5 ms·

Unfortunately this is the problem that Chase created ... we give users a way to download a form letter instead, but were just trying to make it as easy as possi

Unfortunately this is the problem that Chase created ... we give users a way to download a form letter instead, but were just trying to make it as easy as possible for customers to opt out if they would like to do so

lozenge 7y ago
You're teaching users it's OK to give out their account information "sometimes". Which is much less secure than "never".
- ralph84 7y ago
  I give out my credit card number hundreds of times per year. Credit cards wouldn't be very useful if you never gave them out.
  - WoahNoun 7y ago
    An ecommerce site has a merchant agreement with a payment processor to comply with PCI DSS. This does not. It is in no way similar.
    - zbruhnke 7y ago
      FYI we are complying with PCI DSS when you use this site - you can read details in the FAQ
      - snazz 7y ago
        Do we have proof of that? I think the fact that we're taking your word for everything so far is the source of the discomfort here.
        toomuchtodo 7y ago
        Sort of humorous comment, as PCI DSS is self assessment and attestation of compliance. If OP states they’ve met their burden, that’s all that’s required at their scale.
        snazz 7y ago
        Really? I evidently know nothing of the matter, but you're saying that the auditors only get involved when they become a larger operation?
        toomuchtodo 7y ago
        Yep. Card networks can also unilaterally decide your level. https://www.pcicomplianceguide.org/faq/#4 https://www.pcicomplianceguide.org/faq/#4 Disclaimer: I work in governance/risk/compliance, but have not performed PCI compliance work in the last several years.
        gowld 7y ago
        PCI DSS assessments are signed by natural persons, not arbitrary HTML content.
        deleted 7y ago
        [deleted]
        toomuchtodo 7y ago
        Natural persons who are rarely, if ever, pursued when breaches occur.
      - craftyguy 7y ago
        Anyone can make a FAQ on the web. Not everyone can prove compliance with PCI DSS.
        chipperyman573 7y ago
        The same could be said about any other online merchant...
        igetspam 7y ago
        It could but they should be able to provide an Attestation of Compliance. If they can't, then you can trust that they're PCI compliant.
    - laughinghan 7y ago
      I give out my credit card number hundreds of times per year to websites that I have not verified have a merchant agreement with a payment processor to comply with PCI DSS. In terms of what users are taught (which is plainly the context of the comment you are replying to), this website is identical to ecommerce sites.
- travisjungroth 7y ago
  What about buying things? This is the same info that would go in an order form.
- deleted 7y ago
  [deleted]
gricardo99 7y ago
>we give users a way to download a form letter instead But you don't just let them download it. You make them give you their email address first. Edit: Haha! No wait, you have to click through two levels of "Don't want to give us your info? Click here to get the letter". The first one asks for you email, only after the second do you actually get the letter. Why? They already said "dont want to...". Just give it to them! Edit2: Also the form letter, prepopulated with the Chase customer service P.O. box address, is another scam pitfall. Anyone using this kind of form letter should always check the address with the financial institution before sending any forms, especially that include PII/financial information.
- Wowfunhappy 7y ago
  > The first one asks for you email, only after the second do you actually get the letter. They're pretty clearly trying to collect email addresses through this campaign. I'm okay with that. My email address isn't exactly private, and this site is going to pay to mail physical letters for me. > Also the form letter, prepopulated with the Chase customer service P.O. box address, is another scam pitfall. Anyone using this kind of form letter should always check the address with the financial institution before sending any forms, especially that include PII/financial information. Is the address fradulent? If so, please tell us. If not, I don’t see the concern.
  - gricardo99 7y ago
    >I don’t see the concern. really? No concern downloading a form letter from some web site and mailing PII/account information to the address they provided? Call me paranoid, but that kind of behavior is just waiting to run into a scam. My point was not about the address, it was about general wariness of scams. No different than always calling your financial institution using a valid/known number, rather than a number provided to you by a voicemail/email/letter.
    - Wowfunhappy 7y ago
      You need to consider the two possible evils. If I don't use this website, there is a 100% chance I will "agree" to binding arbitration. I know myself. There is absolutely no way I am going to print, fill out, and mail in a paper form. Is this website a perfect solution? No, but I don't see a better option under the circumstances, and from what I can tell, the people running it are doing the right things within the confines of what is necessary for their solution to work. If that's not the case, criticize away, and certainly let us know if you have a clear reason to believe this specific project is a scam. But keep the goal in mind. It certainly set off some alarm bells for me, but when I read through the site it all made sense.
deleted 7y ago
[deleted]
Sephr 7y ago
Is the form letter generated on the client-side?
craftyguy 7y ago
Collecting/storing credit card numbers, names, and addresses is creating a whole new problem for users.
briandear 7y ago
Chase didn’t set up a website asking for account numbers. So how did Chase create this problem? What exactly have they done wrong? If someone disagrees with the policy, they can opt-out, so what’s the problem that causes someone to need to give a bank account number to a random website? Why not just disclose in big letters what the site is all about: lead generation for a law firm? This isn’t some kind of “we like to help people,” project any more than ambulance chasers seek “justice.” There is a place for lawsuits certainly, but let’s not pretend this is about “helping,” it’s about lead generation.

