5 ms·

Hi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I

Hi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I was also security officer. Basically, credit cards can be very secure. But it also costs. Banks do simple cost/benefit decisions and may in many cases significantly lag behind in technology for various reasons. They get away with this because consumers have absolutely no idea how cards differ and what the options are.

whitepoplar 6y ago
Can you give any recommendations on banks that really get it right? How about the inverse?
dddddaviddddd 6y ago
What features make a secure credit card and how can a consumer verify their presence?
throwaway_pdp09 6y ago
> because consumers have absolutely no idea how cards differ and what the options are Well if there's a time and a place to educate people, it's here and now. Your knowledge would be appreciated, TIA
cosmie 6y ago
> They get away with this because consumers have absolutely no idea how cards differ and what the options are. Do you have any tips/resources for how an interested consumer can become more informed (whether for personal or small business accounts)? Would you be able to get this type of information you'd be able to get to through contacting support, if you know the right way to ask? Or would it be considered too sensitive for the bank to give out implementation details that easily?
rblatz 6y ago
But also banks take on all the liability for misuse. Customers aren’t liable for fraudulent charges, that’s why America has lagged behind Europe on rolling out chip cards, customers don’t demand it because they don’t pay the price for card fraud.
- Wowfunhappy 6y ago
  Right, and so the trade-off seems completely reasonable to me. If the bank has calculated that extra fraud costs less than the price mitigating it with additional security measures, and it is the one bearing the cost either way, then power to them!
  - VBprogrammer 6y ago
    This completely ignores the amount of worry and frustration which an ordinary person has to go through to get back to the point that only the bank are out of pocket. It's not trivial by any means. You could also make an argument that by continuing to allow this fraud to happen we're funding all kinds of nasty people. I'm not convinced the argument holds water since bad guys are often faster to move than the banks but it's worth noting.
    - kergonath 6y ago
      It’s a systemic issue. In jurisdictions where banks cannot shift the risk to the customers, they tend to be more effective. In the few European countries I know, banks are very pro-active about card fraud and refund without asking questions if fraud happens anyway. Nasty people will get funded anyway, but reducing fraud also reduces their income. The main drawback is that people have to use their PIN (and even that is getting rare thanks to contactless cards).
  - techsupporter 6y ago
    I'm not sure I understand this. Fraud, and cleaning up after it, is not free of cost. If anything, fraud is more insidious because it costs the one thing I can't replace, which is time. Even for me--someone who has multiple payment cards, primarily uses credit (instead of debit), a healthy savings account, and a flexible job--cleaning up from a stolen credit card number takes two or three hours at a minimum. For someone who does not have those things, particularly for people who primarily use debit cards[0], the impact is far worse. If we swapped our cards to simply require a PIN that's validated by the chip on the card (so that in-person charges without the proper PIN cannot complete, even if the card is shimmed), that removes the bulk of in-person fraud attempts. But US banks are, largely, so fearful of customers switching away from them at even the slightest provocation, we don't get PINs. So I'm forced to ask what other "basic" measures (like 3D Secure for online transactions) we lack. 0 - I don't want to hear the rebuttal that "well, people should just use credit cards." There are a hundred different reasons why people don't use credit cards--don't qualify for one, have an objection to debt, past bad experience, and so on--and we cannot write off people who "only" use debit from security measures.
lsllc 6y ago
I think the bigger issue is not the terminals themselves, but the software behind it that's designed to process the payment from the track data. Contactless magstripe (MSD) is a workaround that allows for a contactless payment, but really is just sending the same (insecure) track data through the backend software. Contactless EMV is the right way, but requires more sophisticated software.
kergonath 6y ago
My experience has been that all the banks that gave me cards were diligent in verifying suspicious transactions, often erring on the side of caution and asking for confirmation. Also, they don’t tend to argue much before refunding an illegal transaction. So, from my point of view, it could certainly be improved (along the lines of what Apple Pay is doing with tokenisation: confidentiality is an issue), but there is no real reason to complain. As long as fraudulent transactions are rare enough that the banks don’t drag their feet, it’s fine.
specialist 6y ago
How can noobs like me assess how good any given POS is? Is there a rating system? Any way to inspect transactions to see the whatnots? Knowing nothing, I've been doing as much as possible using Apple Pay, because IIRC they do some kind of token exchange, vs sending my digits across the wire.

