5 ms·

Exactly, some of this is semantics. To me, a skimmer duplicated card isn't identity theft. Taking my identifying information and opening new credit is. Again,

Exactly, some of this is semantics. To me, a skimmer duplicated card isn't identity theft. Taking my identifying information and opening new credit is. Again, this whole industry needs to change. We could cut massive amounts of the estimated $200B loss in the US with just simple things like mandatory chip+pin, 2FA or CCV for online purchases, your credit is always frozen and only unfrozen for a 24 hour period at your specific request (requiring MFA). It is so silly when I have to type in my 5 digit zip at the gas pump (something someone could easily find online or by asking for ID) even though my card has a chip.

jamra 9y ago
Some banks offer virtual credit card numbers for one time use. It works great online. There are phone payment methods like Apple Pay and whatever Google uses that protect your identity. The burden should be on the providers of these services to secure themselves.
- zxcmx 9y ago
  None of this works for you as a person if your easily look up-able information can be used to apply for credit. In a high trust society you are extremely vulnerable to this stuff. Low trust societies do not have this problem in the same way. The major problem really is that high trust society credit etc are optimising for sign up rate. Any kind of serious personal authentication mechanism will seriously impact conversion rate, which is the giant dashboard they have on the wall. There are whole teams of people whose job it is to make sign ups and conversions better. The fraud team is much smaller and as long as it doesn't impact the top line numbers too much they will be ignored.
  - kiriakasis 9y ago
    ok... i think the point is that it should be mandated by law to have chip+pin(+maybe contactless)+CCV with credit cards, and also two factor authentication for most online transaction. Whether the current business model does not provide these assurances is inconsequential: it can be imposed as a customer protection law. It is to be discussed whether the increase in the cost of the service would be worth it though.
- kilceem 9y ago
  They are good buffers. They are basically prepaid cards that can be refilled. Not sure about any assurances for fraud(probably none) but what is taken can be minimized.
sammorrowdrums 9y ago
The zip code at gas pumps is not just a poor security measure, it also blocks international travellers like me from obtaining any fuel sometimes!!!
- kwhitefoot 9y ago
  Just make a note of the zip code of some random address in the neighbourhood. A hotel or even the airport will do. At least that has worked for me. The system doesn't seem to care that that zip code has nothing to do with my Norwegian issued American Express corporate credit card.
  - astura 9y ago
    12345 is a valid zip code, it has a single address associated with it - General Electric in Schenectady, NY. 10101 and 01010 are also valid zip codes. (00000 usually works too even though it's not a valid zip code)
- umanwizard 9y ago
  I'm not positive, but I think zip verification fails open on foreign cards. Here's an arbitrary one I know exists: 85310. Try it next time and see if it works.
  - shawnz 9y ago
    I like to use '90210'
    - astura 9y ago
      When I was a teenager in the 90s I worked at a chain store that had the policy of asking customers for their zip code at checkout to collect data on who was shopping. People sometimes would get really mad (and I mean really mad) that I was asking them, and since it was before the internet went mainstream people had not been conditioned to give out personal information yet/were unfamiliar with big data/weren't getting anything in return for their zip code. So in order to confuse the system (and avoid upsetting anyone - I am conflict avoidant) I would solely use 90210 as the zip code of all our shoppers, despite being on the other side of the country from Beverly Hills. I conspired to get my coworkers to do the same. A quarter of a century later I still feel minor gratification that I stuck it to the man.
zxcmx 9y ago
Low trust versus high trust society is the thing you need to understand here. You live in a high trust society which means that, in general, it is more efficient to optimise for conversion rate than to deny valid but incompetent or "unable to provide all the details" consumers.
- zAy0LfpBZLC8mAC 9y ago
  While that might be true to a degree, chances are that what is really going on here is that it is more profitable to externalize the costs of insufficient authentication to unsuspecting people. While both result in higher profits, one does so by actually increasing the value that is being created while the other does so by making a third party pay, possibly even more than the increase in profit, so one of them is more efficient for society, while the other is just more efficient for the company but might still even be less efficient for society overall.
  - zxcmx 9y ago
