13 ms·

This is common practice in germany. The whole payment methode "sofortüberweisung" or "sofort" is based on this. You give your login information and a single use

by 1ris 10y ago

This is common practice in germany. The whole payment methode "sofortüberweisung" or "sofort" is based on this. You give your login information and a single use password to sofort, they initiate a wire transfer and instantly guarantee the money will arive. (It will arrive 24h later, as banks are allowed to delay it this long and they use it as additional liquidity) Of course this is a security nightmare and or course the ToS of the Banks prohibit you from sharing your login details. But unfortunately they don't enforce their ToS. Recently the cartel office called for making this part of the Banks ToS void, as they would "hinder the adoption of innovative FinTec". But it illustrates how deeply flawed the whole banking sector is that people are willing to give up passwords to third parties or paying insane fees to paypal. IMHO we urgently need a law that makes wire transferees instant, or this dangerous and incredible expensive layers grow for the disadvantage of everybody (expect paypal and sofort).

candiodari 10y ago
From the merchant's perspective this works because bank transfers have to be free for both the source and the destination. So banks have an incentive to sabotage this and they will. By contrast bank fees on credit cards can go close to 6% now. That's why you get cashback offers, points, ... on credit card offers. I think a lot of people (but not banks) would be very keen on having regulated fees for transfers. Of course, not banks.
- dublinben 10y ago
  Credit card transaction fees are regulated at a much lower level in Europe.
  - cmdrfred 10y ago
    I don't understand why we don't do that here. People like the rewards but that only works because the cost of those rewards is subsided by a price increase for everyone, even the people paying cash.
    - nickles 10y ago
      >> Credit card transaction fees are regulated at a much lower level in Europe. > I don't understand why we don't do that here. It really comes down to allowing markets to operate efficiently. Such regulation, in order to be work as intended, creates a price ceiling for the credit card market. This ceiling produces a deadweight loss (in this case, you would likely see it as either a reduction in the aggregate quantity of credit extended to consumers or the perks associated with using the card like fraud protection, ability to file charge backs, and customer support). On the whole (producer surplus + consumer surplus), you will observe such a loss. Now what makes the government more capable of determining appropriate prices than market participants themselves? Allowing a competitive market to determine prices for credit services will drive the cost of the services to an efficient level. Given that governments are tasked with many pressing issues, it's reasonable to believe that they can only afford to put so many resources into assessing price levels for each regulated good or service. However, each market participant is able to focus solely on determining a price for the product offered. Even if the government can determine the optimal price level for the market, there is necessarily a lag time for the regulation to be passed and implemented, reducing the ability of the market to respond to systemic shocks and changing conditions. Along different lines, if price regulations on credit card fees are acceptable, should the government install price ceilings on housing (causing reduced incentive to build more) and other markets? Should the price of all meals at restaurants be capped at $10 so more people can dine out? In the latter example it's easier to imagine the ramifications of a price ceiling, but the same market forces are at work. > People like the rewards but that only works because the cost of those rewards is subsided by a price increase for everyone, even the people paying cash. That's not true in specific, observable cases, and I suspect it's not true in general either. To provide concrete examples, many gas stations and vending machines offer discounts for paying with cash instead of card, specifically to avoid the impact of fees on their prices. Additionally, vendors can choose to set minimum thresholds at which they accept credit cards, in order to mitigate the impact on their pricing and profitability. In general, I assume the rewards are not truly subsidized by merchant fees. From my recollection of previous reading on the subject (I'd appreciate more accurate numbers if someone can provide them), merchants pay 3% to accept the credit card. ~2.5% of the fee is consumed by the cost of fraud. The remainder is split between the payment processor (e.g. Stripe), the issuing bank, and the credit card company. Clearly in a world of 2% rewards cards, a 3% fee does not allow for fraud protection, servicing expenses, and rewards. My guess is that rewards programs only become feasible when you consider the interest charged on unpaid balances. Somewhere on the order of 50% - 70% of consumers carry debt on their credit cards. At 6% - 30% APR, this expense can reasonably cover the perks conferred by a credit card. If all consumers suddenly stopped carrying debt on credit cards, I suspect rewards programs would disappear rapidly.
- morgante 10y ago
  > By contrast bank fees on credit cards can go close to 6% now. I'm not sure where you're getting your info, but that's off by a factor of 2. Credit cards work great for consumers, just not merchants.
  - deleted 10y ago
    [deleted]
  - 1ris 10y ago
    Guess who pays for them. It's not the merchants. But you are right about credit cards, it's not that much. Right now I'm more or less fored to use paypal. They offer a very similar service. I'm paying a tiny bit less than 10% of my income directly to paypal.
    - morgante 10y ago
      Huh? Merchants definitely are the ones who pay card processing fees. Some small merchants offer cash discounts, but that's comparatively very rare. Edit: since you mentioned Paypal, I agree that they're horrible to both merchants and consumers. Stay far away if you can. (In fact, I'm curious why you're using Paypal instead of someone friendlier like Stripe.)
      - 1ris 10y ago
        I'm very sure it completely tickles down, although I have nothing to back that up.
      - cgriswald 10y ago
        The merchants pass on those costs in the form of higher prices. The better your rewards the more someone else is subsidizing your credit card fees, but you're not breaking even either.
        morgante 10y ago
        Sure, in the same sense that merchants pass on all costs in the form of higher prices. That being said, if you play it right you can actually make far more in rewards than the merchants paid. There's a whole subculture devoted to it: I routinely earn around 4-5% back, to the point that I prefer to pay my taxes via credit card even with the surcharge.
brazzledazzle 10y ago
This is totally and completely insane. If a site gets hacked and your money is stolen there's no way the bank is going to indemnify you when you willingly turned over your credentials to a third party. Do they have to have all kinds of specialized fraud detection in place to prevent unknown IPs from transferring more than a certain dollar amount? It also just occurred to me that you probably can't have 2-factor enabled on your bank account.
