6 ms·

It's funny that I haven't heard about it before, although I live in Germany and Klarna is probably the biggest payment processor in Germany. Luckily, I haven't

It's funny that I haven't heard about it before, although I live in Germany and Klarna is probably the biggest payment processor in Germany. Luckily, I haven't used it. I never liked that one need to provide his bank login data to Klarna / Sofort to use it. How is that even legal? EDIT: I haven't heard about Klarna outage, Klarna is well known.

Xylakant 5y ago
Are you certain you haven’t used it? Some shopping sites use them as payment processor for regular CC transactions without much visibility. You have to look at the T&C to even notice.
- tut-urut-utut 5y ago
  I usually don't leave CC info on some random site, only to major and well known. If the site is unknown, it's either PayPal, "pay by invoice" or no order at all. Either PayPal or CC issuer provide at least some buyers' protection, while given your bank credentials to Klarna is normally against ToC of your bank.
  - deleted 5y ago
    [deleted]
  - jokethrowaway 5y ago
    I try not to use PayPal in the hope they will become irrelevant as a business (I know, not holding my breath), mainly because their customer service and fees are terrible. CCs are not a great mechanism and I wished we had better bank services and safer integrations to process payments, but that's what we have. I check my bank statement regularly and I know I can get money back if fraud happens. If I don't trust a website I used a prepaid with the exact amount on.
  - zibzab 5y ago
    > I usually don't leave CC info on some random site, only to major and well known. That's the whole point of klarna (who also do CC processing so might have used them unknowingly): you don't need to trust Johnny's Little Online Store handling your CC, since the payment is handled by klarna.
    - tut-urut-utut 5y ago
      The irony is, as a buyer, I trust unknown Johnny's Little Online Store as much as Klarna. Maybe even more, since I can give a Little Johnny the benefit of the doubt. But in practice it's either invoice, PayPal or CC. Even if Klarna process that payment in the background, I can still object to my CC company and let them settle it, instead of having to deal with them.
      - zibzab 5y ago
        Do you believe Johnnys has the resources to create a secure payment system and keep it secure? Also, Klarna is a major invoice and CC processor. You probably have already used them unknowingly.
randomlurking 5y ago
I agree, haven’t used it (knowingly) and regularly order from other sites if klarna is the only payment option.
julianlam 5y ago
> I never liked that one need to provide his bank login data to Klarna / Sofort to use it. How is that even legal? I am parroting other HN comments here, but the reason this is necessary is because banks do not provide a public (or private) API except between other banks. Therefore the only avenue for integration would be directly accessing the account.
- ludamad 5y ago
  I wish this wasn't normal to me, but I've been fully conditioned to expect this from QuickBooksOnline
- showsover 5y ago
  They do though. PDS2 requires all banks to have an accessible API.
  - samhw 5y ago
    This is different from banks actually _having_ an API. Many have stalled or successfully asked for exemptions, and even those who have gone ahead and, to some extent, complied, have still tried to make their APIs as difficult to use, feature-poor, and unreliable as possible. Source: worked at a bank which actually tried to do this well, and which also offered functionality which required us to integrate with other banks' APIs.
- Tainnor 5y ago
  Not really true in Germany where FinTS and its precursor HBCI have been supported by many banks since the 90s or so. Ironically, it's typically the hip start-up banks like N26 that don't support this standard.
Tainnor 5y ago
> How is that even legal? It's worse than that. Several banks tried to enforce in their terms and conditions that sharing your bank login data would be a breach of contract or at least absolve the bank of any liability. This was deemed in violation of antitrust laws for some reason, so now banks have to actively allow this which is just brain-dead IMHO. The only upside of this is that we now have PSD2 now anyway, so the damage that can be done by someone who has your login credentials is limited.
- mdaniel 5y ago
  For others wondering what PSD2 is: https://en.wikipedia.org/wiki/Payment_Services_Directive https://en.wikipedia.org/wiki/Payment_Services_Directive and there were also a lot of "what is it and how does it affect you" articles from name brand bank websites, too, but I figured start here
- samhw 5y ago
  > This was deemed in violation of antitrust laws for some reason My best guess at what that "some reason" may be is that it breaks shoddily built integrations like [Teller](https://teller.io/ https://teller.io/), which, instead of using schemes like Open Banking where available, simply rely on credential sharing.
- gmokki 5y ago
  In Finland it is illegal to give your bank login data to others, including scrapers. One couple both got sentenced when the other used the bank login data left on table to order something online. Fraud for the other and neglegence of leaving the login data easily accessible for the other.

