone straight up tell them something at least as serious as "fix this, or we will no longer take your credit card payments". Honestly, it's better off being "we aren't taking your credit card payments, you should know better. Fix this and go through a security audit and we might reinstate you".

daurnimator 10y ago
But this isn't a credit card payment. This is for direct debit. I've sadly seen all sorts of stuff spring up around this in australia, like https://polipayments.com/Buy https://polipayments.com/Buy (which e.g. is one of the only ways a normal person can pay for a jetstar flight without a credit card surcharge)
- SyneRyder 10y ago
  It is for a credit card payment - the article mentions they paid via AmEx, their card was charged, and then a day later the website asked them to provide the login to their AmEx account as proof that they are the card holder. (Some/many AmEx cards come direct from AmEx itself, not via a bank.)
  - vacri 10y ago
    Adding to the semantic fun, Amex is a 'charge card', not a 'credit card'.
    - SyneRyder 10y ago
      Huh, so it is! https://www.americanexpress.com/au/content/credit-cards/about-credit-cards/what-is-a-charge-card/ https://www.americanexpress.com/au/content/credit-cards/abou... It appears that AmEx offers both, I have a credit card Amex via my bank that has both a spending limit & doesn't have to be paid off each month (though I always do anyway). But I learned something today, thank you!
    - madeofpalk 10y ago
      Actually, American Express offers both credit cards and charge cards, at least here in Australia. Here, Amex credit cards are far more common than charge cards, at least due to how regular banks can issue an Amex.
    - nommm-nommm 10y ago
      American Express offers something like 30+ products (there's like six versions of the Platinum card alone). Some are charge cards and some are credit cards, they offer a wide variety of both. Fun fact, they have a limit to how many credit cards you have have with them (6?) But no limit on the number of charge cards they will issue you. That's excluding AMEX cards issued by third parties.
- PostOnce 10y ago
  What's wrong with just sending money from your acct# to their acct# with a reference number/code to identify that transaction as you, other businesses work this way (such as my power and phone bills from diff. companies), but the NZTA for example requires me to use either a credit card (which is fine) or POLi, which is garbage. "no one can see your bank details" it says on https://www.polipayments.com/security https://www.polipayments.com/security which is a fraudulent claim, yeah the hell you can, its being sent to your server, not my bank, this is crazy. It also says they don't cache anything -- all kinds of criminals claim they're up to no harm. POLi says they're up to no harm, why should I believe them? There is NO EXCUSE for using POLi vs. just paying with your bank, if a business offers POLi and not bank transfer directly or a credit card, i would never even remotely entertain doing business with them. NZTA is not a business though, it's a government agency. You can do it in person though (transfer ownership of a car for example), or by CC, so whatever, I don't understand who would ever use POLi, the naive? Hopefully they go bankrupt in the near future.

CGamesPlay 10y ago

> Mwave has identified online banking access as the quickest and easiest method to get access to your banking information. Well, that's certainly true... https://www.mwave.com.au/help/faq/view/76 https://www.mwave.com.au/help/faq/view/76

captncraig 10y ago

I'm confused. They think this is easiest? Either they have someone manually going into bank accounts and making transfers, or somebody actually programmed something to log in via the webpage and do stuff. Neither of those are "quick and easy". Is a paypal button really so hard? Also, how are they not shut down? It seems a single user sending that screenshot to Amex should be more than sufficient to close any merchant account they have.

madeofpalk 10y ago
There are services that give you programmatic access to bank accounts from multiple providers. Plaid and Yodlee are examples of these. Not sure exactly how they services work under the hood, but it wouldn't be too dissimilar to just screen scraping.

maerF0x0 10y ago

Pretty sure Expensify and Mint did/do this, no?

fishtoaster 10y ago
True, but they have a legitimate need to access your banking info: they need access to your transaction history to function. The absurdity here is asking for bank login info just to make a purchase.
kjbflsudfb 10y ago
Yea, but those are different services that utilize the history of your transactions. What reason does an online retailer have to access that level of detail? Shouldn't they simply be able to accept the information on the credit card for the sale?
- jpalomaki 10y ago
  They can reduce their risk by doing this. For online retailer there is always risks in accepting card payments. (Not saying this is a good idea, just trying to find reasons).
  - kjbflsudfb 10y ago
    Whose risk is reduced? The retailer or the bank? Certainly not the cardholder.
    - 464192002d7fe1c 10y ago
      The retailer and only the retailer. It probably reduces fraud chargebacks to nearly 0.
adambrenecki 10y ago
Sites like Mint do this to retrieve your banking history. Asking for banking login details seems to be the standard way of doing that sort of thing. (Don't get me wrong, it's still terrible, but it's not like the banks provide an API you can log in to with oAuth or something.) This is different; mwave is a retailer, all they're doing is receiving a payment.