lozenge 7y ago

You're teaching users it's OK to give out their account information "sometimes". Which is much less secure than "never".

ralph84 7y ago
I give out my credit card number hundreds of times per year. Credit cards wouldn't be very useful if you never gave them out.
- WoahNoun 7y ago
  An ecommerce site has a merchant agreement with a payment processor to comply with PCI DSS. This does not. It is in no way similar.
  - zbruhnke 7y ago
    FYI we are complying with PCI DSS when you use this site - you can read details in the FAQ
    - snazz 7y ago
      Do we have proof of that? I think the fact that we're taking your word for everything so far is the source of the discomfort here.
      - toomuchtodo 7y ago
        Sort of humorous comment, as PCI DSS is self assessment and attestation of compliance. If OP states they’ve met their burden, that’s all that’s required at their scale.
        snazz 7y ago
        Really? I evidently know nothing of the matter, but you're saying that the auditors only get involved when they become a larger operation?
        toomuchtodo 7y ago
        Yep. Card networks can also unilaterally decide your level. https://www.pcicomplianceguide.org/faq/#4 https://www.pcicomplianceguide.org/faq/#4 Disclaimer: I work in governance/risk/compliance, but have not performed PCI compliance work in the last several years.
        gowld 7y ago
        PCI DSS assessments are signed by natural persons, not arbitrary HTML content.
        deleted 7y ago
        [deleted]
        toomuchtodo 7y ago
        Natural persons who are rarely, if ever, pursued when breaches occur.
    - craftyguy 7y ago
      Anyone can make a FAQ on the web. Not everyone can prove compliance with PCI DSS.
      - chipperyman573 7y ago
        The same could be said about any other online merchant...
        igetspam 7y ago
        It could but they should be able to provide an Attestation of Compliance. If they can't, then you can trust that they're PCI compliant.
  - laughinghan 7y ago
    I give out my credit card number hundreds of times per year to websites that I have not verified have a merchant agreement with a payment processor to comply with PCI DSS. In terms of what users are taught (which is plainly the context of the comment you are replying to), this website is identical to ecommerce sites.
travisjungroth 7y ago
What about buying things? This is the same info that would go in an order form.
deleted 7y ago
[deleted]

gricardo99 7y ago

>we give users a way to download a form letter instead But you don't just let them download it. You make them give you their email address first. Edit: Haha! No wait, you have to click through two levels of "Don't want to give us your info? Click here to get the letter". The first one asks for you email, only after the second do you actually get the letter. Why? They already said "dont want to...". Just give it to them! Edit2: Also the form letter, prepopulated with the Chase customer service P.O. box address, is another scam pitfall. Anyone using this kind of form letter should always check the address with the financial institution before sending any forms, especially that include PII/financial information.

Wowfunhappy 7y ago
> The first one asks for you email, only after the second do you actually get the letter. They're pretty clearly trying to collect email addresses through this campaign. I'm okay with that. My email address isn't exactly private, and this site is going to pay to mail physical letters for me. > Also the form letter, prepopulated with the Chase customer service P.O. box address, is another scam pitfall. Anyone using this kind of form letter should always check the address with the financial institution before sending any forms, especially that include PII/financial information. Is the address fradulent? If so, please tell us. If not, I don’t see the concern.
- gricardo99 7y ago
  >I don’t see the concern. really? No concern downloading a form letter from some web site and mailing PII/account information to the address they provided? Call me paranoid, but that kind of behavior is just waiting to run into a scam. My point was not about the address, it was about general wariness of scams. No different than always calling your financial institution using a valid/known number, rather than a number provided to you by a voicemail/email/letter.
  - Wowfunhappy 7y ago
    You need to consider the two possible evils. If I don't use this website, there is a 100% chance I will "agree" to binding arbitration. I know myself. There is absolutely no way I am going to print, fill out, and mail in a paper form. Is this website a perfect solution? No, but I don't see a better option under the circumstances, and from what I can tell, the people running it are doing the right things within the confines of what is necessary for their solution to work. If that's not the case, criticize away, and certainly let us know if you have a clear reason to believe this specific project is a scam. But keep the goal in mind. It certainly set off some alarm bells for me, but when I read through the site it all made sense.

deleted 7y ago

[deleted]

Sephr 7y ago

Is the form letter generated on the client-side?

craftyguy 7y ago

Collecting/storing credit card numbers, names, and addresses is creating a whole new problem for users.

briandear 7y ago

Chase didn’t set up a website asking for account numbers. So how did Chase create this problem? What exactly have they done wrong? If someone disagrees with the policy, they can opt-out, so what’s the problem that causes someone to need to give a bank account number to a random website? Why not just disclose in big letters what the site is all about: lead generation for a law firm? This isn’t some kind of “we like to help people,” project any more than ambulance chasers seek “justice.” There is a place for lawsuits certainly, but let’s not pretend this is about “helping,” it’s about lead generation.