4 ms·

I don't know about that... I was sure it would work, but I'm not so sure anymore, after Avis managed to charge me 25EUR on an _expired_, _debit_ Mastercard that

I don't know about that... I was sure it would work, but I'm not so sure anymore, after Avis managed to charge me 25EUR on an _expired_, _debit_ Mastercard that had 0 EUR in it (bank simply took upon themselves to automatically perform currency conversion from one of my other accounts so that they'd cover the negative balance). I never thought something like this would be possible. (it was a fee for supposedly "processing" a traffic ticket; they didn't pay it for me, or send the ticket to me - the fee was for taking the time to inform authorities who drove the car; they said I'd receive the ticket separately from the police, which I never did). I contacted the bank, and they said if the charge was not fraudulent (1), there's nothing I or they can do. Apparently the merchants can back-date transactions like that to a time when you interacted with them and the card was valid; I'm not exactly sure how they can charge an empty debit card though, but apparently they can do that too (because they pre-validated that I had a certain amount at the time of rental?). (1) It wasn't; the contract said that they can do that, and I actually could use a ticket reference number that they quoted to verify on the police site that there was indeed a parking ticket issued to the car on the day that I dropped it. To this day I'm not sure if it was me who committed a parking violation, or the next person who rented the car, after me. It is mildly plausible that it was me - that morning I parked in a legal parking space, but slightly outside the allowed "lines" (another car was taking a third of the only remaining slot, and I parked a bit outside of it).

tialaramex 8y ago
The payment card system consists of two entirely parallel mechanisms, with different purposes. One of them ("Authorization") is about verifying that the payment has been authorised by a cardholder, and is there to protect the issuer against fraud by their own cardholder and perhaps if you squint, to indirectly protect you from thieves. This has been the focus of technological innovation, up to and including EMV ("Chip and PIN"). It's also completely optional, most cardholders have no idea that's the case. The other mechanism ("Settlement") is about taking money from the cardholder's account and putting it in the merchant's account. This is done entirely on the honour system, always has been, probably always will be, none of the technological improvements touch it significantly. It's mandatory in the sense that without it the merchant can't get their money. Avis doesn't need Authorization to get your money, they only need Settlement. And like I said, it's on the honour system. Any merchant in the system can just tell the card network "Hi, card number X gave us $418.26" and they'll get $418.26 of X's money in their account. No need for any other steps. Now, if you dispute the transaction the issuer _might_ say, well, wait, how do we know they agreed to pay $418.26? And then Authorization matters, the Authorization can prove somebody swiped a card, or typed in a PIN, or whatever. Without Authorization the issuer might choose not to pay. But there's no guarantee as you found, unless a government regulation forces their hand why should they care - it isn't their money? This reliance on the honour system means that e.g. even though EMV has anti-replay features that mean Authorizations can't be re-used about once a year or so in the UK you'll have a news story where some big merchant like a supermarket or fast food chain will double charge all card customers for a day. What happens is the Settlement data just gets accidentally run twice, maybe it's a physical magnetic tape, or a backup copy of a file, or some new server boots up and re-runs yesterday's Kafka stream. Settlement has no replay resistance so even though all these transactions are duplicates that goes undetected until customers start phoning up angrily and their bank realises what happened. To a first approximation nobody checks Authorization. If you wanted to be an asshole you could try it out, ask your bank to reverse a random fraction of all your transactions. When you get a bill, pick some at random, phone the bank. Insist those are bogus and you've never heard of them. In most cases the vendor has no usable Authorization records and will just write it off, they were entirely reliant on getting paid on the honour system. Obviously if you're unlucky you'll pick someone who can prove you owed them money and is angry about it, so you may not want to try this after all. You might think this situation is crazy but it's more common than you realise. There have been a lot of grave problems with SSL/TLS over the years. But there aren't many examples of actual consequences in practical terms. Mostly it seems as though there actually aren't bad guys trying to break your secure communications, so even if it would be possible they didn't try. Huh.
- virgilp 8y ago
  Oh wow, that makes perfect sense, thank you for writing the long reply. So you're basically telling me that it's only "authorisation" that checks the balance, and "settlement" doesn't? (I guess that also makes sense, now that I think about a few other things I noticed). How about the case I mentioned? If I told the bank "I did not authorise Avis, would Avis have been able to somehow "prove" that I authorised the transaction (I obviously didn't; the card was expired when they charged it; but I did have a signed contract with them, is that enough to directly take money from my account? Feels like it shouldn't be enough, not without a court getting involved).
  - tialaramex 8y ago
    What Authorisation checks is up to the issuer. For most accounts the bank does NOT promise to prevent you from spending beyond the limit. That limit is for their benefit not yours. A regular EMV card has some limits programmed into it by the issuer like "I'm not allowed to say yes to more than $500 of spending without going online to my issuer" but the issuer chooses what those are, not you. Whether the bank has to take your side will depend on law where you are more than any technical facts. That signed contract is going to be a factor, and you giving Avis the card (even though months before and without expecting to pay this) would probably matter too, I'd be surprised if the issuer or the law was OK with something like "We found this card number on an unrelated payment from years ago so we charged it". I mostly think this should be "fixed" to be stricter, but let me briefly take the merchant's side. Suppose I check out from a hotel one morning. $120 for one night sir, thanks for staying with us. Two hours later cleaners find the room is trashed. I've ripped up the carpet, a chair is in pieces, the wall TV has been attacked with a knife. Why the hell shouldn't they be able to try putting it on my card? Should my bank really refuse if I have the money, and force them to take me to court to try to get their money just because I didn't authorise the charge? Realistically it's not in anyone's interest to insist on that except bad actors.
    - nybble41 8y ago
      > Should my bank really refuse if I have the money, and force them to take me to court to try to get their money just because I didn't authorise the charge? Yes, absolutely. Are you seriously arguing that anyone should be able to claim money from your bank account without either prior authorization by the account holder or independent arbitration? Bypassing the courts in cases like this serves no one's interests except bad actors.