    I understand, but in practice the fraud liability when it comes to identifying parties between two huge companies is very, very clearly laid out. As in, weeks or months or years of discussion. Not talking about credit cards thougn which are kind of a special case, where yes, totally merchant gets screwed.
- snarf21 9y ago
  I understand what you are saying but that just means that the consumer pays for that in any case (in higher prices or interest rates or ...). Using your verbiage, I would like it to be even "higher" trust so that I don't have to pay for fraud that seems almost trivial to prevent.
  - zxcmx 9y ago
    It is not trivial to prevent at all. You need to spend money and fraud prevention effort at every trust point. All of this costs literal salaries of people who say "no computer says no" at every point. Those people also suffer risk of physical assault. In the electronic space you need to pay for "social media consultants" and look after twitter and facebook and such. You would be surprised how incredibly expensive the things you seem to take for granted are, to a large organisation which pays proper wages to people. Practically speaking if your personal details have been disclosed by some douchebag fucking company it is very difficult to distinguish you as a caller from some random internet asshole impersonating you.
dalbasal 9y ago
* To me, skimmer duplicated card isn't identity theft.* No? I kind of think of identity theft as any fraud where someone pretends to be someone else to the detriment of the someone else, who needs to deal with the consecquences of whatever the someone did.
8ytecoder 9y ago
A commenter below already mentions the difference between high-trust and low-trust society. I'm from a country which has a notoriously low-trust society. Opening a credit card or bank account is notoriously hard. It's so hard that a large portion of the society is left out of the system. The problem with chip-pin, 2FA ...etc is that people would still be vulnerable to fraud. Except in those cases, banks can wash off their hands. I lost my credit card recently and someone misused it. my bank reverted the transactions immediately. I know they got my back. It's the merchant or the merchant's bank that usually absorbs the cost. It's also a conscious decision the merchant makes to not check an id card for every single purchase. It's a risk they are willing to take and they probably take an insurance to cover for it. They are rewarded with reduced friction in transacting with them and hopefully better revenues as a result. I think it's a system that works good enough. Would I prefer something more secure like Apple Pay - 100%! But I'd take this over being checked for my ID card for any purchase over very trivial amounts. Now, you may argue that it would never happen with chip-pin...etc. That's not true at all. There are people who can't remember the pin well and would choose to use cash or write the pin in a paper and keep it in their wallet. Exposing themselves to more risk and no protection from the card company either - "hey someone knew your pin so you are responsible for it".
- snarf21 9y ago
  I agree the system has to protect both sides and that may not always pan out completely. I'm genuinely curious what you think would work better. All systems have drawbacks. Some of them may be systemic but those are harder to abuse than a waiter writing down your CC # and selling that to people who encode them on magstripes. I think with chip+pin it is at least a lot harder to be vulnerable. More and more credit card companies also have an app that you can easily report your card missing/stolen almost instantly. Also, if you have trouble with a 4 digit # of your choosing, then you should stick with cash which is still open to theft but not digital duplication.
  - 8ytecoder 9y ago
    If you are really interested, read this ArsTechnica article [1]. Interesting tidbit [2]. This makes it far superior to even chip+pin. You have to enable TouchId to use Apple Pay - there's the 2FA which doesn't requiring writing it down. It never sends the real cc number - no way for the waiter to even see it. It's a shame it's not catching up. Even in a tech-savvy city like SF it's adoption is abysmal. [1] https://arstechnica.com/gadgets/2014/10/how-mobile-payments-really-work/ https://arstechnica.com/gadgets/2014/10/how-mobile-payments-... [2] On top of that, Apple has introduced tokenization into its payment system. Like Google Wallet's Virtual Card, this obfuscates the user's actual credit card number, but it does so using a security standard developed by various standards groups and big-name card networks like Visa. It all happens without having to go through another bank as an intermediary supplier of a virtual card.
vpalanc1 9y ago
it's not silly, it's infuriating. I can't pay at the pump with my card, because I don't have a US ZIP (I do have a perfectly secret PIN that I can use everywhere in Europe, but US doesn't seem to care about that)

jamra 9y ago

Some banks offer virtual credit card numbers for one time use. It works great online. There are phone payment methods like Apple Pay and whatever Google uses that protect your identity. The burden should be on the providers of these services to secure themselves.

