6 ms·

My bank (Bank of America) lets you create temporary credit card numbers. They are linked directly to your actual card, but can be revoked individually.

codetrotter 8y ago
I wish my bank offered that as well but another option offered in some countries including mine is to buy a prepaid MasterCard gift card. Now such gift cards aren’t perfect — you have to pay a bit extra, but for the purpose of signing up for a trial period with any company that automatically turns your trial into a subscription and which is known to make it difficult to cancel the trial it might be a good idea. However, before even signing up for a trial with a prepaid gift card one needs to be sure that one is not entering into an agreement that legally binds you to a subscription. I recently bought a prepaid gift card that I intend to use for a 7-day trial with a company that is known to make it difficult to cancel. But I will only sign up for the trial if the automatic subscription is not legally binding.
- TheSpiceIsLife 8y ago
  > However, before even signing up for a trial with a prepaid gift card one needs to be sure that one is not entering into an agreement that legally binds you to a subscription. This gets to the heart of the matter: it shouldn’t be possible to sign up for a legally binding automatic subscription for a pure service. Customers should have the liberty to leave at any time without incurring a fee. If I can sign up in under a minute I ought to be able to leave in under a minute.
tokyodude 8y ago
Dumb question. How much longer till we run out of credit card numbers? Sure 1,000,000,000,000,000 (1 quadrillion) is a large number but the actual usable number is smaller isn't it since there is some kind of checksum system
- LeoPanthera 8y ago
  The key is credit card number + expiry date. Cards can share numbers as long as the expiry date is different.
  - AmericanChopper 8y ago
    This isn’t true, the same PAN (Primary Account Number) is never issued to two different accounts. Even if you wanted to solve all the payment routing problems this could cause, it wouldn’t be possible to implement. The expiry date can change while the PAN stays the same, so you’d never be able to gurantee a unique key today stays unique in the future.
    - tyfon 8y ago
      I used to work in a bank where we had to specifically implement routines for when visa reused the PANs... There was a period between the old expiration and the new issue and not common, but it did happen from time to time.
      - AmericanChopper 8y ago
        I should have been a bit more verbose. Two accounts won’t have the same PAN at the same time.
        Dylan16807 8y ago
        Which is notable, but doesn't matter in the context of "running out of numbers"
        AmericanChopper 8y ago
        Seems to matter a lot for IPv4.
        8y ago
hbcondo714 8y ago
Citi offers the same but their UI is still in Flash
virgilp 8y ago
I don't know about that... I was sure it would work, but I'm not so sure anymore, after Avis managed to charge me 25EUR on an _expired_, _debit_ Mastercard that had 0 EUR in it (bank simply took upon themselves to automatically perform currency conversion from one of my other accounts so that they'd cover the negative balance). I never thought something like this would be possible. (it was a fee for supposedly "processing" a traffic ticket; they didn't pay it for me, or send the ticket to me - the fee was for taking the time to inform authorities who drove the car; they said I'd receive the ticket separately from the police, which I never did). I contacted the bank, and they said if the charge was not fraudulent (1), there's nothing I or they can do. Apparently the merchants can back-date transactions like that to a time when you interacted with them and the card was valid; I'm not exactly sure how they can charge an empty debit card though, but apparently they can do that too (because they pre-validated that I had a certain amount at the time of rental?). (1) It wasn't; the contract said that they can do that, and I actually could use a ticket reference number that they quoted to verify on the police site that there was indeed a parking ticket issued to the car on the day that I dropped it. To this day I'm not sure if it was me who committed a parking violation, or the next person who rented the car, after me. It is mildly plausible that it was me - that morning I parked in a legal parking space, but slightly outside the allowed "lines" (another car was taking a third of the only remaining slot, and I parked a bit outside of it).
- tialaramex 8y ago
  The payment card system consists of two entirely parallel mechanisms, with different purposes. One of them ("Authorization") is about verifying that the payment has been authorised by a cardholder, and is there to protect the issuer against fraud by their own cardholder and perhaps if you squint, to indirectly protect you from thieves. This has been the focus of technological innovation, up to and including EMV ("Chip and PIN"). It's also completely optional, most cardholders have no idea that's the case. The other mechanism ("Settlement") is about taking money from the cardholder's account and putting it in the merchant's account. This is done entirely on the honour system, always has been, probably always will be, none of the technological improvements touch it significantly. It's mandatory in the sense that without it the merchant can't get their money. Avis doesn't need Authorization to get your money, they only need Settlement. And like I said, it's on the honour system. Any merchant in the system can just tell the card network "Hi, card number X gave us $418.26" and they'll get $418.26 of X's money in their account. No need for any other steps. Now, if you dispute the transaction the issuer _might_ say, well, wait, how do we know they agreed to pay $418.26? And then Authorization matters, the Authorization can prove somebody swiped a card, or typed in a PIN, or whatever. Without Authorization the issuer might choose not to pay. But there's no guarantee as you found, unless a government regulation forces their hand why should they care - it isn't their money? This reliance on the honour system means that e.g. even though EMV has anti-replay features that mean Authorizations can't be re-used about once a year or so in the UK you'll have a news story where some big merchant like a supermarket or fast food chain will double charge all card customers for a day. What happens is the Settlement data just gets accidentally run twice, maybe it's a physical magnetic tape, or a backup copy of a file, or some new server boots up and re-runs yesterday's Kafka stream. Settlement has no replay resistance so even though all these transactions are duplicates that goes undetected until customers start phoning up angrily and their bank realises what happened. To a first approximation nobody checks Authorization. If you wanted to be an asshole you could try it out, ask your bank to reverse a random fraction of all your transactions. When you get a bill, pick some at random, phone the bank. Insist those are bogus and you've never heard of them. In most cases the vendor has no usable Authorization records and will just write it off, they were entirely reliant on getting paid on the honour system. Obviously if you're unlucky you'll pick someone who can prove you owed them money and is angry about it, so you may not want to try this after all. You might think this situation is crazy but it's more common than you realise. There have been a lot of grave problems with SSL/TLS over the years. But there aren't many examples of actual consequences in practical terms. Mostly it seems as though there actually aren't bad guys trying to break your secure communications, so even if it would be possible they didn't try. Huh.
presto8 8y ago
I tried this feature from my bank (not BofA) several years back. It didn't work as I expected. Even after revoking the card, the merchant was still able to charge me and the amount was just posted to my "real" card number. I called and complained and the customer service told me that once I had authorized the merchant to charge me, they would accept any future charges even if the card number was closed. Just curious, have you actually used BofA's service? Maybe the implementation is different now... If it works, it would be a great way to limit those automatic renewal situations.