- revelation 10y ago
  There isn't actually anything you can do with the login + password. Sure, you can look at the transactions, so I guess it's a privacy problem. But any transaction or change usually requires generating a single use pin with your debit card and a small card reader. Some also use your mobile phone.
  - deleted 10y ago
    [deleted]
  - bathory 10y ago
    That really depends. Some banks dont require a code at all for known contacts. Some banks dont require a code at all for small amounts (under 50). Some banks send you a plain SMS with a one-time-password. Some banks send you an SMS with some additional information (receiver, amount) and a one-time-password. Some banks ask for a one-time-password from a dongle. Some banks ask for a one-time-password by entering a challenge code into your dongle and then the dongle generates the new one-time-password. etc. What I am trying to say is, there is no real standard. The best method I've come across so far is a device in which you insert your debit card, enter your pin, then scan a QR code on the computerscreen and the device will actually show you the receiving IBAN + amount. After pressing OK you get a challenge that you have to enter on the website. Also in the Netherlands the banks have an API they can use called iDEAL which does the same as "SOFORT" but instead of having "SOFORT" log in to your account, your actual bank immediately transfers the funds and sends an OK to the vendor. It makes me really angry that bank security isnt standardized and that good systems like iDEAL dont find international adoption. Luxembourg is trying to develope its own version of iDEAL e.g.
hackinthebochs 10y ago
What we need is just a secondary password with limited permissions and some fraud guarantees. There's no reason your bank account can't also act as a payments gateway with the right protections.
- wmf 10y ago
  We could call it... a credit card number.
  - ctpide 10y ago
    Yes, because that never got stolen in the past
    - wmf 10y ago
      Any password that you give out will be stolen; that's why "let's have a special secondary password" doesn't solve much. There are now passwordless ways to authenticate, authorize, prove identity, make payments, etc. so that's what we should be suggesting.
      - ctpide 10y ago
        Apple Pay is technically trying to solve this problem by providing one-time authentication keys for a specific transaction at time of payment. This sort of key can not be reused in another transaction... What exactly do you mean with other passwordless ways?
        wmf 10y ago
        Basically OAuth, which allows you to prove to one site (e.g. a merchant) that you have an account at another site (e.g. a bank in this case). http://designingsocialinterfaces.com/patterns/The_Password_Anti-Pattern http://designingsocialinterfaces.com/patterns/The_Password_A...
morgante 10y ago
This is a solved problem. Credit cards work great. The issue is that lots of merchants (particularly in the EU) simply don't want to deal with the fees associated with credit cards so come of up with lots of creative ways to externalize the cost of fraud to consumers.
- 1ris 10y ago
  No, they don't. They are completely insane aswell. They are like smart cards, but with the secret printed on them, visible for the world. If you want to clone them you don't need a highly advanced lab, you can just remember the number. You also share said "secret" with everybody you do business with. Of course you constantly get your money stolen. You just don't notice because the loss is distributed evenly. That's why they are so expensive. I'm suprised people use such a low tech system. I wouldn't even accept such authentication system for my throw-away reddit accounts, let alone for money.
  - morgante 10y ago
    Sure, I don't dispute that credit cards are technically very simplistic and basically don't have any security. The huge benefit of them is that almost all those security risks are externalized. If someone uses my credit card fraudulently, I don't pay any of the costs. Basically every alternative (Verified by Visa, etc.) is about shifting those liabilities back to the consumer.
    - ChemicalWarfare 10y ago
      Technically "verified by visa" shifts the liability from the merchant towards the issuer.
    - closeparen 10y ago
      The costs are distributed evenly, in the form of the markup on all products that covers the interchange fee and losses to charge backs. You do pay them, but in small undetectable increments all the time instead of random surprise large losses.
djsumdog 10y ago
I thought in Germany you used one-time disposable TAN numbers for this purpose? Australia also has direct person-to-person/business money transfers, but without the one-time-use pins. That this company would even ask for a bank login is terrible and unnecessary.
- atomwaffel 10y ago
  > I thought in Germany you used one-time disposable TAN numbers for this purpose? We do, Sofortüberweisung just acts as a man in the middle and passes through all TAN requests from the banking website to the client. They can't transfer money out of your account without your consent, but they can do just about anything else that doesn't require a TAN.
- dx034 10y ago
  If someone intercepts the traffic (a hack on sofort's server) they could read all transactions and account info without anyone noticing. Guess with that information you could make a lot of money phishing.
ChemicalWarfare 10y ago
>>we urgently need a law that makes wire transferees instant Not sure about Germany, in the US this is a "technical" issue with the way consumer banking settlement is implemented. The notification of the intent to move the funds is almost instantaneous, the actual clearing takes days in some cases.
- dx034 10y ago
  In the UK it was solved by making all small transfers instant, while large transfers (direct debits, salaries) are still settled overnight. That way most of the transfers are instant while >90% of the amount transferred is still settled. Avoids issues for the banks' cash management while it's convenient for the user at the same time. I think the US has the problem that it had to set up that way when clearing was done physically (due to the size of the country) and it's now very costly to change, for very little benefit to the banks.
  - ascorbic 10y ago
    Faster Payments aren't just for small transfers. The only limits are by individual banks, and they are normally in the thousands.
    - dx034 10y ago
      While that's true, they're still mostly used for rather small amounts. The payment volume is around 5% of all electronic payments [1]. Not saying that Faster Payments are not a good thing, but they would probably cause problems for banks if most money would be moved by it. It works well because the major source of cash management is done due to card payments, direct debits and Bacs. So the normal cash buffer a bank holds throughout the day is sufficient to do fast transactions. [1] http://www.paymentsuk.org.uk/sites/default/files/publication-free/UK%20Payment%20Markets%20Summary%202016%20-%20Free%20Download.pdf http://www.paymentsuk.org.uk/sites/default/files/publication...
