6 ms·

No, it's how terrible people are. The chargeback mechanism is consumer protection through and through. It's there to help you deal with shady merchants, fraud,

No, it's how terrible people are. The chargeback mechanism is consumer protection through and through. It's there to help you deal with shady merchants, fraud, and theft. The fault lies entirely on the people abusing it. Blaming the banks here is akin to blaming the postal service because they delivered a bomb.

hyperman1 6y ago
You are too easy on the credit card system. If you manage to steal my european bank card, you can't use it without the pin code. If you get all numbers on it, you still have nothing usefull. This kind of fraud simply does not exist with our bank cards. This raises the bar for theft and fraud significantly compared to the credit card system, where a simple copy of the numbers on it is enough to take any amount you want.
- Cyph0n 6y ago
  > If you get all numbers on it, you still have nothing usefull. Does that also apply to online purchases?
  - andai 6y ago
    Yeah, and with the banks I have used, there is always a second factor like an authenticator or phone confirmation as well.
    - gambiting 6y ago
      That's....usually not true. At least the way it's implemented in the EU, yes, your bank has to verify if the transaction is legitimate, and optionally show you a challenge step. So when you pay online you usually get a small window displaying your bank's verification page, but unless there's something unusual about the payment, they don't actually verify it at all. So when I'm placing orders on Amazon it pretty much never comes up, but when I'm buying flights it usually does(but even then not always).
- xdrosenheim 6y ago
  > if you manage to steal my european bank card, you still can't use it without the pin. If you get all the numbers on it, you still have nothing usefull. You can absolutely use a credit card online if you get the card number, date and those last three numbers on the back. No need for a pin there. You can even use a stolen credit card these days in physical stores, because of the Contactless Payment on most new cards. As long as you don't spend too much, you won't need the pin.
  - rmccue 6y ago
    Not entirely. Since Strong Customer Authentication took effect in Europe, 2FA is now required in most places for most purchases. Additionally, contactless now "expires" occasionally, and requires you to put your PIN in after spending €150 since the last time you entered your PIN.
    - xdrosenheim 6y ago
      I have manage to go a few weeks without putting in my pin. I don't think there is a set limit. Not for my bank/card at least.
  - gambiting 6y ago
    In fact, you don't need a pin and you don't need the last three digits either. Pretty much every terminal can do a "card not present" transaction where you only need the long card number and the amount. My bank classes those as "telephone transactions" and I can disable them entirely on my card, but they are enabled by default.
  - hyperman1 6y ago
    That's more or less what I was saying? My european bank card is a debet card. If I pay online, it redirects to a page for my bank. This does a 2 factor authentication. The 2FA challenge contains the monetary amount and the IBAN check digits, so even MITM is hard.
    - guitarbill 6y ago
- z2 6y ago
  I've always wondered, does using a PIN make it both safer for the consumer and merchant, but also make it harder for the consumer to argue fraud? With my signature-only card, it's easy to receive the benefit of the doubt from the issuer when a shady charge hits, but with a PIN card, would the issuer respond, "It's your PIN, you agreed to guard it, so it's your fault."? I'm imagining some sort of ATM fraud situation where someone records or otherwise logs the PIN number. Or is the safety more from the chip not being replicable?
  - redpine 6y ago
    Yes it does make it harder to argue fraud. If the stolen credit card is used with the pin by the perpetrator, the bank will often say it was your responsibility to guard it.
    - bartwe 6y ago
      Had my card skimmed at a gasstation once, bank covered it and issues a new card with zero interaction from my side.
  - tialaramex 6y ago
    There are two parallel systems for payment cards, only one of which is "protected" by the PIN and which one is probably instructive for you. Authorisation is the system which verifies that you, the card's holder, authorised this payment. This is the part that EMV ("Chip and PIN") and lots of anti-fraud technologies are focused on, and yes its main purpose is to prevent you (though also the merchants) from defrauding the bank or other card issuer. Settlement is the system which transfers money from your account to a merchant's account. Authorisation is optional. If there is zero authorisation a settlement will still work, though there is some higher chance either the card holder later disputes it or the issuer decides it was fraudulent by their own methods. Big merchants often just don't use Authorisation at all. Whereas if they didn't do Settlement they wouldn't get the money, not doing Authorisation just means it's harder for them to "prove" you agreed to pay, but they may find it just isn't worth fighting you anyway. Knowing this you should read your card statements every time they're sent, in proportion to how careful you need to be about money (if you're Elon Musk maybe don't sweat any line item under $1000) because that's the first time you may find out that, for example a hotel in a country you've never visited has submitted Settlement data taking $500 for a hotel room you never booked. Mistake? Fraud? Who cares, if you don't spot it then you're out $500. Yes banks may tell a jury in a fraud trial (against you, their customer who has been stolen from, convicting you of fraud means they aren't on