zxcmx 9y ago
None of this works for you as a person if your easily look up-able information can be used to apply for credit. In a high trust society you are extremely vulnerable to this stuff. Low trust societies do not have this problem in the same way. The major problem really is that high trust society credit etc are optimising for sign up rate. Any kind of serious personal authentication mechanism will seriously impact conversion rate, which is the giant dashboard they have on the wall. There are whole teams of people whose job it is to make sign ups and conversions better. The fraud team is much smaller and as long as it doesn't impact the top line numbers too much they will be ignored.
- kiriakasis 9y ago
  ok... i think the point is that it should be mandated by law to have chip+pin(+maybe contactless)+CCV with credit cards, and also two factor authentication for most online transaction. Whether the current business model does not provide these assurances is inconsequential: it can be imposed as a customer protection law. It is to be discussed whether the increase in the cost of the service would be worth it though.
kilceem 9y ago
They are good buffers. They are basically prepaid cards that can be refilled. Not sure about any assurances for fraud(probably none) but what is taken can be minimized.

sammorrowdrums 9y ago

The zip code at gas pumps is not just a poor security measure, it also blocks international travellers like me from obtaining any fuel sometimes!!!

kwhitefoot 9y ago
Just make a note of the zip code of some random address in the neighbourhood. A hotel or even the airport will do. At least that has worked for me. The system doesn't seem to care that that zip code has nothing to do with my Norwegian issued American Express corporate credit card.
- astura 9y ago
  12345 is a valid zip code, it has a single address associated with it - General Electric in Schenectady, NY. 10101 and 01010 are also valid zip codes. (00000 usually works too even though it's not a valid zip code)
umanwizard 9y ago
I'm not positive, but I think zip verification fails open on foreign cards. Here's an arbitrary one I know exists: 85310. Try it next time and see if it works.
- shawnz 9y ago
  I like to use '90210'
  - astura 9y ago
    When I was a teenager in the 90s I worked at a chain store that had the policy of asking customers for their zip code at checkout to collect data on who was shopping. People sometimes would get really mad (and I mean really mad) that I was asking them, and since it was before the internet went mainstream people had not been conditioned to give out personal information yet/were unfamiliar with big data/weren't getting anything in return for their zip code. So in order to confuse the system (and avoid upsetting anyone - I am conflict avoidant) I would solely use 90210 as the zip code of all our shoppers, despite being on the other side of the country from Beverly Hills. I conspired to get my coworkers to do the same. A quarter of a century later I still feel minor gratification that I stuck it to the man.

zxcmx 9y ago

Low trust versus high trust society is the thing you need to understand here. You live in a high trust society which means that, in general, it is more efficient to optimise for conversion rate than to deny valid but incompetent or "unable to provide all the details" consumers.