gcb0 10y ago
that is actually great! with one time password it does work. In the USA, you give them a number (which is written on each check anyway) that allows anyone to empty your account if so they wish, with absolutely no passwords or anything else.
Rafert 10y ago
This is a solved problem in the Netherlands with iDEAL. Go to checkout, select your bank, authenticate at your banks website with your credentials and 2FA (SMS/EMV CAP reader/QR code), confirm transaction details and you'll be redirected back to the web store. The wire transfer is not instant but it is guaranteed so the merchant can start shipping immediately. See https://www.ideal.nl/demo/en/ https://www.ideal.nl/demo/en/ for a demo.
- rbag 10y ago
  In France we have 3D Secure, when you make the paiement you are redirected to a page that belongs to the bank, you receive a SMS with a one time code to validate the paiement and are redirected to the merchant with the validation. Quite efficient, but I think there's fees for the merchant in this case.
  - blowski 10y ago
    Usually there are no fees, and it also protects you from chargebacks. But it's harder to implement, and it does tend to increase abandon rates a bit.
    - cm2187 10y ago
      And some implementations rely on 3rd party cookies!
  - makmanalp 10y ago
    I've seen some horrific UI on some 3D secure implementations. Also, I've seen some websites refresh to a "loading 3D secure ..." page, only to somehow skip it and go further. If the merchant can just skip it and charge your card like a regular credit card, then what's even the point of having it?
    - Flimm 10y ago
      I'm guessing that the page gets skipped when you're on a familiar IP address with a familiar cookie, or there are other factors where the bank decides more authentication is unnecessary.
77pt77 10y ago
Some places solved this by creating one shot virtual VISA cards created at the banks website. It's a good compromise that works almost everywhere.
thirdsun 10y ago
Is that actually true? I remember I used Sofortüberweisung once when I had to and it didn't feel (for a lack of a better term) as if I was sharing my credentials with Sofort. It was a long time ago but I had the impression that they used some kind of legitimate connection to your bank (with TAN check and my original banking interface) and were only notified about the success (or failure) of the transaction while never receiving the sensitive credentials themselves. Of course I may be wrong.
- the_mitsuhiko 10y ago
  Yes, they just scrape your banks online system.
dom0 10y ago
> This is common practice in germany. The whole payment methode "sofortüberweisung" or "sofort" is based on this. I've never used that and only one person I know did use it ever. And even that person felt rather uncomfortable about it. So I don't think it's very common. A year ago or so it was also exposed that sofortüberweisung doesn't only do the transfer, they actually retrieve details of all recent transfers.
- darklajid 10y ago
  Well, given that they have all the login information (bank, user/account number, password/pin) they can basically access everything that is read-only and not TAN protected. For my bank the transfers of the last month would be accessible right away, for example. Honestly, I (German as well) didn't believe 1ris right of the bat and went to their website to prove someone wrong on the internet. Oh my was I wrong (apologies, 1ris). Horrible idea.
biafra 10y ago
To solve the problem with Sofortüberweisung it would be enough if my bank would just provide a digitally signed statement, that I authorized a payment and had enough funds at the time so they would execute it. I could take this statement, show it to the merchant and he could verify it by using a publicly known publlic key of that bank. If nothing better is available it could be the key they us on their website. I wonder who is interested not to already have this. I can't be the first person with that idea.
- blauditore 10y ago
  From what I understand, this is basically what happens for most online credit card payments. If you enter your credentials, you're redirected to a verification page by the issuer where you have to enter a password or SMS-sent key. On success, this page then passes a signed token (or similar) back to the original online shop as confirmation.
kekub 10y ago
Let me elaborate on that: For a German it is common to have a "check account". The underlying system is called "girocard". It contains a module for paying in stores (electronic cash) and another one for withdrawing money from cash dispensers ("Deutsches Geldautomaten-System"). In addition to that most banks offer their customers access to "maestro" (some debit card service from Master Card) and V-Pay (same as maestro but from Visa). Credit cards are only popular among the younger population as they need them to buy things online (iTunes, Google Play, etc...). However the "check accounts" come with a different kind of insurance. You can read quite a lot about that online, my personal experience is the following: If somebody steals (no matter how) 200€ from your credit card the bank will cancel the transaction immediately, if the same happens with your "check account" you need to go to court to get it back. Having this system you might imagine why our online-banking is overly complex: You have to login with a username and a password[=PIN] (for some banks you have a fixed username, at others you can choose one). Afterwards you are allowed to send someone money. Therefore you require another one-time-password[=TAN]. This TAN can be obtained in multiple ways: 1. Snake Mail (Just a printed TAN list asking you for a random free TAN), 2. Snake Mail (A printed TAN list asking you for a specific TAN at a given index), 3. Snake Mail (A printed TAN list asking you for a specific TAN at a given index and returning a verification code, that is also printed on the list), 4. Mobile TAN (TAN via SMS), 5. Push TAN (TAN via Banking App), 6. Photo TAN / QR TAN (Optical System which works with pub/priv key to verify your transaction), 7. Chip TAN (Special device that uses the chip in your card to verify your transaction). After you verified your transaction it takes up to three days before the recievers bank notifies the reciever that he got the money. The real joke is, that everything regarding payments can be transmitted in real time. However some banks make use of these days to generate more interest. End of the story: If you want to pay something online and you want to recieve it quick you need to either use a Credit Card or some proprietary system that your bank might support (see paydirekt, giropay). As both might not be available for some users they either have to wait for 3 days for their money to arrive at the reciever or use a untrustworthy service like sofortüberweisung (which scans all your transactions and predicts your accountability [Disclaimer: If I remember correctly, German Ref. http://www.pcwelt.de/news/Datenschuetzer-alarmiert-Sofortueberweisung-de-spaeht-Kontodaten-aus-1928829.html] http://www.pcwelt.de/news/Datenschuetzer-alarmiert-Sofortueb...).
