3 ms·

> I fully believe that a consumer bank will refund 99.99% of transactions without asking further questions if you tell them it's fraud. OK, so my point still s

> I fully believe that a consumer bank will refund 99.99% of transactions without asking further questions if you tell them it's fraud. OK, so my point still stands then?! I mean, it's certainly true that banks will generally refund (and in many jurisdictions have to refund) if they can tell that the customer was defrauded, and they also generally won't inconvenience their customers over small amounts. But for one, you didn't say 100%, and you can guess that the remaining 0.01% (though I would guess it's quite a bit more than that) are not the 100 pound transactions that ultimately wouldn't really hurt the customer anyway, but rather those that wipe out someone's life savings. It's an easy business decision for a bank to immediately refund you 100 pounds if they expect to make more than 100 pounds from you by retaining you as a customer. It's very much not if you are asking them to refund you 100000 pounds. So, there is a bias in this mechanism that it primarily helps those who don't need it, but is of questionable reliability for those who really need it. Plus, even if you do get your life savings back, you can be sure that just asking them to refund you 100000 pounds will not do the trick. So, yeah, sure, banks will refund you more often than not. But my point was that that is not something you can really rely on when it actually matters, and I stand by that.

maccard 7y ago
> and you can guess that the remaining 0.01% (though I would guess it's quite a bit more than that) are not the 100 pound transactions that ultimately wouldn't really hurt the customer anyway, but rather those that wipe out someone's life savings I disagree - like I mentioned before, actually getting my bank to _make_ a medium sized transaction (debit card >1k) required me to phone them in advance. I'm not going to say 100% because all you need is one anecdote about a fraud transaction being reversed, for any reason, and 100% isn't valid.
- zAy0LfpBZLC8mAC 7y ago
  > I disagree - like I mentioned before, actually getting my bank to _make_ a medium sized transaction (debit card >1k) required me to phone them in advance. Are they legally required to do so? Could an attacker circumvent this somehow (such as redirecting the calls to themselves)? ... Apart from the fact that preventing me from using my money is terrible usability. If I am not contractually obligated to have my phone with me, but they suddenly refuse to authorize a transaction because they can't reach me on my phone, I suddenly have to fulfill some secret requirements in order to be able to spend my own money. > I'm not going to say 100% because all you need is one anecdote about a fraud transaction being reversed, for any reason, and 100% isn't valid. The point is: You recognize that that probably does happen. And that some of those cases could be prevented with strong passwords. So ... what is your point?

maccard 7y ago

> and you can guess that the remaining 0.01% (though I would guess it's quite a bit more than that) are not the 100 pound transactions that ultimately wouldn't really hurt the customer anyway, but rather those that wipe out someone's life savings I disagree - like I mentioned before, actually getting my bank to _make_ a medium sized transaction (debit card >1k) required me to phone them in advance. I'm not going to say 100% because all you need is one anecdote about a fraud transaction being reversed, for any reason, and 100% isn't valid.

zAy0LfpBZLC8mAC 7y ago
> I disagree - like I mentioned before, actually getting my bank to _make_ a medium sized transaction (debit card >1k) required me to phone them in advance. Are they legally required to do so? Could an attacker circumvent this somehow (such as redirecting the calls to themselves)? ... Apart from the fact that preventing me from using my money is terrible usability. If I am not contractually obligated to have my phone with me, but they suddenly refuse to authorize a transaction because they can't reach me on my phone, I suddenly have to fulfill some secret requirements in order to be able to spend my own money. > I'm not going to say 100% because all you need is one anecdote about a fraud transaction being reversed, for any reason, and 100% isn't valid. The point is: You recognize that that probably does happen. And that some of those cases could be prevented with strong passwords. So ... what is your point?