codetrotter 8y ago

I wish my bank offered that as well but another option offered in some countries including mine is to buy a prepaid MasterCard gift card. Now such gift cards aren’t perfect — you have to pay a bit extra, but for the purpose of signing up for a trial period with any company that automatically turns your trial into a subscription and which is known to make it difficult to cancel the trial it might be a good idea. However, before even signing up for a trial with a prepaid gift card one needs to be sure that one is not entering into an agreement that legally binds you to a subscription. I recently bought a prepaid gift card that I intend to use for a 7-day trial with a company that is known to make it difficult to cancel. But I will only sign up for the trial if the automatic subscription is not legally binding.

TheSpiceIsLife 8y ago
> However, before even signing up for a trial with a prepaid gift card one needs to be sure that one is not entering into an agreement that legally binds you to a subscription. This gets to the heart of the matter: it shouldn’t be possible to sign up for a legally binding automatic subscription for a pure service. Customers should have the liberty to leave at any time without incurring a fee. If I can sign up in under a minute I ought to be able to leave in under a minute.

tokyodude 8y ago

Dumb question. How much longer till we run out of credit card numbers? Sure 1,000,000,000,000,000 (1 quadrillion) is a large number but the actual usable number is smaller isn't it since there is some kind of checksum system

LeoPanthera 8y ago
The key is credit card number + expiry date. Cards can share numbers as long as the expiry date is different.
- AmericanChopper 8y ago
  This isn’t true, the same PAN (Primary Account Number) is never issued to two different accounts. Even if you wanted to solve all the payment routing problems this could cause, it wouldn’t be possible to implement. The expiry date can change while the PAN stays the same, so you’d never be able to gurantee a unique key today stays unique in the future.
  - tyfon 8y ago
    I used to work in a bank where we had to specifically implement routines for when visa reused the PANs... There was a period between the old expiration and the new issue and not common, but it did happen from time to time.
    - AmericanChopper 8y ago
      I should have been a bit more verbose. Two accounts won’t have the same PAN at the same time.
      - Dylan16807 8y ago
        Which is notable, but doesn't matter in the context of "running out of numbers"
        AmericanChopper 8y ago
        Seems to matter a lot for IPv4.
        8y ago