gosubpl 10y ago
Solved problem in Poland. Actually I usually laugh when I hear about "FinTech" startups struggling to deliver technology that is history here. mBank has been offering "instant" money transfer for purchases for the last 15 years, now there are more then a couple of vendors aggregating almost every bank that there is on the market. Real time transfers have been available via BlueMedia (private company) for like 7 years and via central banking transfer hub for over a year. You can pay with your mobile via a couple of providers, including said central banking transfer hub (Blik payments). And standard bank transfers (take around 8h to deliver - depending on incoming and outgoing transfer sessions timing - there are 3 sessions a day) are free - so many people are used to pay via standard bank transfer and there are many solutions for merchants that do automated account scraping to match incoming transfers. Poland - the land of FinTech future. Downside - if you are Financial IT provider - you can hardly get anything sold here - everything that comes from outside is history here.
- mootothemax 10y ago
  Yeah, the tech side is great, it's just a shame that borrowing costs - for anything in złoty, e.g. mortgage - are gigantic, saving interest rates are abysmal, and you really have to watch out for bad actors thanks to the close-to-zero consumer protection rights. For example, a number of online shops show items as being "in stock" despite having an empty warehouse (or no idea if their supplier has anything in stock). It's possible to transfer large sums, and then have to sit around waiting for a month or two while the shop decides what to do, all with close to zero repercussions for the shop themselves. If you've paid with a credit card instead of a bank transfer, it's simple enough to kick off a chargeback. (well, not as simple as in other nations, but a short form and a quick chat with a moody call centre rep). As a recent example, I had a ~5,000zł purchase go wrong (to a well-known Apple authorized store) after the payment was successfully taken, but the store's website had an error and failed to process. Trying to get a response out of the payment processor or the shop was like getting blood out of a stone; the only thing that worked inside of a reasonable timeframe (I gave them a week to even reply to me on phone -or- email) was a chargeback. While I can live with unfavourable rates, give me the UK's consumer protection laws any day of the week!
captn3m0 10y ago
.nl and .in have similar systems that allow one-time transfers to be made using your online bank account. In .nl they have iDEAL, as someone already pointed out. In .in, we have to integrate with each bank individually, and there are several aggregators that do this for you, and you don't have to sign an agreement with each bank.
- gosubpl 10y ago
  Yes, I have noticed. But thanks for the update again :) I think future is here, just it is not evenly distributed. But I really laugh when talking to someone who has just heard of this new exciting London or SV Fintech startup and learns that in some countries this is already forgotten history and we moved forward since :) I think Poland is more striking for them than The Netherlands as people are used to thinking about old Comm block countries as a bit backwards ;)
thesimon 10y ago
>as they would "hinder the adoption of innovative FinTec". Which is not surprising considering the banks have their own similar scheme giropay/paydirekt and not allowing competitors doesn't seem that fair. > IMHO we urgently need a law that makes wire transferees instant SEPA Instant Transfers are coming 2018 PSD2 coming 2018 requires bank to provide API access to third parties as well, so this is basically a solved problem.
jnsaff2 10y ago
In Estonia it was solved in a somewhat saner way: there is a unified framework with which customers can: - click on a Pay with Internet bank link - it directs you to your chosen bank's internet bank - you log in - the payment is already pre-filled and - once it is done the seller gets a signed confirmation from the bank that the transaction has actually happened.
vurpo 10y ago
This is a common method of payment in Finland as well, but, the store always asks you to choose your bank, then redirects you to the online bank where you then authenticate and authorize the transfer on the bank's website. It then redirects you back to the merchant's website. Basically, banks provide an API (similar to OAuth? I guess) where the merchant only asks the bank for a specific amount of money, and the authentication and authorization of the payment happens only directly between the customer and the bank. Why would this be so hard to so in other countries?
- ptaipale 10y ago
  And note: the same authorization is mandatory also for credit card payments in Finnish web shops. I.e. when you're ready with your shopping cart and click "pay", and give your credit card number, then next thing is a redirect to the bank's page (where you really should check the URL and SSL certificate...), you give your OTP for bank login, and this authorizes the credit card payment, you get a redirect back to the seller website and complete the transaction.
  - mnw21cam 10y ago
    > where you really should check the URL and SSL certificate... Yeah, we are really training people to be vulnerable to phishing scams, aren't we. The advice I give is that if you didn't type the URL of the bank web site into the address bar yourself, it may not be your actual bank you are talking to.
codedokode 10y ago
What if the login credentials are stolen with a keylogger, will the hackers be able to transfer the money the same way? It looks totally insecure. And as I understand the customer cannot charge back the payment later. > IMHO we urgently need a law that makes wire transferees instant, Why not just use card processing systems like Visa? Are the fees too high or are there privacy concerns with sending personal data to USA?
ThomPete 10y ago
Wiretransfer at least internationally can't be instant since there is no such thing as an international wiretransfer. What there is is a bunch of agreement between banks. So at least globally a law wont change anything.
- ascorbic 10y ago
  https://en.wikipedia.org/wiki/Single_Euro_Payments_Area https://en.wikipedia.org/wiki/Single_Euro_Payments_Area
- germanier 10y ago
  Not only is there such a thing as a common system for international wire transfers in Europe (SEPA Credit Transfer, which is also used for domestic wires as well), instant payments are coming soon™ to that (supposedly end of next year): http://www.europeanpaymentscouncil.eu/index.cfm/sepa-instant-payments/what-are-instant-payments/ http://www.europeanpaymentscouncil.eu/index.cfm/sepa-instant...
  - ThomPete 10y ago
    Sure i was talking about globally.
    - germanier 10y ago
      The existence of SEPA shows that it might be viable on a larger scale. While the EU and EEA members already share a common legal framework, the other two SEPA members (San Marino and Monaco) don't (even though they cooperate closely with the EU in certain areas). With enough political will a larger payment area doesn't seem impossible. (But personally I can't imagine this to happen globally.)

