4 ms·

Credit card numbers can be easily generated, there are tons of generators online. The right solution is not to have a number that you give out to random people

by sydd 6y ago

Credit card numbers can be easily generated, there are tons of generators online. The right solution is not to have a number that you give out to random people who then gain access to your money. Also the righ way is not to trust the few giant credit card corporations to move all the money in the world The right way (EU is introducing it) is that you get a payment request that you can paste into your bank app and there authorize it. See SEPA or PSD2

ericd 6y ago
That doesn't sound like a great design from a UX/speed perspective. Is it better than it sounds?
- jacobr1 6y ago
  That isn't specific EU regulations. SEPA is both the way payments are cleared and EU rules so works cross boarder. It is the foundation (interbank infra) upon which PSD2 layers a requirement for what amounts to having APIs, and a requirement to make the API open-access, in the sense they can't privilege their own systems over these APIs. They solved (or at least it seems like they might) one of the bigger blockers of building fintech solutions: a level playing ground.
sgjohnson 6y ago
I can't stand it. Amex have implemented Express List to deal with this, and you can automatically add any new sites that you use your card in to the list. It doesn't even automatically trigger 2FA.
lmm 6y ago
It's pretty easy to make a secure payment method for one-off payments or fixed-price regular payments. A lot of the value of credit cards is that you can use them to pay for things that do usage-based billing, without having to do anything after the initial setup.
- kwhitefoot 6y ago
  That's what direct debits (Avtalegiro in Norwegian) are for. Works fine here. I only use my credit cards for buying things in shops or one off things online. And my credit card gets paid by direct debit.
  - gsliepen 6y ago
    Indeed, and in the Netherlands there is something similar to Avtalegiro as well, since more than 20 years ago. And depending on your bank, they even make it easy to reverse a charge up to three months after it has been made if you don't agree with it.
  - lmm 6y ago
    Direct debits have all of the dangers of credit cards and then some - you have to give out a numeric identifier, and unlike a credit card that number allows pulling directly from your bank account.
    - kwhitefoot 6y ago
      How so? Avtalegiro is offered by the creditor via my bank. I click a box to allow it and I can also specify a maximum that they are allowed to take. Every time the creditor requests a payment I am notified before it is paid. I can cancel it or in some cases, such as a credit card monthly payment, alter it.
    - AnssiH 6y ago
      "Direct debit" can mean multiple different systems. In this case the Norwegian system the parent talked about sounds similar to the Finnish Finvoice system that can be used to (auto-)pay practically all bills in Finland - the system is known to users as "e-invoicing" (e-lasku) or, if used offline, as "direct payment" (suoramaksu). The customer manually creates the billing agreement with a specific invoicer at the customer's online bank, and can set payment limits, notifications, and either automatic or manual approvals. These are distinct from the "SEPA direct debit", which is not used in Finland domestically. Due to their rarity I think "SEPA direct debit" payments are usually/often disabled or each payment requires a specific customer authorization via their online bank (so IBAN of such an account cannot be used to get money out of the account).

by sydd 6y ago

ericd 6y ago

That doesn't sound like a great design from a UX/speed perspective. Is it better than it sounds?

jacobr1 6y ago
That isn't specific EU regulations. SEPA is both the way payments are cleared and EU rules so works cross boarder. It is the foundation (interbank infra) upon which PSD2 layers a requirement for what amounts to having APIs, and a requirement to make the API open-access, in the sense they can't privilege their own systems over these APIs. They solved (or at least it seems like they might) one of the bigger blockers of building fintech solutions: a level playing ground.

sgjohnson 6y ago

I can't stand it. Amex have implemented Express List to deal with this, and you can automatically add any new sites that you use your card in to the list. It doesn't even automatically trigger 2FA.

lmm 6y ago

It's pretty easy to make a secure payment method for one-off payments or fixed-price regular payments. A lot of the value of credit cards is that you can use them to pay for things that do usage-based billing, without having to do anything after the initial setup.

kwhitefoot 6y ago
That's what direct debits (Avtalegiro in Norwegian) are for. Works fine here. I only use my credit cards for buying things in shops or one off things online. And my credit card gets paid by direct debit.
- gsliepen 6y ago
  Indeed, and in the Netherlands there is something similar to Avtalegiro as well, since more than 20 years ago. And depending on your bank, they even make it easy to reverse a charge up to three months after it has been made if you don't agree with it.
- lmm 6y ago
  Direct debits have all of the dangers of credit cards and then some - you have to give out a numeric identifier, and unlike a credit card that number allows pulling directly from your bank account.
  - kwhitefoot 6y ago
    How so? Avtalegiro is offered by the creditor via my bank. I click a box to allow it and I can also specify a maximum that they are allowed to take. Every time the creditor requests a payment I am notified before it is paid. I can cancel it or in some cases, such as a credit card monthly payment, alter it.
  - AnssiH 6y ago
    "Direct debit" can mean multiple different systems. In this case the Norwegian system the parent talked about sounds similar to the Finnish Finvoice system that can be used to (auto-)pay practically all bills in Finland - the system is known to users as "e-invoicing" (e-lasku) or, if used offline, as "direct payment" (suoramaksu). The customer manually creates the billing agreement with a specific invoicer at the customer's online bank, and can set payment limits, notifications, and either automatic or manual approvals. These are distinct from the "SEPA direct debit", which is not used in Finland domestically. Due to their rarity I think "SEPA direct debit" payments are usually/often disabled or each payment requires a specific customer authorization via their online bank (so IBAN of such an account cannot be used to get money out of the account).