hbcondo714 8y ago

Citi offers the same but their UI is still in Flash

virgilp 8y ago

I don't know about that... I was sure it would work, but I'm not so sure anymore, after Avis managed to charge me 25EUR on an _expired_, _debit_ Mastercard that had 0 EUR in it (bank simply took upon themselves to automatically perform currency conversion from one of my other accounts so that they'd cover the negative balance). I never thought something like this would be possible. (it was a fee for supposedly "processing" a traffic ticket; they didn't pay it for me, or send the ticket to me - the fee was for taking the time to inform authorities who drove the car; they said I'd receive the ticket separately from the police, which I never did). I contacted the bank, and they said if the charge was not fraudulent (1), there's nothing I or they can do. Apparently the merchants can back-date transactions like that to a time when you interacted with them and the card was valid; I'm not exactly sure how they can charge an empty debit card though, but apparently they can do that too (because they pre-validated that I had a certain amount at the time of rental?). (1) It wasn't; the contract said that they can do that, and I actually could use a ticket reference number that they quoted to verify on the police site that there was indeed a parking ticket issued to the car on the day that I dropped it. To this day I'm not sure if it was me who committed a parking violation, or the next person who rented the car, after me. It is mildly plausible that it was me - that morning I parked in a legal parking space, but slightly outside the allowed "lines" (another car was taking a third of the only remaining slot, and I parked a bit outside of it).

tialaramex 8y ago
The payment card system consists of two entirely parallel mechanisms, with different purposes. One of them ("Authorization") is about verifying that the payment has been authorised by a cardholder, and is there to protect the issuer against fraud by their own cardholder and perhaps if you squint, to indirectly protect you from thieves. This has been the focus of technological innovation, up to and including EMV ("Chip and PIN"). It's also completely optional, most cardholders have no idea that's the case. The other mechanism ("Settlement") is about taking money from the cardholder's account and putting it in the merchant's account. This is done entirely on the honour system, always has been, probably always will be, none of the technological improvements touch it significantly. It's mandatory in the sense that without it the merchant can't get their money. Avis doesn't need Authorization to get your money, they only need Settlement. And like I said, it's on the honour system. Any merchant in the system can just tell the card network "Hi, card number X gave us $418.26" and they'll get $418.26 of X's money in their account. No need for any other steps. Now, if you dispute the transaction the issuer _might_ say, well, wait, how do we know they agreed to pay $418.26? And then Authorization matters, the Authorization can prove somebody swiped a card, or typed in a PIN, or whatever. Without Authorization the issuer might choose not to pay. But there's no guarantee as you found, unless a government regulation forces their hand why should they care - it isn't their money? This reliance on the honour system means that e.g. even though EMV has anti-replay features that mean Authorizations can't be re-used about once a year or so in the UK you'll have a news story where some big merchant like a supermarket or fast food chain will double charge all card customers for a day. What happens is the Settlement data just gets accidentally run twice, maybe it's a physical magnetic tape, or a backup copy of a file, or some new server boots up and re-runs yesterday's Kafka stream. Settlement has no replay resistance so even though all these transactions are duplicates that goes undetected until customers start phoning up angrily and their bank realises what happened. To a first approximation nobody checks Authorization. If you wanted to be an asshole you could try it out, ask your bank to reverse a random fraction of all your transactions. When you get a bill, pick some at random, phone the bank. Insist those are bogus and you've never heard of them. In most cases the vendor has no usable Authorization records and will just write it off, they were entirely reliant on getting paid on the honour system. Obviously if you're unlucky you'll pick someone who can prove you owed them money and is angry about it, so you may not want to try this after all. You might think this situation is crazy but it's more common than you realise. There have been a lot of grave problems with SSL/TLS over the years. But there aren't many examples of actual consequences in practical terms. Mostly it seems as though there actually aren't bad guys trying to break your secure communications, so even if it would be possible they didn't try. Huh.

presto8 8y ago

I tried this feature from my bank (not BofA) several years back. It didn't work as I expected. Even after revoking the card, the merchant was still able to charge me and the amount was just posted to my "real" card number. I called and complained and the customer service told me that once I had authorized the merchant to charge me, they would accept any future charges even if the card number was closed. Just curious, have you actually used BofA's service? Maybe the implementation is different now... If it works, it would be a great way to limit those automatic renewal situations.