6 ms·

This isn't new and has existed for nearly 20 years. Visa's implementation is called VAU (Visa Account Updater[1]) and Mastercard's is ABU (Automatic Billing Upd

This isn't new and has existed for nearly 20 years. Visa's implementation is called VAU (Visa Account Updater[1]) and Mastercard's is ABU (Automatic Billing Updater[2]). Issuers (banks) have to provide the details of these new cards to Visa/Mastercard, and the systems are certainly capable of updating the details of debit cards. It sounds like TD had a bug where they sent updates for cards which they shouldn't have. ie: TD broke their own rule about only enrolling credit cards. Card details which do not automatically update are really frustrating for customers – especially on services like Uber. In nearly all cases the customer is going to go and give the merchant their new card details anyway. My understanding is that if card is compromised (as opposed to being lost) then banks should not provide the new details. There isn't really much _additional_ privacy or security risk here beyond those posed by merchants/acquirers holding onto card details already – provided banks do it right. Though zooming out a little, long-lived payment tokens shared among every merchant a user shops with being the way things are still done is crazy. How long it has took to roll out EMV (chip cards), especially in the US, shows how hard it is to effect change in vast, three+ sided marketplaces like card networks. [1] https://developer.visa.com/capabilities/vau https://developer.visa.com/capabilities/vau [2] https://developer.mastercard.com/product/automatic-billing-updater https://developer.mastercard.com/product/automatic-billing-u... Disclosure: I work for a bank.

ricardobeat 7y ago
It sounds convenient for things like Uber, but should still be opt-in. Since the vendor can apply charges arbitrarily, having your new CC details shared without your knowledge doesn't feel right. I've never seen this anywhere, usually you get a warning that 'your payment method will expire' a few weeks in advance. Might be a US only practice?
- obeattie 7y ago
  It’s definitely a thing in Europe, but many merchants don’t bother to support it. Large ones like Amazon definitely do though, as do all merchants who use Stripe.
  - stordoff 7y ago
    Are you sure on Amazon? I've definitely had cards expire (Visa Debit/Mastercard) that have not been updated.
    - obeattie 7y ago
      Yes, though your bank has to also support it. https://www.amazon.com/gp/help/customer/display.html?nodeId=202074530 https://www.amazon.com/gp/help/customer/display.html?nodeId=...
Canada 7y ago
I prefer to be able to choose whether my card details are updated. By default I do not want updates. I will definitely give Uber my new card, but I like how card expiration kills subscriptions I don't care about without me having to do anything.
- chrisan 7y ago
  > but I like how card expiration kills subscriptions I don't care about without me having to do anything. I'm not advocating against choice of automatic updates... but shouldn't you come up with a different way to kill off subscriptions you don't care about? My VISA doesn't expire till 2023
  - Canada 7y ago
    It's far from ideal, but I like the reset provided by card expiration. Better would be if the issuer provided a web interface to turn off any subscriptions at will. Asking the merchant to do it is usually very annoying and time consuming by design, so sometimes it just doesn't get done.
    - pbreit 7y ago
      No guarantee that your card issuer will decline a transaction on an expired card. Plus, that may not actually cancel the subscription and you could continue building a debt. Just cancel the sub.
      - literallycancer 7y ago
        I think he's talking about services that intentionally make it hard or impossible to cancel.
        lordlimecat 7y ago
        This is overblown. Worst case, you can send a certified letter for most things. For gyms, it's pretty well known you either don't agree to said contract to begin with, or suck it up and show up in person if you did. And gyms have a valid contract and will likely continue accruing debt on your account which they could pursue if they wanted to.
coldcode 7y ago
I guess the solution is to switch to another bank, VISA can't automatically figure this out.
mwexler 7y ago
It's not just uber, think of all the utility companies and quarterly/annual billers who you put on your card to get rewards points. Who even knows how to change those, or which ones to change? Will you go through a year of statements? There are lots of ways to make this better, but it exists because the consumer complaints when banks didn't do this outweighed the few who wish to have payment vehicles actually expire. Banks could do a better job of listing the recurring billers, companies could do a better job of making it easier for you to update payment info (en masse), and networks could stop hiding behind issuers and big TV ads and provide direct-to-consumer controls even for banks that don't choose to offer them. Disclosure: at the time of this comment, I work for a bank.
pbreit 7y ago
I don’t think it’s that crazy. Has worked exceedingly well for 75 years. Can’t say that about too many systems.
- obeattie 7y ago
  The amount of fraud in the system is eye-watering. Everyone pays the price of that whether they realise it or not.

ricardobeat 7y ago

It sounds convenient for things like Uber, but should still be opt-in. Since the vendor can apply charges arbitrarily, having your new CC details shared without your knowledge doesn't feel right. I've never seen this anywhere, usually you get a warning that 'your payment method will expire' a few weeks in advance. Might be a US only practice?

obeattie 7y ago
It’s definitely a thing in Europe, but many merchants don’t bother to support it. Large ones like Amazon definitely do though, as do all merchants who use Stripe.
- stordoff 7y ago
  Are you sure on Amazon? I've definitely had cards expire (Visa Debit/Mastercard) that have not been updated.
  - obeattie 7y ago
    Yes, though your bank has to also support it. https://www.amazon.com/gp/help/customer/display.html?nodeId=202074530 https://www.amazon.com/gp/help/customer/display.html?nodeId=...

Canada 7y ago

I prefer to be able to choose whether my card details are updated. By default I do not want updates. I will definitely give Uber my new card, but I like how card expiration kills subscriptions I don't care about without me having to do anything.

chrisan 7y ago
> but I like how card expiration kills subscriptions I don't care about without me having to do anything. I'm not advocating against choice of automatic updates... but shouldn't you come up with a different way to kill off subscriptions you don't care about? My VISA doesn't expire till 2023
- Canada 7y ago
  It's far from ideal, but I like the reset provided by card expiration. Better would be if the issuer provided a web interface to turn off any subscriptions at will. Asking the merchant to do it is usually very annoying and time consuming by design, so sometimes it just doesn't get done.
  - pbreit 7y ago
    No guarantee that your card issuer will decline a transaction on an expired card. Plus, that may not actually cancel the subscription and you could continue building a debt. Just cancel the sub.
    - literallycancer 7y ago
      I think he's talking about services that intentionally make it hard or impossible to cancel.
      - lordlimecat 7y ago
        This is overblown. Worst case, you can send a certified letter for most things. For gyms, it's pretty well known you either don't agree to said contract to begin with, or suck it up and show up in person if you did. And gyms have a valid contract and will likely continue accruing debt on your account which they could pursue if they wanted to.

coldcode 7y ago

I guess the solution is to switch to another bank, VISA can't automatically figure this out.

mwexler 7y ago

It's not just uber, think of all the utility companies and quarterly/annual billers who you put on your card to get rewards points. Who even knows how to change those, or which ones to change? Will you go through a year of statements? There are lots of ways to make this better, but it exists because the consumer complaints when banks didn't do this outweighed the few who wish to have payment vehicles actually expire. Banks could do a better job of listing the recurring billers, companies could do a better job of making it easier for you to update payment info (en masse), and networks could stop hiding behind issuers and big TV ads and provide direct-to-consumer controls even for banks that don't choose to offer them. Disclosure: at the time of this comment, I work for a bank.

pbreit 7y ago

I don’t think it’s that crazy. Has worked exceedingly well for 75 years. Can’t say that about too many systems.

obeattie 7y ago
The amount of fraud in the system is eye-watering. Everyone pays the price of that whether they realise it or not.