the hook for the missing money) that only you should have known the PIN and therefore the jury should assume that your inability to explain how "someone else" had the PIN means you're lying. You will need a good lawyer and experts to explain that actually the bank's insiders can know the PIN (the bank will try to dodge this awkward fact, insider fraud at banks is common and banks would prefer you never think about that) and there are various means by which it could have been stolen that the bank doesn't do enough to prevent. When EMV ("Chip and PIN") was introduced the main increase in fraud went like this: You hide a skimmer inside the PIN terminal, and it harvests card details (it could also harvest PINs). The terminals are supposed to have "anti-tamper" systems to defeat that, but they're trivially bypassed. Now, you can't use these to make EMV cards, but you can use it to make a convincing fake non-EMV card, and then use it in countries that haven't rolled out EMV. This fraud mostly went away as more countries finished deploying EMV but other types replaced it. Some of these things are only possible because EMV is a typical "Hand rolled crypto" solution where nobody remembered to hire actual expert cryptanalysts to critique and revise the design before it shipped. Others aren't technical at all.
- jeroenhd 6y ago
  This depends. My Dutch credit card with a PIN protecting it can be used online as long as you have all the numbers. However, almost everybody I know never uses credit cards to buy anything. Everyone I know uses debit cards. With the rise of contactless payments there's an argument to be made that those are still usable, but it only takes a quick call to your bank to disable that. All Dutch banks I've seen used online require at least SMS 2FA. Payment through mobile banking apps often do not, but the process of authenticating your phone with your bank is very cumbersome even for legitimate use. In my local banking ecosystem, digital fraud only really exists in the form of phishing. I don't think I even know anyone who's ever done a chargeback. The credit card system is horribly designed and because of compatibility reasons (and fear of change) fraud is much more common than with banking like I'm used to. I use my credit card as backup on holidays and for paying on some foreign websites but I never feel at ease entering my card details. It's ridiculous how in this day and age credit cards are still so easy to abuse.
  - csdreamer7 6y ago
    > However, almost everybody I know never uses credit cards to buy anything. Everyone I know uses debit cards. Why? Here in America CCs give fraud protection. Debit cards only after the first $50 after a fraud charge. Banks almost always reverse CC charges.
    - ryanlol 6y ago
      >Why? Because Europeans are weird about this, there isn’t really any reasonable explanation.
- StavrosK 6y ago
  Even this is too little criticism. Why do banks not implement an open standard with credit card processors, that allows the bank to talk directly to the processor and do a direct "push" transaction that I authorized, instead of having to "pull" money out of the card I'm giving to some shady site? Hell, even having disposable credit card numbers that were locked to a single merchant upon first use would basically eliminate card fraud.
  - TheCraiggers 6y ago
    Jeez people, at no point did I say that banks / credit card companies were perfect. Far from it. There are N+1 ways transactions could be improved, and each one probably has many reasons why "it can't be done". I don't feel like getting into all of that though, because it would take forever.
    - StavrosK 6y ago
      Jeez guy, nobody is attacking you. I was agreeing.
- some_random 6y ago
  That is not true at all.
293984j29384 6y ago
I think it's a bit more nuanced than that. You have credit card companies offering a service that's easily abused and then charging companies for accept their credit card service for their lack of fraud protection. As an online only platform, you don't have much choice other than to accept credit cards. It seems like it'd be so trivial to enact measures to reduce this type of fraud. My credit card company frequently sends me an SMS whenever I try to use my credit card on OVH.com, I suspect as a result of frequent fraud on their website.
fuster 6y ago
I think it's a little of column A and a little of column B. Just a few weeks ago I had two back-to-back $400+ fraudulent online charges on my card, but due to alerts I discovered it within 20 minutes of them happening. I immediately called my bank and notified them that they were fraudulent. Apparently they didn't bother to do anything for weeks because 1) the charges still went from pending to posted several days later 2) the vendors were apparently not notified through some other method because they shipped the products and 3) the charges showed up on my bill (although later I received credits when they completed their "investigation."). So as far as I can tell the vendors got left holding the bag even though the bank knew the charges were bad. I know that the vendors shipped the equipment because at least one of them contested the fraud by submitting proof of delivery from the shipper (to the wrong address)...
mavhc 6y ago
You're saying that just needing a username (and maybe a couple of bits of password), that you have to give to everyone you buy something from is good security?

hyperman1 6y ago

You are too easy on the credit card system. If you manage to steal my european bank card, you can't use it without the pin code. If you get all numbers on it, you still have nothing usefull. This kind of fraud simply does not exist with our bank cards. This raises the bar for theft and fraud significantly compared to the credit card system, where a simple copy of the numbers on it is enough to take any amount you want.

