4 ms·

I'm sorry you have to put up with all of that, and I don't want to be part of the problem for folks like you. But here's the other side of the coin: I ran a sma

by Meekro 7y ago

I'm sorry you have to put up with all of that, and I don't want to be part of the problem for folks like you. But here's the other side of the coin: I ran a small VPS hosting company for many years, and the "small, poor, out-of-sight-out-of-mind countries" are a huge source of fraud. Someone signing up from an IP in Latvia, for example, was virtually guaranteed to be paying with a stolen card that would later get disputed. Debit card payments can get disputed, too, and disputes can happen as much as 120 days after the initial charge. For comparison purposes, the dispute rate for US-origin payments (US card, US origin IP, no evidence of proxy use) was under 1%. If I couldn't do things like "submit a scan of your passport", I would probably just decline any cards from high-risk countries. What would you suggest I do instead?

Crosseye_Jack 7y ago
Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud. In the EU one thing we are doing is basically enabling 2FA for card purchases aka "Strong Customer Authentication". Now I'm not 100% happy with the use of SMS as a 2FA but what will happen is if the bank or site ask for extra verification of a purchase the issuing bank will prompt the user to auth the transaction via another means (Either a SMS Code they enter into the page (think verify by visa but using a one time code that gets delivered to the customer with the amount they are approving), a Rich Communication Services with a Approve / Deny prompt or a push notification to the users banking app on their smart device. Will it defect card fraud completely? Nope, crooks are smart and will find ways around it like they did with chip and pin. But it will help (as long as we don't keep pushing back the rollout date - https://www.businessinsider.com/uk-delays-strong-customer-authentication-requirements-2019-8 https://www.businessinsider.com/uk-delays-strong-customer-au...).
- danShumway 7y ago
  > Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud. Agreed. There are basically zero digital payment systems in the US that aren't a complete joke, and all of our institutions think the correct answer to that problem is to add more captchas. Imagine an alternate reality where we discovered that HTTP traffic was trivially monster-in-the-middled, and instead of moving to HTTPS, we all said, "well, we'll just do device fingerprinting to validate the request came from the right person." This is the current digital payment system. Instead of moving to 2FA for each purchase or overhauling ACH, or changing payments to be a push system instead of a pull system, our solution to credit card fraud is that: A) payments will take a long time to resolve, B) customers will be required to be vetted using invasive, privacy-incompatible tools that don't work particularly well, and C) whenever something goes wrong, the merchant will take the financial hit instead of the payment processor that let the fraud happen in the first place. So many of our payment/privacy/fraud problems boil down to the fact that we are putting band-aides on a fundamentally broken system.
thegeomaster 7y ago
I don't think you as an individual can do a lot, and I don't blame you as an individual. In your position I would've probably done the same. The situation with poorer countries is completely clear. As people have less and less honest options of providing a dignified living for themselves and their family, their moral principles give way and they turn to crime. Maslow hierarchy of needs and all that. In my opinion, the blame for a lot of these situations is the aggressive exploitative treatment and bullying of "small guys" by "big guys" on the global scene. But that's a separate political discussion, and a long one at that. One thing that could help, but I doubt it's under your direct control, is taking advantage of systems such as 3-D Secure, which is SMS-based OTP for card payments. My card has this and I'm always happy to verify my payment this way, but payment processors are free to ignore these capabilities and just charge the card. (Conspiracy theory: this is because it hurts the conversion rates, as it adds another step to the funnel.) I think that a payment verified via 3-D Secure would have a much lower risk associated with it. But overall, I don't think I can offer any suggestions on how to make the system better. I ranted due to a perceived injustice, but that didn't mean I have ways ready to make the situation better. I think that change must come from the powers that be - and they're unlikely to suddenly start giving a shit, so there goes that. In any case, I thank you for considering my perspective and offering to help move the status quo. Rest assured, my friend, you are not part of the problem.
- im3w1l 7y ago
  > But overall, I don't think I can offer any suggestions on how to make the system better. I ranted due to a perceived injustice, but that didn't mean I have ways ready to make the situation better. I think that change must come from the powers that be - and they're unlikely to suddenly start giving a shit, so there goes that. > In any case, I thank you for considering my perspective and offering to help move the status quo. Rest assured, my friend, you are not part of the problem. I disagree with basically all of this. A lot of people here are part of the problem. They are part of "the powers that be". Not that they want to keep anyone down or anything, it's just that they have businesses to run and will do reasonable accommodations but no more. Since I'm sure everyone here wants the problem to be solved, if it can be done easily enough, there is a good hope of solving it with some smart technologies. 3d secure and looking at cookie reputation are both good ideas. If they are not used as much as you think they should be, we gotta ask why that is? Is it because it's too hard to implement? People haven't heard of it? Can library for doing it easily be made? Can it be pushed on people through add it as default, or including it in code samples?