voycey 10y ago

I don't think PCI compliance is a factor here (unfortunately) - they literally only deal with the taking of cards, I would think Banks should be looking at this pretty skeptically! Although here in Australia there seems to be a lot more "access" available to your bank account than in many other countries (including my native UK), it makes things like integrations nicer but I do wonder just when it's all going to come crashing down!

voycey 10y ago
"Usernames and passwords to electronic accounts holding payment data are not sufficiently protected" I correct myself - maybe it does!
- windowsworkstoo 10y ago
  That is more referring to the user/pass you might use to login retrieve card details say from a card vault for manual processing. Indeed PCI 3.1 (and actually from v2) has a strong requirement for MFA when connecting to the cardholder data environment network. I've lived PCI for a while - I don't think this particular issue would fall under their purview. As per PCI-DSS doc, it is primarily concerned with the secure "acceptance, transmission and storage" of cardholder data. If they use a 3rd party payment processor for their credit/debit card transactions, they will only have a very limited PCI scope (probably just SAQ-A) which will basically say "oh, make sure you send it to your processor over TLS" and don't peek. This particular instance is probably one for the regulatory body, which in our case in Aus would likely be APRA.
joatmon-snoo 10y ago
According to the PCI-DSS website, "[i]t is important to note that the payment brands and acquirers are responsible for enforcing compliance, not the PCI council." [1] No idea what the state of actual legally-enforceable penalties is. In the meantime I've tweeted @AmericanExpress about this. [1] https://www.pcicomplianceguide.org/pci-faqs-2/#1 https://www.pcicomplianceguide.org/pci-faqs-2/#1
- 10y ago

russdill 10y ago

Is this the verified by visa thing? https://usa.visa.com/pay-with-visa/featured-technologies/verified-by-visa.html https://usa.visa.com/pay-with-visa/featured-technologies/ver... Bank passwords alone wouldn't work on any of my accounts because it would detect a different computer and request secondary authorization. It does this by looking at the information the browser sent...and...oh...oh. Geez I hate security theater. Is there anything less secure than the information sent by your browser?

464192002d7fe1c 10y ago
It looks like their own ghetto implementation of Verified by Visa. Verified by Visa is secure because it uses a shared secret (not terribly unlike how JWT works) for the merchant to redirect you to the bank (with information on what card you used), who verifies your username and password and that that is your card, who then redirects you back to the merchant with something that says "Yep, we verified them"
- 0x0 10y ago
  A big problem with VbV is that the VbV step is usually embedded as an iframe, making it near impossible to verify its authenticity in normal browsers.
  - rconti 10y ago
    I don't think I've EVER had a VBV or Mastercard Securecode transaction actually work. I avoided buying stuff from NewEgg for a couple of years because of this.
  - brazzledazzle 10y ago
    That's ridiculous. Why not just use redirects/posts the way SAML and OAuth does?
  - innocenat 10y ago
    My bank (Thailand) has VbV that requires me to set up personal phrase with the bank and that phrase is shown on VbV page. Also it sends SMS OTP to preregistered mobile number so I doubt any sites could fake that.

rajington 10y ago

This is how Venmo does it so they don't have to make you do the "verify two microdeposits" process, and it's getting more popular. I think because when you give your login you're giving over complete access so bank is not liable for fraud.

fraserharris 10y ago
Huh? Venmo requires a bank card - that's all.
andrewguenther 10y ago
I never had to do this for Venmo. Is this a recent change?
- JadeNB 10y ago
  I had to do it when I signed up. That's why the history of my interaction with Venmo was (1) change bank password, (2) accept the money from the person who would only pay using Venmo, (3) change bank password back so that Venmo / late hackers into Venmo databases don't get any ideas.
msk5293 10y ago
I think you're referring to Plaid's Auth product, which is for verifying bank accounts. https://plaid.com/products/auth/ https://plaid.com/products/auth/

smaili 10y ago

Why do I need to provide my bank login information (username, password, security questions)? Mwave has identified online banking access as the quickest and easiest method to get access to your banking information. In order to access this information, it is required that you provide your username, password, and any security questions associated with your online banking account.