Cyph0n 6y ago
> If you get all numbers on it, you still have nothing usefull. Does that also apply to online purchases?
- andai 6y ago
  Yeah, and with the banks I have used, there is always a second factor like an authenticator or phone confirmation as well.
  - gambiting 6y ago
    That's....usually not true. At least the way it's implemented in the EU, yes, your bank has to verify if the transaction is legitimate, and optionally show you a challenge step. So when you pay online you usually get a small window displaying your bank's verification page, but unless there's something unusual about the payment, they don't actually verify it at all. So when I'm placing orders on Amazon it pretty much never comes up, but when I'm buying flights it usually does(but even then not always).
xdrosenheim 6y ago
> if you manage to steal my european bank card, you still can't use it without the pin. If you get all the numbers on it, you still have nothing usefull. You can absolutely use a credit card online if you get the card number, date and those last three numbers on the back. No need for a pin there. You can even use a stolen credit card these days in physical stores, because of the Contactless Payment on most new cards. As long as you don't spend too much, you won't need the pin.
- rmccue 6y ago
  Not entirely. Since Strong Customer Authentication took effect in Europe, 2FA is now required in most places for most purchases. Additionally, contactless now "expires" occasionally, and requires you to put your PIN in after spending €150 since the last time you entered your PIN.
  - xdrosenheim 6y ago
    I have manage to go a few weeks without putting in my pin. I don't think there is a set limit. Not for my bank/card at least.
- gambiting 6y ago
  In fact, you don't need a pin and you don't need the last three digits either. Pretty much every terminal can do a "card not present" transaction where you only need the long card number and the amount. My bank classes those as "telephone transactions" and I can disable them entirely on my card, but they are enabled by default.
- hyperman1 6y ago
  That's more or less what I was saying? My european bank card is a debet card. If I pay online, it redirects to a page for my bank. This does a 2 factor authentication. The 2FA challenge contains the monetary amount and the IBAN check digits, so even MITM is hard.
  - guitarbill 6y ago
z2 6y ago
I've always wondered, does using a PIN make it both safer for the consumer and merchant, but also make it harder for the consumer to argue fraud? With my signature-only card, it's easy to receive the benefit of the doubt from the issuer when a shady charge hits, but with a PIN card, would the issuer respond, "It's your PIN, you agreed to guard it, so it's your fault."? I'm imagining some sort of ATM fraud situation where someone records or otherwise logs the PIN number. Or is the safety more from the chip not being replicable?
- redpine 6y ago
  Yes it does make it harder to argue fraud. If the stolen credit card is used with the pin by the perpetrator, the bank will often say it was your responsibility to guard it.
  - bartwe 6y ago
    Had my card skimmed at a gasstation once, bank covered it and issues a new card with zero interaction from my side.
- tialaramex 6y ago
  There are two parallel systems for payment cards, only one of which is "protected" by the PIN and which one is probably instructive for you. Authorisation is the system which verifies that you, the card's holder, authorised this payment. This is the part that EMV ("Chip and PIN") and lots of anti-fraud technologies are focused on, and yes its main purpose is to prevent you (though also the merchants) from defrauding the bank or other card issuer. Settlement is the system which transfers money from your account to a merchant's account. Authorisation is optional. If there is zero authorisation a settlement will still work, though there is some higher chance either the card holder later disputes it or the issuer decides it was fraudulent by their own methods. Big merchants often just don't use Authorisation at all. Whereas if they didn't do Settlement they wouldn't get the money, not doing Authorisation just means it's harder for them to "prove" you agreed to pay, but they may find it just isn't worth fighting you anyway. Knowing this you should read your card statements every time they're sent, in proportion to how careful you need to be about money (if you're Elon Musk maybe don't sweat any line item under $1000) because that's the first time you may find out that, for example a hotel in a country you've never visited has submitted Settlement data taking $500 for a hotel room you never booked. Mistake? Fraud? Who cares, if you don't spot it then you're out $500. Yes banks may tell a jury in a fraud trial (against you, their customer who has been stolen from, convicting you of fraud means they aren't on the hook for the missing money) that only you should have known the PIN and therefore the jury should assume that your inability to explain how "someone else" had the PIN means you're lying. You will need a good lawyer and experts to explain that actually