5 ms·

> want to make a $5 payment? Hand over the secret that gives the other party the ability to take an unlimited amount of money from you at any time in the next 4

> want to make a $5 payment? Hand over the secret that gives the other party the ability to take an unlimited amount of money from you at any time in the next 4 years, and hope they don't misuse it I don't understand this at all, and I always feel so nervous using my card at US retailers for this reason (these days I try to stick to PayPal where possible). Where I'm from, _all_ one-off online card transactions are 2FA'd between you and your bank; it was strange to say the least the first time I paid for something on Amazon and the transaction just...went through.

Erlich_Bachman 6y ago
Look up what a "chargeback" is. That's the mechanism (and which has been working well enough in practice to keep the system going, and everyone is happy (except for some merchants of course)) that is preventing the dangers you are thinking about from occuring too often to unsuspecting card holders.
- AnthonyMouse 6y ago
  Then it brings with it a whole list of different problems, like being incredibly susceptible to buyer fraud, the cost of which everybody then has to eat. Meanwhile it causes the payment processors to not want to do business with merchants who get a large number of chargebacks, even if the problem isn't with the merchants but with their customers. In other words, it discriminates against merchants who do business with disadvantaged clientele who are more likely to have payment issues.
  - salawat 6y ago
    A merchant getting excessive numbers of chargebacks is not in and of itself an issue if you have all your ducks in a row. I mean it's an interesting enough heuristic, but can you provide an example of a processor that would refuse to business with someone because they had excessive chargeback, but also had the information in place to prove the purchases in question? I mean, if you've got crappy customers, I can understand where you're coming from, but I think your choice of customer base to market to may be more in question then whether the system as a whole is fit to transact in. I don't have much firsthand experience in it though, so I'd be thrilled if you could share some insight on it.
    - AnthonyMouse 6y ago
      > I mean it's an interesting enough heuristic, but can you provide an example of a processor that would refuse to business with someone because they had excessive chargeback, but also had the information in place to prove the purchases in question? The problem in many cases is the difficulty in proving the purchases. For something like digital content, the only proof you'd really have is some server logs showing that it was transferred, which are naturally trivial to fabricate because they're entirely under the control of the seller, and so the payment processor may not give them much weight. > I mean, if you've got crappy customers, I can understand where you're coming from, but I think your choice of customer base to market to may be more in question then whether the system as a whole is fit to transact in. But then you run headlong into the efficient market hypothesis, because when everybody else is avoiding that customer base for those reasons there is less competition and thereby greater opportunity. Also, from the perspective of the customer, just because 30% of similar customers are dirtbags doesn't mean you are or that you don't want to be able to buy your stuff.
  - Erlich_Bachman 6y ago
    I did not say it does not have any problems. The poster said that they don't understand why the whole system even works. I simply explained the mechanism by which it currently works. I did not say it was flawless.
tyoma 6y ago
In the US this isn't a major issue due to very consumer friendly legislation. This is omitting some details, but effectively you call your card provider and say you didn't make a purchase. Then its effectively up to the merchant to prove you did.
- ryanmarsh 6y ago
  Speaking of omitting details. Consumer friendly legislation helps solve a problem that need not exist in the first place and saying this “isn’t a major issue” assumes: a) the consumer catches it in time b) the consumer has the time to deal with the bank (try calling Wells Fargo in the midst of COVID) c) it doesn’t cause the consumer’s rent check to bounce The US payment card system is not a good solution for the non-cash payments problem.
- ceejayoz 6y ago
  That's not really consumer friendly. We wind up paying higher costs for everything because of this. The lost money doesn't magically disappear - the merchants have to include it in their costs. Actually fixing the problem - 2FA etc. - would probably be more consumer friendly in the long run.
  - AmericanChopper 6y ago
    Consumers have been paying for merchant losses since before credit cards even existed. The price of shop lifting, robbery, burglary, ect... have always been factored into brick and mortar pricing (even if only via the cost of insurance). The cost of fraud is factored into online pricing. It’s not a problem that’s going to go away.
    - ceejayoz 6y ago
      "It's not going away" is not a good reason not to mitigate.
  - kelnos 6y ago
    It really just depends on what you value most when it comes to "friendliness". If you value being able to just swipe your card or enter your details and be done with it, and not have to deal with 2FA prompts, remembering a PIN, digging in an app on your phone, or waiting for a code via SMS, then you might not mind the small price increases around the board to account for fraud. Not saying that's the case for everyone, but you can't define "customer friendly" in a narrow way that conforms to your personal desires and assume that's that. Also consider that if banks did have strong authentication around every purchase, there would be less of an incentive for banks or merchants to agree to roll over and eat the cost when there is fraud (and more ammunition for them against laws that require them to). No security/anti-fraud system is perfect, and something will always slip through; I wouldn't want to be a card holder stuck with a big bill because someone managed to clone/swap my SIM (for example) and make transactions using my card if I had no protection from that.
fingerlocks 6y ago
The banks have determined that the cost of preventing fraud is higher than the fraud itself. If you suspect fraud on your account, or if a card is stolen/lost, the fraudulent transaction is quickly reversed and a new card arrives in the mail in 2-3 days. And it's pretty rare. I've had only once actual instance of electric fraud, and one stolen card in 20 years. That's 20 years of never having to remember or type in a PIN.
- bluGill 6y ago
  2fa has appearantly been found too expensive. Banks do a lot of fraud detection in the background.
pricechild 6y ago
I get your decision making but the annoying thing is that using PayPal will most likely reduce your legal protections? Fingers crossed PayPal don't screw you over...
vbezhenar 6y ago
AFAIK you're talking about 3DS and under 3DS the code is treated like a PIN. So if you want to revert transaction protected by 3DS, you're out of luck, because you acknowledged it yourself. Now if your transaction is not 3DS (or PIN) protected, you can claim that your card was stolen and bank should revert transaction and issue new card. So it's about who's responsible. Without 3DS or PIN a merchant is responsible. With 3DS or PIN a client is responsible.
- Nextgrid 6y ago
  Keep in mind that this difference only applies to fraud. You can still dispute transactions for other reasons (missing/wrong goods delivered, etc).
- filleduchaos 6y ago
  I have never had trouble getting a transaction I legitimately needed reverted to be reverted.

