3 ms·

Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment

Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud. In the EU one thing we are doing is basically enabling 2FA for card purchases aka "Strong Customer Authentication". Now I'm not 100% happy with the use of SMS as a 2FA but what will happen is if the bank or site ask for extra verification of a purchase the issuing bank will prompt the user to auth the transaction via another means (Either a SMS Code they enter into the page (think verify by visa but using a one time code that gets delivered to the customer with the amount they are approving), a Rich Communication Services with a Approve / Deny prompt or a push notification to the users banking app on their smart device. Will it defect card fraud completely? Nope, crooks are smart and will find ways around it like they did with chip and pin. But it will help (as long as we don't keep pushing back the rollout date - https://www.businessinsider.com/uk-delays-strong-customer-authentication-requirements-2019-8 https://www.businessinsider.com/uk-delays-strong-customer-au...).

danShumway 7y ago
> Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud. Agreed. There are basically zero digital payment systems in the US that aren't a complete joke, and all of our institutions think the correct answer to that problem is to add more captchas. Imagine an alternate reality where we discovered that HTTP traffic was trivially monster-in-the-middled, and instead of moving to HTTPS, we all said, "well, we'll just do device fingerprinting to validate the request came from the right person." This is the current digital payment system. Instead of moving to 2FA for each purchase or overhauling ACH, or changing payments to be a push system instead of a pull system, our solution to credit card fraud is that: A) payments will take a long time to resolve, B) customers will be required to be vetted using invasive, privacy-incompatible tools that don't work particularly well, and C) whenever something goes wrong, the merchant will take the financial hit instead of the payment processor that let the fraud happen in the first place. So many of our payment/privacy/fraud problems boil down to the fact that we are putting band-aides on a fundamentally broken system.

danShumway 7y ago

> Start pushing for more validation from the payment providers so you can be sure that a payment is legit and once you have jumped though the hoops that a payment is legit the bank takes the hit for the fraud. Agreed. There are basically zero digital payment systems in the US that aren't a complete joke, and all of our institutions think the correct answer to that problem is to add more captchas. Imagine an alternate reality where we discovered that HTTP traffic was trivially monster-in-the-middled, and instead of moving to HTTPS, we all said, "well, we'll just do device fingerprinting to validate the request came from the right person." This is the current digital payment system. Instead of moving to 2FA for each purchase or overhauling ACH, or changing payments to be a push system instead of a pull system, our solution to credit card fraud is that: A) payments will take a long time to resolve, B) customers will be required to be vetted using invasive, privacy-incompatible tools that don't work particularly well, and C) whenever something goes wrong, the merchant will take the financial hit instead of the payment processor that let the fraud happen in the first place. So many of our payment/privacy/fraud problems boil down to the fact that we are putting band-aides on a fundamentally broken system.