tialaramex 8y ago

The payment card system consists of two entirely parallel mechanisms, with different purposes. One of them ("Authorization") is about verifying that the payment has been authorised by a cardholder, and is there to protect the issuer against fraud by their own cardholder and perhaps if you squint, to indirectly protect you from thieves. This has been the focus of technological innovation, up to and including EMV ("Chip and PIN"). It's also completely optional, most cardholders have no idea that's the case. The other mechanism ("Settlement") is about taking money from the cardholder's account and putting it in the merchant's account. This is done entirely on the honour system, always has been, probably always will be, none of the technological improvements touch it significantly. It's mandatory in the sense that without it the merchant can't get their money. Avis doesn't need Authorization to get your money, they only need Settlement. And like I said, it's on the honour system. Any merchant in the system can just tell the card network "Hi, card number X gave us $418.26" and they'll get $418.26 of X's money in their account. No need for any other steps. Now, if you dispute the transaction the issuer _might_ say, well, wait, how do we know they agreed to pay $418.26? And then Authorization matters, the Authorization can prove somebody swiped a card, or typed in a PIN, or whatever. Without Authorization the issuer might choose not to pay. But there's no guarantee as you found, unless a government regulation forces their hand why should they care - it isn't their money? This reliance on the honour system means that e.g. even though EMV has anti-replay features that mean Authorizations can't be re-used about once a year or so in the UK you'll have a news story where some big merchant like a supermarket or fast food chain will double charge all card customers for a day. What happens is the Settlement data just gets accidentally run twice, maybe it's a physical magnetic tape, or a backup copy of a file, or some new server boots up and re-runs yesterday's Kafka stream. Settlement has no replay resistance so even though all these transactions are duplicates that goes undetected until customers start phoning up angrily and their bank realises what happened. To a first approximation nobody checks Authorization. If you wanted to be an asshole you could try it out, ask your bank to reverse a random fraction of all your transactions. When you get a bill, pick some at random, phone the bank. Insist those are bogus and you've never heard of them. In most cases the vendor has no usable Authorization records and will just write it off, they were entirely reliant on getting paid on the honour system. Obviously if you're unlucky you'll pick someone who can prove you owed them money and is angry about it, so you may not want to try this after all. You might think this situation is crazy but it's more common than you realise. There have been a lot of grave problems with SSL/TLS over the years. But there aren't many examples of actual consequences in practical terms. Mostly it seems as though there actually aren't bad guys trying to break your secure communications, so even if it would be possible they didn't try. Huh.

virgilp 8y ago
Oh wow, that makes perfect sense, thank you for writing the long reply. So you're basically telling me that it's only "authorisation" that checks the balance, and "settlement" doesn't? (I guess that also makes sense, now that I think about a few other things I noticed). How about the case I mentioned? If I told the bank "I did not authorise Avis, would Avis have been able to somehow "prove" that I authorised the transaction (I obviously didn't; the card was expired when they charged it; but I did have a signed contract with them, is that enough to directly take money from my account? Feels like it shouldn't be enough, not without a court getting involved).
- tialaramex 8y ago
  What Authorisation checks is up to the issuer. For most accounts the bank does NOT promise to prevent you from spending beyond the limit. That limit is for their benefit not yours. A regular EMV card has some limits programmed into it by the issuer like "I'm not allowed to say yes to more than $500 of spending without going online to my issuer" but the issuer chooses what those are, not you. Whether the bank has to take your side will depend on law where you are more than any technical facts. That signed contract is going to be a factor, and you giving Avis the card (even though months before and without expecting to pay this) would probably matter too, I'd be surprised if the issuer or the law was OK with something like "We found this card number on an unrelated payment from years ago so we charged it". I mostly think this should be "fixed" to be stricter, but let me briefly take the merchant's side. Suppose I check out from a hotel one morning. $120 for one night sir, thanks for staying with us. Two hours later cleaners find the room is trashed. I've ripped up the carpet, a chair is in pieces, the wall TV has been attacked with a knife. Why the hell shouldn't they be able to try putting it on my card? Should my bank really refuse if I have the money, and force them to take me to court to try to get their money just because I didn't authorise the charge? Realistically it's not in anyone's interest to insist on that except bad actors.
  - nybble41 8y ago
    > Should my bank really refuse if I have the money, and force them to take me to court to try to get their money just because I didn't authorise the charge? Yes, absolutely. Are you seriously arguing that anyone should be able to claim money from your bank account without either prior authorization by the account holder or independent arbitration? Bypassing the courts in cases like this serves no one's interests except bad actors.