Erlich_Bachman 6y ago

Look up what a "chargeback" is. That's the mechanism (and which has been working well enough in practice to keep the system going, and everyone is happy (except for some merchants of course)) that is preventing the dangers you are thinking about from occuring too often to unsuspecting card holders.

AnthonyMouse 6y ago
Then it brings with it a whole list of different problems, like being incredibly susceptible to buyer fraud, the cost of which everybody then has to eat. Meanwhile it causes the payment processors to not want to do business with merchants who get a large number of chargebacks, even if the problem isn't with the merchants but with their customers. In other words, it discriminates against merchants who do business with disadvantaged clientele who are more likely to have payment issues.
- salawat 6y ago
  A merchant getting excessive numbers of chargebacks is not in and of itself an issue if you have all your ducks in a row. I mean it's an interesting enough heuristic, but can you provide an example of a processor that would refuse to business with someone because they had excessive chargeback, but also had the information in place to prove the purchases in question? I mean, if you've got crappy customers, I can understand where you're coming from, but I think your choice of customer base to market to may be more in question then whether the system as a whole is fit to transact in. I don't have much firsthand experience in it though, so I'd be thrilled if you could share some insight on it.
  - AnthonyMouse 6y ago
    > I mean it's an interesting enough heuristic, but can you provide an example of a processor that would refuse to business with someone because they had excessive chargeback, but also had the information in place to prove the purchases in question? The problem in many cases is the difficulty in proving the purchases. For something like digital content, the only proof you'd really have is some server logs showing that it was transferred, which are naturally trivial to fabricate because they're entirely under the control of the seller, and so the payment processor may not give them much weight. > I mean, if you've got crappy customers, I can understand where you're coming from, but I think your choice of customer base to market to may be more in question then whether the system as a whole is fit to transact in. But then you run headlong into the efficient market hypothesis, because when everybody else is avoiding that customer base for those reasons there is less competition and thereby greater opportunity. Also, from the perspective of the customer, just because 30% of similar customers are dirtbags doesn't mean you are or that you don't want to be able to buy your stuff.
- Erlich_Bachman 6y ago
  I did not say it does not have any problems. The poster said that they don't understand why the whole system even works. I simply explained the mechanism by which it currently works. I did not say it was flawless.