by 1ris 10y ago

candiodari 10y ago

From the merchant's perspective this works because bank transfers have to be free for both the source and the destination. So banks have an incentive to sabotage this and they will. By contrast bank fees on credit cards can go close to 6% now. That's why you get cashback offers, points, ... on credit card offers. I think a lot of people (but not banks) would be very keen on having regulated fees for transfers. Of course, not banks.

dublinben 10y ago
Credit card transaction fees are regulated at a much lower level in Europe.
- cmdrfred 10y ago
  I don't understand why we don't do that here. People like the rewards but that only works because the cost of those rewards is subsided by a price increase for everyone, even the people paying cash.
  - nickles 10y ago
    >> Credit card transaction fees are regulated at a much lower level in Europe. > I don't understand why we don't do that here. It really comes down to allowing markets to operate efficiently. Such regulation, in order to be work as intended, creates a price ceiling for the credit card market. This ceiling produces a deadweight loss (in this case, you would likely see it as either a reduction in the aggregate quantity of credit extended to consumers or the perks associated with using the card like fraud protection, ability to file charge backs, and customer support). On the whole (producer surplus + consumer surplus), you will observe such a loss. Now what makes the government more capable of determining appropriate prices than market participants themselves? Allowing a competitive market to determine prices for credit services will drive the cost of the services to an efficient level. Given that governments are tasked with many pressing issues, it's reasonable to believe that they can only afford to put so many resources into assessing price levels for each regulated good or service. However, each market participant is able to focus solely on determining a price for the product offered. Even if the government can determine the optimal price level for the market, there is necessarily a lag time for the regulation to be passed and implemented, reducing the ability of the market to respond to systemic shocks and changing conditions. Along different lines, if price regulations on credit card fees are acceptable, should the government install price ceilings on housing (causing reduced incentive to build more) and other markets? Should the price of all meals at restaurants be capped at $10 so more people can dine out? In the latter example it's easier to imagine the ramifications of a price ceiling, but the same market forces are at work. > People like the rewards but that only works because the cost of those rewards is subsided by a price increase for everyone, even the people paying cash. That's not true in specific, observable cases, and I suspect it's not true in general either. To provide concrete examples, many gas stations and vending machines offer discounts for paying with cash instead of card, specifically to avoid the impact of fees on their prices. Additionally, vendors can choose to set minimum thresholds at which they accept credit cards, in order to mitigate the impact on their pricing and profitability. In general, I assume the rewards are not truly subsidized by merchant fees. From my recollection of previous reading on the subject (I'd appreciate more accurate numbers if someone can provide them), merchants pay 3% to accept the credit card. ~2.5% of the fee is consumed by the cost of fraud. The remainder is split between the payment processor (e.g. Stripe), the issuing bank, and the credit card company. Clearly in a world of 2% rewards cards, a 3% fee does not allow for fraud protection, servicing expenses, and rewards. My guess is that rewards programs only become feasible when you consider the interest charged on unpaid balances. Somewhere on the order of 50% - 70% of consumers carry debt on their credit cards. At 6% - 30% APR, this expense can reasonably cover the perks conferred by a credit card. If all consumers suddenly stopped carrying debt on credit cards, I suspect rewards programs would disappear rapidly.
morgante 10y ago
> By contrast bank fees on credit cards can go close to 6% now. I'm not sure where you're getting your info, but that's off by a factor of 2. Credit cards work great for consumers, just not merchants.
- deleted 10y ago
  [deleted]
- 1ris 10y ago
  Guess who pays for them. It's not the merchants. But you are right about credit cards, it's not that much. Right now I'm more or less fored to use paypal. They offer a very similar service. I'm paying a tiny bit less than 10% of my income directly to paypal.
  - morgante 10y ago
    Huh? Merchants definitely are the ones who pay card processing fees. Some small merchants offer cash discounts, but that's comparatively very rare. Edit: since you mentioned Paypal, I agree that they're horrible to both merchants and consumers. Stay far away if you can. (In fact, I'm curious why you're using Paypal instead of someone friendlier like Stripe.)
    - 1ris 10y ago
      I'm very sure it completely tickles down, although I have nothing to back that up.
    - cgriswald 10y ago
      The merchants pass on those costs in the form of higher prices. The better your rewards the more someone else is subsidizing your credit card fees, but you're not breaking even either.
      - morgante 10y ago
        Sure, in the same sense that merchants pass on all costs in the form of higher prices. That being said, if you play it right you can actually make far more in rewards than the merchants paid. There's a whole subculture devoted to it: I routinely earn around 4-5% back, to the point that I prefer to pay my taxes via credit card even with the surcharge.

brazzledazzle 10y ago

This is totally and completely insane. If a site gets hacked and your money is stolen there's no way the bank is going to indemnify you when you willingly turned over your credentials to a third party. Do they have to have all kinds of specialized fraud detection in place to prevent unknown IPs from transferring more than a certain dollar amount? It also just occurred to me that you probably can't have 2-factor enabled on your bank account.