by Meekro 7y ago

Crosseye_Jack 7y ago

Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud. In the EU one thing we are doing is basically enabling 2FA for card purchases aka "Strong Customer Authentication". Now I'm not 100% happy with the use of SMS as a 2FA but what will happen is if the bank or site ask for extra verification of a purchase the issuing bank will prompt the user to auth the transaction via another means (Either a SMS Code they enter into the page (think verify by visa but using a one time code that gets delivered to the customer with the amount they are approving), a Rich Communication Services with a Approve / Deny prompt or a push notification to the users banking app on their smart device. Will it defect card fraud completely? Nope, crooks are smart and will find ways around it like they did with chip and pin. But it will help (as long as we don't keep pushing back the rollout date - https://www.businessinsider.com/uk-delays-strong-customer-authentication-requirements-2019-8 https://www.businessinsider.com/uk-delays-strong-customer-au...).

danShumway 7y ago
> Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud. Agreed. There are basically zero digital payment systems in the US that aren't a complete joke, and all of our institutions think the correct answer to that problem is to add more captchas. Imagine an alternate reality where we discovered that HTTP traffic was trivially monster-in-the-middled, and instead of moving to HTTPS, we all said, "well, we'll just do device fingerprinting to validate the request came from the right person." This is the current digital payment system. Instead of moving to 2FA for each purchase or overhauling ACH, or changing payments to be a push system instead of a pull system, our solution to credit card fraud is that: A) payments will take a long time to resolve, B) customers will be required to be vetted using invasive, privacy-incompatible tools that don't work particularly well, and C) whenever something goes wrong, the merchant will take the financial hit instead of the payment processor that let the fraud happen in the first place. So many of our payment/privacy/fraud problems boil down to the fact that we are putting band-aides on a fundamentally broken system.

thegeomaster 7y ago

I don't think you as an individual can do a lot, and I don't blame you as an individual. In your position I would've probably done the same. The situation with poorer countries is completely clear. As people have less and less honest options of providing a dignified living for themselves and their family, their moral principles give way and they turn to crime. Maslow hierarchy of needs and all that. In my opinion, the blame for a lot of these situations is the aggressive exploitative treatment and bullying of "small guys" by "big guys" on the global scene. But that's a separate political discussion, and a long one at that. One thing that could help, but I doubt it's under your direct control, is taking advantage of systems such as 3-D Secure, which is SMS-based OTP for card payments. My card has this and I'm always happy to verify my payment this way, but payment processors are free to ignore these capabilities and just charge the card. (Conspiracy theory: this is because it hurts the conversion rates, as it adds another step to the funnel.) I think that a payment verified via 3-D Secure would have a much lower risk associated with it. But overall, I don't think I can offer any suggestions on how to make the system better. I ranted due to a perceived injustice, but that didn't mean I have ways ready to make the situation better. I think that change must come from the powers that be - and they're unlikely to suddenly start giving a shit, so there goes that. In any case, I thank you for considering my perspective and offering to help move the status quo. Rest assured, my friend, you are not part of the problem.

im3w1l 7y ago
> But overall, I don't think I can offer any suggestions on how to make the system better. I ranted due to a perceived injustice, but that didn't mean I have ways ready to make the situation better. I think that change must come from the powers that be - and they're unlikely to suddenly start giving a shit, so there goes that. > In any case, I thank you for considering my perspective and offering to help move the status quo. Rest assured, my friend, you are not part of the problem. I disagree with basically all of this. A lot of people here are part of the problem. They are part of "the powers that be". Not that they want to keep anyone down or anything, it's just that they have businesses to run and will do reasonable accommodations but no more. Since I'm sure everyone here wants the problem to be solved, if it can be done easily enough, there is a good hope of solving it with some smart technologies. 3d secure and looking at cookie reputation are both good ideas. If they are not used as much as you think they should be, we gotta ask why that is? Is it because it's too hard to implement? People haven't heard of it? Can library for doing it easily be made? Can it be pushed on people through add it as default, or including it in code samples?