tyoma 6y ago

In the US this isn't a major issue due to very consumer friendly legislation. This is omitting some details, but effectively you call your card provider and say you didn't make a purchase. Then its effectively up to the merchant to prove you did.

ryanmarsh 6y ago
Speaking of omitting details. Consumer friendly legislation helps solve a problem that need not exist in the first place and saying this “isn’t a major issue” assumes: a) the consumer catches it in time b) the consumer has the time to deal with the bank (try calling Wells Fargo in the midst of COVID) c) it doesn’t cause the consumer’s rent check to bounce The US payment card system is not a good solution for the non-cash payments problem.
ceejayoz 6y ago
That's not really consumer friendly. We wind up paying higher costs for everything because of this. The lost money doesn't magically disappear - the merchants have to include it in their costs. Actually fixing the problem - 2FA etc. - would probably be more consumer friendly in the long run.
- AmericanChopper 6y ago
  Consumers have been paying for merchant losses since before credit cards even existed. The price of shop lifting, robbery, burglary, ect... have always been factored into brick and mortar pricing (even if only via the cost of insurance). The cost of fraud is factored into online pricing. It’s not a problem that’s going to go away.
  - ceejayoz 6y ago
    "It's not going away" is not a good reason not to mitigate.
- kelnos 6y ago
  It really just depends on what you value most when it comes to "friendliness". If you value being able to just swipe your card or enter your details and be done with it, and not have to deal with 2FA prompts, remembering a PIN, digging in an app on your phone, or waiting for a code via SMS, then you might not mind the small price increases around the board to account for fraud. Not saying that's the case for everyone, but you can't define "customer friendly" in a narrow way that conforms to your personal desires and assume that's that. Also consider that if banks did have strong authentication around every purchase, there would be less of an incentive for banks or merchants to agree to roll over and eat the cost when there is fraud (and more ammunition for them against laws that require them to). No security/anti-fraud system is perfect, and something will always slip through; I wouldn't want to be a card holder stuck with a big bill because someone managed to clone/swap my SIM (for example) and make transactions using my card if I had no protection from that.

fingerlocks 6y ago

The banks have determined that the cost of preventing fraud is higher than the fraud itself. If you suspect fraud on your account, or if a card is stolen/lost, the fraudulent transaction is quickly reversed and a new card arrives in the mail in 2-3 days. And it's pretty rare. I've had only once actual instance of electric fraud, and one stolen card in 20 years. That's 20 years of never having to remember or type in a PIN.

bluGill 6y ago
2fa has appearantly been found too expensive. Banks do a lot of fraud detection in the background.

pricechild 6y ago

I get your decision making but the annoying thing is that using PayPal will most likely reduce your legal protections? Fingers crossed PayPal don't screw you over...

vbezhenar 6y ago

AFAIK you're talking about 3DS and under 3DS the code is treated like a PIN. So if you want to revert transaction protected by 3DS, you're out of luck, because you acknowledged it yourself. Now if your transaction is not 3DS (or PIN) protected, you can claim that your card was stolen and bank should revert transaction and issue new card. So it's about who's responsible. Without 3DS or PIN a merchant is responsible. With 3DS or PIN a client is responsible.

Nextgrid 6y ago
Keep in mind that this difference only applies to fraud. You can still dispute transactions for other reasons (missing/wrong goods delivered, etc).
filleduchaos 6y ago
I have never had trouble getting a transaction I legitimately needed reverted to be reverted.