revelation 10y ago
There isn't actually anything you can do with the login + password. Sure, you can look at the transactions, so I guess it's a privacy problem. But any transaction or change usually requires generating a single use pin with your debit card and a small card reader. Some also use your mobile phone.
- deleted 10y ago
  [deleted]
- bathory 10y ago
  That really depends. Some banks dont require a code at all for known contacts. Some banks dont require a code at all for small amounts (under 50). Some banks send you a plain SMS with a one-time-password. Some banks send you an SMS with some additional information (receiver, amount) and a one-time-password. Some banks ask for a one-time-password from a dongle. Some banks ask for a one-time-password by entering a challenge code into your dongle and then the dongle generates the new one-time-password. etc. What I am trying to say is, there is no real standard. The best method I've come across so far is a device in which you insert your debit card, enter your pin, then scan a QR code on the computerscreen and the device will actually show you the receiving IBAN + amount. After pressing OK you get a challenge that you have to enter on the website. Also in the Netherlands the banks have an API they can use called iDEAL which does the same as "SOFORT" but instead of having "SOFORT" log in to your account, your actual bank immediately transfers the funds and sends an OK to the vendor. It makes me really angry that bank security isnt standardized and that good systems like iDEAL dont find international adoption. Luxembourg is trying to develope its own version of iDEAL e.g.

hackinthebochs 10y ago

What we need is just a secondary password with limited permissions and some fraud guarantees. There's no reason your bank account can't also act as a payments gateway with the right protections.

wmf 10y ago
We could call it... a credit card number.
- ctpide 10y ago
  Yes, because that never got stolen in the past
  - wmf 10y ago
    Any password that you give out will be stolen; that's why "let's have a special secondary password" doesn't solve much. There are now passwordless ways to authenticate, authorize, prove identity, make payments, etc. so that's what we should be suggesting.
    - ctpide 10y ago
      Apple Pay is technically trying to solve this problem by providing one-time authentication keys for a specific transaction at time of payment. This sort of key can not be reused in another transaction... What exactly do you mean with other passwordless ways?
      - wmf 10y ago
        Basically OAuth, which allows you to prove to one site (e.g. a merchant) that you have an account at another site (e.g. a bank in this case). http://designingsocialinterfaces.com/patterns/The_Password_Anti-Pattern http://designingsocialinterfaces.com/patterns/The_Password_A...

morgante 10y ago

This is a solved problem. Credit cards work great. The issue is that lots of merchants (particularly in the EU) simply don't want to deal with the fees associated with credit cards so come of up with lots of creative ways to externalize the cost of fraud to consumers.

1ris 10y ago
No, they don't. They are completely insane aswell. They are like smart cards, but with the secret printed on them, visible for the world. If you want to clone them you don't need a highly advanced lab, you can just remember the number. You also share said "secret" with everybody you do business with. Of course you constantly get your money stolen. You just don't notice because the loss is distributed evenly. That's why they are so expensive. I'm suprised people use such a low tech system. I wouldn't even accept such authentication system for my throw-away reddit accounts, let alone for money.
- morgante 10y ago
  Sure, I don't dispute that credit cards are technically very simplistic and basically don't have any security. The huge benefit of them is that almost all those security risks are externalized. If someone uses my credit card fraudulently, I don't pay any of the costs. Basically every alternative (Verified by Visa, etc.) is about shifting those liabilities back to the consumer.
  - ChemicalWarfare 10y ago
    Technically "verified by visa" shifts the liability from the merchant towards the issuer.
  - closeparen 10y ago
    The costs are distributed evenly, in the form of the markup on all products that covers the interchange fee and losses to charge backs. You do pay them, but in small undetectable increments all the time instead of random surprise large losses.

djsumdog 10y ago

I thought in Germany you used one-time disposable TAN numbers for this purpose? Australia also has direct person-to-person/business money transfers, but without the one-time-use pins. That this company would even ask for a bank login is terrible and unnecessary.

atomwaffel 10y ago
> I thought in Germany you used one-time disposable TAN numbers for this purpose? We do, Sofortüberweisung just acts as a man in the middle and passes through all TAN requests from the banking website to the client. They can't transfer money out of your account without your consent, but they can do just about anything else that doesn't require a TAN.
dx034 10y ago
If someone intercepts the traffic (a hack on sofort's server) they could read all transactions and account info without anyone noticing. Guess with that information you could make a lot of money phishing.

ChemicalWarfare 10y ago

>>we urgently need a law that makes wire transferees instant Not sure about Germany, in the US this is a "technical" issue with the way consumer banking settlement is implemented. The notification of the intent to move the funds is almost instantaneous, the actual clearing takes days in some cases.

dx034 10y ago
In the UK it was solved by making all small transfers instant, while large transfers (direct debits, salaries) are still settled overnight. That way most of the transfers are instant while >90% of the amount transferred is still settled. Avoids issues for the banks' cash management while it's convenient for the user at the same time. I think the US has the problem that it had to set up that way when clearing was done physically (due to the size of the country) and it's now very costly to change, for very little benefit to the banks.
- ascorbic 10y ago
  Faster Payments aren't just for small transfers. The only limits are by individual banks, and they are normally in the thousands.
  - dx034 10y ago
    While that's true, they're still mostly used for rather small amounts. The payment volume is around 5% of all electronic payments [1]. Not saying that Faster Payments are not a good thing, but they would probably cause problems for banks if most money would be moved by it. It works well because the major source of cash management is done due to card payments, direct debits and Bacs. So the normal cash buffer a bank holds throughout the day is sufficient to do fast transactions. [1] http://www.paymentsuk.org.uk/sites/default/files/publication-free/UK%20Payment%20Markets%20Summary%202016%20-%20Free%20Download.pdf http://www.paymentsuk.org.uk/sites/default/files/publication...

gcb0 10y ago

that is actually great! with one time password it does work. In the USA, you give them a number (which is written on each check anyway) that allows anyone to empty your account if so they wish, with absolutely no passwords or anything else.