mikestew 10y ago
Mwave has identified online banking access as the quickest and easiest method to get access to your banking information. Well, one can't argue that they're wrong in making that statement. However, that's the reason we don't give random websites the credentials for our "online banking access". :-)
brazzledazzle 10y ago
Security questions too. Unbelievable. I wonder how much political good will some poor engineers wasted fighting this.

barbs 10y ago

Wow. And that's an Australian company, based in Sydney no less, not far from where I live... how embarassing.

yashwanthcp 10y ago

This page has a good explanation of why - https://www.mwave.com.au/help/faq/view/24 https://www.mwave.com.au/help/faq/view/24

cyberferret 10y ago
That link explains other security measures, but doesn't actually say that they need your bank/credit card login details though?!? (unless I missed it somewhere). "Please note: Due to the rise of credit card fraud and for your security all credit card orders will be subject to detailed security checks requiring further documentation; that may include Driver Licence, CreditCard or bank statements. If your order does not meet our security check requirements, you will be contacted and further credit card security procedures will be implemented. As part of our verification process we will utilise various procedures to ensure ultimate protection to the Credit Card holder. These processes may include but not limited to charging a small amount randomly under $2 requiring confirmation prior to approval; verbal verification via phone or a request for written Authorization, photo identification including valid Driver Licence, Utilities bill or the copy of the credit card or a request for your bank statement displaying the debit entry. Mwave may also use a verification service powered by BankStatements.com.au, the Australian leader in automated bank statement data retrieval. Since 2013 BankStatements.com.au has provided secure, automated data retrieval services to over a quarter of a million Australians as part of their credit applications. "

1ris 10y ago

This is common practice in germany. The whole payment methode "sofortüberweisung" or "sofort" is based on this. You give your login information and a single use password to sofort, they initiate a wire transfer and instantly guarantee the money will arive. (It will arrive 24h later, as banks are allowed to delay it this long and they use it as additional liquidity) Of course this is a security nightmare and or course the ToS of the Banks prohibit you from sharing your login details. But unfortunately they don't enforce their ToS. Recently the cartel office called for making this part of the Banks ToS void, as they would "hinder the adoption of innovative FinTec". But it illustrates how deeply flawed the whole banking sector is that people are willing to give up passwords to third parties or paying insane fees to paypal. IMHO we urgently need a law that makes wire transferees instant, or this dangerous and incredible expensive layers grow for the disadvantage of everybody (expect paypal and sofort).

candiodari 10y ago
From the merchant's perspective this works because bank transfers have to be free for both the source and the destination. So banks have an incentive to sabotage this and they will. By contrast bank fees on credit cards can go close to 6% now. That's why you get cashback offers, points, ... on credit card offers. I think a lot of people (but not banks) would be very keen on having regulated fees for transfers. Of course, not banks.
- dublinben 10y ago
  Credit card transaction fees are regulated at a much lower level in Europe.
  - cmdrfred 10y ago
    I don't understand why we don't do that here. People like the rewards but that only works because the cost of those rewards is subsided by a price increase for everyone, even the people paying cash.
    - 10y ago

jaunkst 10y ago

No. Just no. Not necessary. Its amazing that this is successful by any means.

plantain 10y ago

This is very normal in Australia. All the major airlines do it via POLi[1] [1]https://en.wikipedia.org/wiki/POLi_Payments https://en.wikipedia.org/wiki/POLi_Payments

abrookewood 10y ago
I wouldn't say it is common - I've never seen it.
- _kyran 10y ago
  It's usually the only option to avoid a $5-$70 credit card surcharge. Have you ever paid for a flight online with Jetstar, Tiger or Air Asia? With Jetstar, up until a few months ago, you could do your own bank transfer, but now poli is the only option.
  - fineline 10y ago
    Tiger used to not charge for Mastercard debit. It has changed recently, but still only a matter of cents.

polemic 10y ago

There is a similar system in use in New Zealand and Australia called POLi: https://en.wikipedia.org/wiki/POLi_Payments https://en.wikipedia.org/wiki/POLi_Payments It's discouraged by banks and you don't see it as much as you used to (in NZ anyway).

