5 ms·
The whole point is that the attacker can opt to withdraw funds using a site/service/xxx that doesn't perform such authorization. I've only seen such authorizati
by tjoff 8y ago
The whole point is that the attacker can opt to withdraw funds using a site/service/xxx that doesn't perform such authorization. I've only seen such authorizations be used on domestic sites, an attacker would probably even prefer to withdraw funds from a country other than that of the victim.
Making the whole endeavor pointless.
- tialaramex 8y agoAbsent the authorization you can just unwind the transaction, since there's no evidence whatsoever that you authorized it. It will depend on how strong consumer protection is as to whether this actually leaves you financially whole afterwards or whether the bank is able to get away with just giving back the money for the single transaction. To the extent that Authorization isn't mandatory before the Payment step, sure, everything about payment cards is "pointless". Banks have decided they don't care about fraud and will just pass that cost on to you. shrug
- tjoff 8y agoYou can do that if the bank decides that you have not been negligent. Whether you have been negligent seems to be correlated with how much money was taken from you ;) Anyway, it is pretty immoral to rely on reimbursements - actively funding and making thievery profitable.