Rafert 10y ago

This is a solved problem in the Netherlands with iDEAL. Go to checkout, select your bank, authenticate at your banks website with your credentials and 2FA (SMS/EMV CAP reader/QR code), confirm transaction details and you'll be redirected back to the web store. The wire transfer is not instant but it is guaranteed so the merchant can start shipping immediately. See https://www.ideal.nl/demo/en/ https://www.ideal.nl/demo/en/ for a demo.

rbag 10y ago
In France we have 3D Secure, when you make the paiement you are redirected to a page that belongs to the bank, you receive a SMS with a one time code to validate the paiement and are redirected to the merchant with the validation. Quite efficient, but I think there's fees for the merchant in this case.
- blowski 10y ago
  Usually there are no fees, and it also protects you from chargebacks. But it's harder to implement, and it does tend to increase abandon rates a bit.
  - cm2187 10y ago
    And some implementations rely on 3rd party cookies!
- makmanalp 10y ago
  I've seen some horrific UI on some 3D secure implementations. Also, I've seen some websites refresh to a "loading 3D secure ..." page, only to somehow skip it and go further. If the merchant can just skip it and charge your card like a regular credit card, then what's even the point of having it?
  - Flimm 10y ago
    I'm guessing that the page gets skipped when you're on a familiar IP address with a familiar cookie, or there are other factors where the bank decides more authentication is unnecessary.

77pt77 10y ago

Some places solved this by creating one shot virtual VISA cards created at the banks website. It's a good compromise that works almost everywhere.

thirdsun 10y ago

Is that actually true? I remember I used Sofortüberweisung once when I had to and it didn't feel (for a lack of a better term) as if I was sharing my credentials with Sofort. It was a long time ago but I had the impression that they used some kind of legitimate connection to your bank (with TAN check and my original banking interface) and were only notified about the success (or failure) of the transaction while never receiving the sensitive credentials themselves. Of course I may be wrong.

the_mitsuhiko 10y ago
Yes, they just scrape your banks online system.

dom0 10y ago

> This is common practice in germany. The whole payment methode "sofortüberweisung" or "sofort" is based on this. I've never used that and only one person I know did use it ever. And even that person felt rather uncomfortable about it. So I don't think it's very common. A year ago or so it was also exposed that sofortüberweisung doesn't only do the transfer, they actually retrieve details of all recent transfers.

darklajid 10y ago
Well, given that they have all the login information (bank, user/account number, password/pin) they can basically access everything that is read-only and not TAN protected. For my bank the transfers of the last month would be accessible right away, for example. Honestly, I (German as well) didn't believe 1ris right of the bat and went to their website to prove someone wrong on the internet. Oh my was I wrong (apologies, 1ris). Horrible idea.

biafra 10y ago

To solve the problem with Sofortüberweisung it would be enough if my bank would just provide a digitally signed statement, that I authorized a payment and had enough funds at the time so they would execute it. I could take this statement, show it to the merchant and he could verify it by using a publicly known publlic key of that bank. If nothing better is available it could be the key they us on their website. I wonder who is interested not to already have this. I can't be the first person with that idea.

blauditore 10y ago
From what I understand, this is basically what happens for most online credit card payments. If you enter your credentials, you're redirected to a verification page by the issuer where you have to enter a password or SMS-sent key. On success, this page then passes a signed token (or similar) back to the original online shop as confirmation.

kekub 10y ago

Let me elaborate on that: For a German it is common to have a "check account". The underlying system is called "girocard". It contains a module for paying in stores (electronic cash) and another one for withdrawing money from cash dispensers ("Deutsches Geldautomaten-System"). In addition to that most banks offer their customers access to "maestro" (some debit card service from Master Card) and V-Pay (same as maestro but from Visa). Credit cards are only popular among the younger population as they need them to buy things online (iTunes, Google Play, etc...). However the "check accounts" come with a different kind of insurance. You can read quite a lot about that online, my personal experience is the following: If somebody steals (no matter how) 200€ from your credit card the bank will cancel the transaction immediately, if the same happens with your "check account" you need to go to court to get it back. Having this system you might imagine why our online-banking is overly complex: You have to login with a username and a password[=PIN] (for some banks you have a fixed username, at others you can choose one). Afterwards you are allowed to send someone money. Therefore you require another one-time-password[=TAN]. This TAN can be obtained in multiple ways: 1. Snake Mail (Just a printed TAN list asking you for a random free TAN), 2. Snake Mail (A printed TAN list asking you for a specific TAN at a given index), 3. Snake Mail (A printed TAN list asking you for a specific TAN at a given index and returning a verification code, that is also printed on the list), 4. Mobile TAN (TAN via SMS), 5. Push TAN (TAN via Banking App), 6. Photo TAN / QR TAN (Optical System which works with pub/priv key to verify your transaction), 7. Chip TAN (Special device that uses the chip in your card to verify your transaction). After you verified your transaction it takes up to three days before the recievers bank notifies the reciever that he got the money. The real joke is, that everything regarding payments can be transmitted in real time. However some banks make use of these days to generate more interest. End of the story: If you want to pay something online and you want to recieve it quick you need to either use a Credit Card or some proprietary system that your bank might support (see paydirekt, giropay). As both might not be available for some users they either have to wait for 3 days for their money to arrive at the reciever or use a untrustworthy service like sofortüberweisung (which scans all your transactions and predicts your accountability [Disclaimer: If I remember correctly, German Ref. http://www.pcwelt.de/news/Datenschuetzer-alarmiert-Sofortueberweisung-de-spaeht-Kontodaten-aus-1928829.html] http://www.pcwelt.de/news/Datenschuetzer-alarmiert-Sofortueb...).