elemenopy 10y ago
It's still around for some things, eg Jetstar. You used to be able to do a manual online transfer to pay for flights but now POLi is the only way you can avoid the $5 credit card surcharge. Grinds on me every time I buy a flight.
snikch 10y ago
Poli now manage this via an API with Westpac at least, i.e. you go to Poli, redirect to Westpac and log in, then redirect back to Poli who pull in the info with an API. Very much like an OAuth flow, but I don't know the actual details of it. (I won't get into how oauth isn't a great solution, but at least I'm not exposing my creds to Poli).

cyberferret 10y ago

I am wondering about the legalities of them doing this. I remember back when we had a merchant account for a retail style business, we were repeatedly warned by the bank that we were legally on the hook if we took a customer's credit card information and it got somehow compromised or leaked. This was back in the pre-EFTPOS days when a store would have to keep a carbon copy of the customer card imprint (as well as their signature). We were told to guard those slips like gold, and dispose of them properly when not needed any longer, because with that information, we could in effect impersonate the customer elsewhere. I would say that things have changed markedly these days, but I wonder if the legislation, especially here in Australia, has kept up with that, seeing as a customer's login credentials are effectively the same as having their signature which can be copied?

netfreak111 10y ago

The way I handle this is, I have a dumb checking account which I transfer money to, when I do such transactions. This is more akin to giving a lame email address to websites you don't care.

bathory 10y ago
If only banks had a special login for these one-time transactions. One where the history isn't enabled either. In the Netherlands such a system exists, it's called iDEAL

deleted 10y ago

[deleted]

technion 10y ago

Author here. The post was put together in a bit of a rush - I've updated it based on a number of the queries I've seen. Overall, if attention to this issue can stop one other company doing this, I'll be pretty happy.

ctpide 10y ago

So, technically, everyone who does this (provides their login info) violates their terms with the bank I assume, as they probably told you not to share your password with any third party?

wolframhempel 10y ago

As the son of an otherwise amazing woman who falls for every credit card scam to ever hit her inbox I think this is another great reminder of the mindset disparity between techies and the wider public. While we obsess over end-to-end encryption and distributed ledgers the vast majority of people are perfectly happy typing online banking credentials and uploading pins to random websites.

SwellJoe 10y ago

I used to love MWave, many years ago. They were just a fantastic vendor back then. They shipped faster than anyone, handled returns fast and with zero hassle. But, I had a couple of mildly negative experiences (slow to ship, items listed as in stock weren't, etc.) and I stopped buying from them. This, though, is just crazy. I can't believe their merchant bank even allows them to do this.

BrandiATMuhkuh 10y ago

I've talked with a friend working in the IT department of one of Austrias biggest banks (black + yellow colour ;) ) about it. Apparently, banks want to become the identification services of the future. The idea is, that you can only (not sure if that is true) open a bank account with a valid ID, therefore the bank login can identify if a person is real or not. Example: creating a Twitter/FB account with you bank credentials would make your account automatically an approved account (you are you)

gargarplex 10y ago
This would solve a lot of problems with online fraud.... I welcome the innovation
boredpudding 10y ago
This is true. However, they will not let you enter the details on the page itself. In The Netherlands they are launching 'iDIN'. Which is a bit like OAuth 2.0, so it only provides the webshops with the things they need (and a bit more like age. So yay, privacy issues).
- BrandiATMuhkuh 10y ago
  One of the problems is when this is done by companies instead of states. A company might remove your access for some, not obvious reasons. Just see current trending HN link http://www.dansdeals.com/archives/98444 http://www.dansdeals.com/archives/98444 where google suspended an account and with that the person could not use the google login anymore. Even for non-google pages. That is scary. A protocol like the EDUROAM system would be nice. In that case, credentials include a domain (usually a Uni name), and with that domain the home uni(bank) can be used as an authentication authority.

biafra 10y ago

> It's that they apply the charge to your card a day before giving you this prompt, leaving you begging for refunds when you refuse. That is strange. I never begged for a charge back with any of my credit cards. When I say the transaction is fraudulent or not authorized by me, I get my money back. Always. The merchant can then sue me, if he thinks different. Is that not what happens with all credit cards in all countries?