zAy0LfpBZLC8mAC 9y ago
While that might be true to a degree, chances are that what is really going on here is that it is more profitable to externalize the costs of insufficient authentication to unsuspecting people. While both result in higher profits, one does so by actually increasing the value that is being created while the other does so by making a third party pay, possibly even more than the increase in profit, so one of them is more efficient for society, while the other is just more efficient for the company but might still even be less efficient for society overall.
- zxcmx 9y ago
  I understand, but in practice the fraud liability when it comes to identifying parties between two huge companies is very, very clearly laid out. As in, weeks or months or years of discussion. Not talking about credit cards thougn which are kind of a special case, where yes, totally merchant gets screwed.
snarf21 9y ago
I understand what you are saying but that just means that the consumer pays for that in any case (in higher prices or interest rates or ...). Using your verbiage, I would like it to be even "higher" trust so that I don't have to pay for fraud that seems almost trivial to prevent.
- zxcmx 9y ago
  It is not trivial to prevent at all. You need to spend money and fraud prevention effort at every trust point. All of this costs literal salaries of people who say "no computer says no" at every point. Those people also suffer risk of physical assault. In the electronic space you need to pay for "social media consultants" and look after twitter and facebook and such. You would be surprised how incredibly expensive the things you seem to take for granted are, to a large organisation which pays proper wages to people. Practically speaking if your personal details have been disclosed by some douchebag fucking company it is very difficult to distinguish you as a caller from some random internet asshole impersonating you.

dalbasal 9y ago

* To me, skimmer duplicated card isn't identity theft.* No? I kind of think of identity theft as any fraud where someone pretends to be someone else to the detriment of the someone else, who needs to deal with the consecquences of whatever the someone did.

8ytecoder 9y ago

A commenter below already mentions the difference between high-trust and low-trust society. I'm from a country which has a notoriously low-trust society. Opening a credit card or bank account is notoriously hard. It's so hard that a large portion of the society is left out of the system. The problem with chip-pin, 2FA ...etc is that people would still be vulnerable to fraud. Except in those cases, banks can wash off their hands. I lost my credit card recently and someone misused it. my bank reverted the transactions immediately. I know they got my back. It's the merchant or the merchant's bank that usually absorbs the cost. It's also a conscious decision the merchant makes to not check an id card for every single purchase. It's a risk they are willing to take and they probably take an insurance to cover for it. They are rewarded with reduced friction in transacting with them and hopefully better revenues as a result. I think it's a system that works good enough. Would I prefer something more secure like Apple Pay - 100%! But I'd take this over being checked for my ID card for any purchase over very trivial amounts. Now, you may argue that it would never happen with chip-pin...etc. That's not true at all. There are people who can't remember the pin well and would choose to use cash or write the pin in a paper and keep it in their wallet. Exposing themselves to more risk and no protection from the card company either - "hey someone knew your pin so you are responsible for it".

snarf21 9y ago
I agree the system has to protect both sides and that may not always pan out completely. I'm genuinely curious what you think would work better. All systems have drawbacks. Some of them may be systemic but those are harder to abuse than a waiter writing down your CC # and selling that to people who encode them on magstripes. I think with chip+pin it is at least a lot harder to be vulnerable. More and more credit card companies also have an app that you can easily report your card missing/stolen almost instantly. Also, if you have trouble with a 4 digit # of your choosing, then you should stick with cash which is still open to theft but not digital duplication.
- 8ytecoder 9y ago
  If you are really interested, read this ArsTechnica article [1]. Interesting tidbit [2]. This makes it far superior to even chip+pin. You have to enable TouchId to use Apple Pay - there's the 2FA which doesn't requiring writing it down. It never sends the real cc number - no way for the waiter to even see it. It's a shame it's not catching up. Even in a tech-savvy city like SF it's adoption is abysmal. [1] https://arstechnica.com/gadgets/2014/10/how-mobile-payments-really-work/ https://arstechnica.com/gadgets/2014/10/how-mobile-payments-... [2] On top of that, Apple has introduced tokenization into its payment system. Like Google Wallet's Virtual Card, this obfuscates the user's actual credit card number, but it does so using a security standard developed by various standards groups and big-name card networks like Visa. It all happens without having to go through another bank as an intermediary supplier of a virtual card.

vpalanc1 9y ago

it's not silly, it's infuriating. I can't pay at the pump with my card, because I don't have a US ZIP (I do have a perfectly secret PIN that I can use everywhere in Europe, but US doesn't seem to care about that)