whitepoplar 6y ago

Can you give any recommendations on banks that really get it right? How about the inverse?

dddddaviddddd 6y ago

What features make a secure credit card and how can a consumer verify their presence?

throwaway_pdp09 6y ago

> because consumers have absolutely no idea how cards differ and what the options are Well if there's a time and a place to educate people, it's here and now. Your knowledge would be appreciated, TIA

cosmie 6y ago

> They get away with this because consumers have absolutely no idea how cards differ and what the options are. Do you have any tips/resources for how an interested consumer can become more informed (whether for personal or small business accounts)? Would you be able to get this type of information you'd be able to get to through contacting support, if you know the right way to ask? Or would it be considered too sensitive for the bank to give out implementation details that easily?

rblatz 6y ago

But also banks take on all the liability for misuse. Customers aren’t liable for fraudulent charges, that’s why America has lagged behind Europe on rolling out chip cards, customers don’t demand it because they don’t pay the price for card fraud.

Wowfunhappy 6y ago
Right, and so the trade-off seems completely reasonable to me. If the bank has calculated that extra fraud costs less than the price mitigating it with additional security measures, and it is the one bearing the cost either way, then power to them!
- VBprogrammer 6y ago
  This completely ignores the amount of worry and frustration which an ordinary person has to go through to get back to the point that only the bank are out of pocket. It's not trivial by any means. You could also make an argument that by continuing to allow this fraud to happen we're funding all kinds of nasty people. I'm not convinced the argument holds water since bad guys are often faster to move than the banks but it's worth noting.
  - kergonath 6y ago
    It’s a systemic issue. In jurisdictions where banks cannot shift the risk to the customers, they tend to be more effective. In the few European countries I know, banks are very pro-active about card fraud and refund without asking questions if fraud happens anyway. Nasty people will get funded anyway, but reducing fraud also reduces their income. The main drawback is that people have to use their PIN (and even that is getting rare thanks to contactless cards).
- techsupporter 6y ago
  I'm not sure I understand this. Fraud, and cleaning up after it, is not free of cost. If anything, fraud is more insidious because it costs the one thing I can't replace, which is time. Even for me--someone who has multiple payment cards, primarily uses credit (instead of debit), a healthy savings account, and a flexible job--cleaning up from a stolen credit card number takes two or three hours at a minimum. For someone who does not have those things, particularly for people who primarily use debit cards[0], the impact is far worse. If we swapped our cards to simply require a PIN that's validated by the chip on the card (so that in-person charges without the proper PIN cannot complete, even if the card is shimmed), that removes the bulk of in-person fraud attempts. But US banks are, largely, so fearful of customers switching away from them at even the slightest provocation, we don't get PINs. So I'm forced to ask what other "basic" measures (like 3D Secure for online transactions) we lack. 0 - I don't want to hear the rebuttal that "well, people should just use credit cards." There are a hundred different reasons why people don't use credit cards--don't qualify for one, have an objection to debt, past bad experience, and so on--and we cannot write off people who "only" use debit from security measures.

lsllc 6y ago

I think the bigger issue is not the terminals themselves, but the software behind it that's designed to process the payment from the track data. Contactless magstripe (MSD) is a workaround that allows for a contactless payment, but really is just sending the same (insecure) track data through the backend software. Contactless EMV is the right way, but requires more sophisticated software.

kergonath 6y ago

My experience has been that all the banks that gave me cards were diligent in verifying suspicious transactions, often erring on the side of caution and asking for confirmation. Also, they don’t tend to argue much before refunding an illegal transaction. So, from my point of view, it could certainly be improved (along the lines of what Apple Pay is doing with tokenisation: confidentiality is an issue), but there is no real reason to complain. As long as fraudulent transactions are rare enough that the banks don’t drag their feet, it’s fine.

specialist 6y ago

How can noobs like me assess how good any given POS is? Is there a rating system? Any way to inspect transactions to see the whatnots? Knowing nothing, I've been doing as much as possible using Apple Pay, because IIRC they do some kind of token exchange, vs sending my digits across the wire.