the bank's insiders can know the PIN (the bank will try to dodge this awkward fact, insider fraud at banks is common and banks would prefer you never think about that) and there are various means by which it could have been stolen that the bank doesn't do enough to prevent. When EMV ("Chip and PIN") was introduced the main increase in fraud went like this: You hide a skimmer inside the PIN terminal, and it harvests card details (it could also harvest PINs). The terminals are supposed to have "anti-tamper" systems to defeat that, but they're trivially bypassed. Now, you can't use these to make EMV cards, but you can use it to make a convincing fake non-EMV card, and then use it in countries that haven't rolled out EMV. This fraud mostly went away as more countries finished deploying EMV but other types replaced it. Some of these things are only possible because EMV is a typical "Hand rolled crypto" solution where nobody remembered to hire actual expert cryptanalysts to critique and revise the design before it shipped. Others aren't technical at all.
jeroenhd 6y ago
This depends. My Dutch credit card with a PIN protecting it can be used online as long as you have all the numbers. However, almost everybody I know never uses credit cards to buy anything. Everyone I know uses debit cards. With the rise of contactless payments there's an argument to be made that those are still usable, but it only takes a quick call to your bank to disable that. All Dutch banks I've seen used online require at least SMS 2FA. Payment through mobile banking apps often do not, but the process of authenticating your phone with your bank is very cumbersome even for legitimate use. In my local banking ecosystem, digital fraud only really exists in the form of phishing. I don't think I even know anyone who's ever done a chargeback. The credit card system is horribly designed and because of compatibility reasons (and fear of change) fraud is much more common than with banking like I'm used to. I use my credit card as backup on holidays and for paying on some foreign websites but I never feel at ease entering my card details. It's ridiculous how in this day and age credit cards are still so easy to abuse.
- csdreamer7 6y ago
  > However, almost everybody I know never uses credit cards to buy anything. Everyone I know uses debit cards. Why? Here in America CCs give fraud protection. Debit cards only after the first $50 after a fraud charge. Banks almost always reverse CC charges.
  - ryanlol 6y ago
    >Why? Because Europeans are weird about this, there isn’t really any reasonable explanation.
StavrosK 6y ago
Even this is too little criticism. Why do banks not implement an open standard with credit card processors, that allows the bank to talk directly to the processor and do a direct "push" transaction that I authorized, instead of having to "pull" money out of the card I'm giving to some shady site? Hell, even having disposable credit card numbers that were locked to a single merchant upon first use would basically eliminate card fraud.
- TheCraiggers 6y ago
  Jeez people, at no point did I say that banks / credit card companies were perfect. Far from it. There are N+1 ways transactions could be improved, and each one probably has many reasons why "it can't be done". I don't feel like getting into all of that though, because it would take forever.
  - StavrosK 6y ago
    Jeez guy, nobody is attacking you. I was agreeing.
some_random 6y ago
That is not true at all.

293984j29384 6y ago

I think it's a bit more nuanced than that. You have credit card companies offering a service that's easily abused and then charging companies for accept their credit card service for their lack of fraud protection. As an online only platform, you don't have much choice other than to accept credit cards. It seems like it'd be so trivial to enact measures to reduce this type of fraud. My credit card company frequently sends me an SMS whenever I try to use my credit card on OVH.com, I suspect as a result of frequent fraud on their website.

fuster 6y ago

I think it's a little of column A and a little of column B. Just a few weeks ago I had two back-to-back $400+ fraudulent online charges on my card, but due to alerts I discovered it within 20 minutes of them happening. I immediately called my bank and notified them that they were fraudulent. Apparently they didn't bother to do anything for weeks because 1) the charges still went from pending to posted several days later 2) the vendors were apparently not notified through some other method because they shipped the products and 3) the charges showed up on my bill (although later I received credits when they completed their "investigation."). So as far as I can tell the vendors got left holding the bag even though the bank knew the charges were bad. I know that the vendors shipped the equipment because at least one of them contested the fraud by submitting proof of delivery from the shipper (to the wrong address)...

mavhc 6y ago

You're saying that just needing a username (and maybe a couple of bits of password), that you have to give to everyone you buy something from is good security?