Biganon 10y ago

It wouldn't work for me (UBS, Switzerland), I need to punch a code into a special calculator thing in order to login.

celerrimus 10y ago

There was similar attempt here in Poland few years ago, i believe it was sofort used by few online shops owned by German parent companies. This ended very soon, because people here are quite sensitive for such practices and Financial Supervision Authority begin informative action as this was against the law. But what was more important, people quickly realized that they could abuse this process. After such payment, they log in again to bank account and cancelled wired transfer (in most banks we can cancel wired transfer unless it actually leave your account few hours later), and then change their bank password. From point of view of shop, payment was successfull, they process order, but never get cash for it. This was the reason such payment systems ended very soon. Like kybernetyk and other wrote, in Poland we have very modern banking system, there's no problem to make fast wire (up to 15min) using official banking systems or reliable payments systems - you authorize each transaction directly in your bank system without revealing your login details to the middleman.

tener 10y ago
Still an issue - tried to buy shoes from Deichmann, they requested my login credentials. WTF.
- dx034 10y ago
  It's because Germany has a very low credit card penetration rate and the German debit cards cannot be used to guarantee a transaction. Direct debits can be cancelled without any reason for a while and aren't confirmed at all for several days. Unfortunately that doesn't seem to change. The big banking networks have their own debit system that's not compatible with many international online payment systems. There is thus little incentive to switch to sth like Visa/Mastercard debit cards.
  - dozzie 10y ago
    >> Still an issue - tried to buy shoes from Deichmann, they requested my login credentials. WTF. > It's because Germany has a very low credit card penetration rate and the German debit cards cannot be used to guarantee a transaction. No, really: WHAT THE F&CK?!? In Poland we have instant payments services for years already. Each of the services directs the user to their own bank's website (login form). Payment clears instantly and confirmation of the payment (which is machine processable) is sent to the shop in a matter of minutes and with no human employee whatsoever. We have these systems working for years, and the use ranges from buying e-books through food to power tools and clothing in on-line auctions site.

ian0 10y ago

Typically the payment process is be managed by a dedicated payment gateway through an iframe and not the merchant so it should in principle be slightly more secure than it looks. Someone mentioned Poli, one such gateway in Oz. As being shut down is a genuine business risk they strive for legitimacy - id be surprised if it was in-country and operating without at least tacit agreement of banks. Even slow moving banks could counter against this type of browser automation technically - not to mention legal action. No large merchant would fancy negative security related PR either. Honestly speaking - the payments industry is full of hacks like this. Look at US p2p systems built on ACH refunds. Or using 3D Secure for identity verification. Or processing pre-auths of 1 cents and rolling back to add a card to a wallet. Banks are slow and competitive, schemes are just slow, central banks often take a wait-and-see approach. When they get their act together systems like this tend to be replaced or evolved into more sensible and durable solutions - but that can take awhile. And in the meantime everyone tries every avenue possible to reduce fees or provide a better UX (in this case at the expense of consumer protection).

codedokode 10y ago

Is that even legal? What is the difference between this company and phishers collecting bank logins? And doesn't it look suspicious if the logins into different accounts are made from the same IP belonging to the online shop? Some banks in my country even require SMS verification if you are logging in from new IP address.

Karupan 10y ago

There is something similar in India called netbanking. Typically, the site redirects you to a payment gateway, which then redirects you to the bank's site. You enter your username/password only on the bank's site and complete the transaction. It is used quite frequently due to convenience and security. When I moved to Oz and tried to buy something online, I was quite taken aback that I was being asked to enter bank login details on 3rd party sites directly. Felt completely unsafe, so haven't used it yet.

jaaames 10y ago

There's a few places doing this now. I've met the CEO of bankstatements.com.au at a trade conference. Currently it's hard to get data feeds from banks - these guys are logging in, scraping bank statements and then providing them as digestable feeds. Pocketbook is another Australian fintech that was recently acquired that do the same things with credentials. The banks know they're doing it, it's against terms of service, but seem to turn a blind eye. POLi seems to have more reputation but I still feel dirty the few times I've been strongarmed into using it.

sathackr 10y ago

Paypal does the same thing. I added a bank account, and Paypal requested my username and password to automatically verify the two test deposits they made.

theobon 10y ago
Is that new. When I signed up, admittedly a number of years ago, they just asked me to tell them the amounts of the two test deposits. No login creds provided.
- sathackr 10y ago
  At first I thought so, as the first time I saw it was a couple of months ago when I added a new account, but then I googled and found [1] So I guess it's based on your routing number and whether your bank's online system has the proper framework to allow it. [1] http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2009/2/1235839118.html http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2009/2/12...