gosubpl 10y ago

Solved problem in Poland. Actually I usually laugh when I hear about "FinTech" startups struggling to deliver technology that is history here. mBank has been offering "instant" money transfer for purchases for the last 15 years, now there are more then a couple of vendors aggregating almost every bank that there is on the market. Real time transfers have been available via BlueMedia (private company) for like 7 years and via central banking transfer hub for over a year. You can pay with your mobile via a couple of providers, including said central banking transfer hub (Blik payments). And standard bank transfers (take around 8h to deliver - depending on incoming and outgoing transfer sessions timing - there are 3 sessions a day) are free - so many people are used to pay via standard bank transfer and there are many solutions for merchants that do automated account scraping to match incoming transfers. Poland - the land of FinTech future. Downside - if you are Financial IT provider - you can hardly get anything sold here - everything that comes from outside is history here.

mootothemax 10y ago
Yeah, the tech side is great, it's just a shame that borrowing costs - for anything in złoty, e.g. mortgage - are gigantic, saving interest rates are abysmal, and you really have to watch out for bad actors thanks to the close-to-zero consumer protection rights. For example, a number of online shops show items as being "in stock" despite having an empty warehouse (or no idea if their supplier has anything in stock). It's possible to transfer large sums, and then have to sit around waiting for a month or two while the shop decides what to do, all with close to zero repercussions for the shop themselves. If you've paid with a credit card instead of a bank transfer, it's simple enough to kick off a chargeback. (well, not as simple as in other nations, but a short form and a quick chat with a moody call centre rep). As a recent example, I had a ~5,000zł purchase go wrong (to a well-known Apple authorized store) after the payment was successfully taken, but the store's website had an error and failed to process. Trying to get a response out of the payment processor or the shop was like getting blood out of a stone; the only thing that worked inside of a reasonable timeframe (I gave them a week to even reply to me on phone -or- email) was a chargeback. While I can live with unfavourable rates, give me the UK's consumer protection laws any day of the week!

captn3m0 10y ago

.nl and .in have similar systems that allow one-time transfers to be made using your online bank account. In .nl they have iDEAL, as someone already pointed out. In .in, we have to integrate with each bank individually, and there are several aggregators that do this for you, and you don't have to sign an agreement with each bank.

gosubpl 10y ago
Yes, I have noticed. But thanks for the update again :) I think future is here, just it is not evenly distributed. But I really laugh when talking to someone who has just heard of this new exciting London or SV Fintech startup and learns that in some countries this is already forgotten history and we moved forward since :) I think Poland is more striking for them than The Netherlands as people are used to thinking about old Comm block countries as a bit backwards ;)

thesimon 10y ago

>as they would "hinder the adoption of innovative FinTec". Which is not surprising considering the banks have their own similar scheme giropay/paydirekt and not allowing competitors doesn't seem that fair. > IMHO we urgently need a law that makes wire transferees instant SEPA Instant Transfers are coming 2018 PSD2 coming 2018 requires bank to provide API access to third parties as well, so this is basically a solved problem.

jnsaff2 10y ago

In Estonia it was solved in a somewhat saner way: there is a unified framework with which customers can: - click on a Pay with Internet bank link - it directs you to your chosen bank's internet bank - you log in - the payment is already pre-filled and - once it is done the seller gets a signed confirmation from the bank that the transaction has actually happened.

vurpo 10y ago

This is a common method of payment in Finland as well, but, the store always asks you to choose your bank, then redirects you to the online bank where you then authenticate and authorize the transfer on the bank's website. It then redirects you back to the merchant's website. Basically, banks provide an API (similar to OAuth? I guess) where the merchant only asks the bank for a specific amount of money, and the authentication and authorization of the payment happens only directly between the customer and the bank. Why would this be so hard to so in other countries?

ptaipale 10y ago
And note: the same authorization is mandatory also for credit card payments in Finnish web shops. I.e. when you're ready with your shopping cart and click "pay", and give your credit card number, then next thing is a redirect to the bank's page (where you really should check the URL and SSL certificate...), you give your OTP for bank login, and this authorizes the credit card payment, you get a redirect back to the seller website and complete the transaction.
- mnw21cam 10y ago
  > where you really should check the URL and SSL certificate... Yeah, we are really training people to be vulnerable to phishing scams, aren't we. The advice I give is that if you didn't type the URL of the bank web site into the address bar yourself, it may not be your actual bank you are talking to.

codedokode 10y ago

What if the login credentials are stolen with a keylogger, will the hackers be able to transfer the money the same way? It looks totally insecure. And as I understand the customer cannot charge back the payment later. > IMHO we urgently need a law that makes wire transferees instant, Why not just use card processing systems like Visa? Are the fees too high or are there privacy concerns with sending personal data to USA?

ThomPete 10y ago

Wiretransfer at least internationally can't be instant since there is no such thing as an international wiretransfer. What there is is a bunch of agreement between banks. So at least globally a law wont change anything.

ascorbic 10y ago
https://en.wikipedia.org/wiki/Single_Euro_Payments_Area https://en.wikipedia.org/wiki/Single_Euro_Payments_Area
germanier 10y ago
Not only is there such a thing as a common system for international wire transfers in Europe (SEPA Credit Transfer, which is also used for domestic wires as well), instant payments are coming soon™ to that (supposedly end of next year): http://www.europeanpaymentscouncil.eu/index.cfm/sepa-instant-payments/what-are-instant-payments/ http://www.europeanpaymentscouncil.eu/index.cfm/sepa-instant...
- ThomPete 10y ago
  Sure i was talking about globally.
  - germanier 10y ago
    The existence of SEPA shows that it might be viable on a larger scale. While the EU and EEA members already share a common legal framework, the other two SEPA members (San Marino and Monaco) don't (even though they cooperate closely with the EU in certain areas). With enough political will a larger payment area doesn't seem impossible. (But personally I can't imagine this to happen globally.)