Xylakant 5y ago

Are you certain you haven’t used it? Some shopping sites use them as payment processor for regular CC transactions without much visibility. You have to look at the T&C to even notice.

tut-urut-utut 5y ago
I usually don't leave CC info on some random site, only to major and well known. If the site is unknown, it's either PayPal, "pay by invoice" or no order at all. Either PayPal or CC issuer provide at least some buyers' protection, while given your bank credentials to Klarna is normally against ToC of your bank.
- deleted 5y ago
  [deleted]
- jokethrowaway 5y ago
  I try not to use PayPal in the hope they will become irrelevant as a business (I know, not holding my breath), mainly because their customer service and fees are terrible. CCs are not a great mechanism and I wished we had better bank services and safer integrations to process payments, but that's what we have. I check my bank statement regularly and I know I can get money back if fraud happens. If I don't trust a website I used a prepaid with the exact amount on.
- zibzab 5y ago
  > I usually don't leave CC info on some random site, only to major and well known. That's the whole point of klarna (who also do CC processing so might have used them unknowingly): you don't need to trust Johnny's Little Online Store handling your CC, since the payment is handled by klarna.
  - tut-urut-utut 5y ago
    The irony is, as a buyer, I trust unknown Johnny's Little Online Store as much as Klarna. Maybe even more, since I can give a Little Johnny the benefit of the doubt. But in practice it's either invoice, PayPal or CC. Even if Klarna process that payment in the background, I can still object to my CC company and let them settle it, instead of having to deal with them.
    - zibzab 5y ago
      Do you believe Johnnys has the resources to create a secure payment system and keep it secure? Also, Klarna is a major invoice and CC processor. You probably have already used them unknowingly.

randomlurking 5y ago

I agree, haven’t used it (knowingly) and regularly order from other sites if klarna is the only payment option.

julianlam 5y ago

> I never liked that one need to provide his bank login data to Klarna / Sofort to use it. How is that even legal? I am parroting other HN comments here, but the reason this is necessary is because banks do not provide a public (or private) API except between other banks. Therefore the only avenue for integration would be directly accessing the account.

ludamad 5y ago
I wish this wasn't normal to me, but I've been fully conditioned to expect this from QuickBooksOnline
showsover 5y ago
They do though. PDS2 requires all banks to have an accessible API.
- samhw 5y ago
  This is different from banks actually _having_ an API. Many have stalled or successfully asked for exemptions, and even those who have gone ahead and, to some extent, complied, have still tried to make their APIs as difficult to use, feature-poor, and unreliable as possible. Source: worked at a bank which actually tried to do this well, and which also offered functionality which required us to integrate with other banks' APIs.
Tainnor 5y ago
Not really true in Germany where FinTS and its precursor HBCI have been supported by many banks since the 90s or so. Ironically, it's typically the hip start-up banks like N26 that don't support this standard.

Tainnor 5y ago

> How is that even legal? It's worse than that. Several banks tried to enforce in their terms and conditions that sharing your bank login data would be a breach of contract or at least absolve the bank of any liability. This was deemed in violation of antitrust laws for some reason, so now banks have to actively allow this which is just brain-dead IMHO. The only upside of this is that we now have PSD2 now anyway, so the damage that can be done by someone who has your login credentials is limited.

mdaniel 5y ago
For others wondering what PSD2 is: https://en.wikipedia.org/wiki/Payment_Services_Directive https://en.wikipedia.org/wiki/Payment_Services_Directive and there were also a lot of "what is it and how does it affect you" articles from name brand bank websites, too, but I figured start here
samhw 5y ago
> This was deemed in violation of antitrust laws for some reason My best guess at what that "some reason" may be is that it breaks shoddily built integrations like [Teller](https://teller.io/ https://teller.io/), which, instead of using schemes like Open Banking where available, simply rely on credential sharing.
gmokki 5y ago
In Finland it is illegal to give your bank login data to others, including scrapers. One couple both got sentenced when the other used the bank login data left on table to order something online. Fraud for the other and neglegence of leaving the login data easily accessible for the other.