5 ms·

Lots of websites in India also offer payment via bank account, including amazon.in. The benefit from my POV was the same as you describe. I don't want random we

by charsi 5y ago

Lots of websites in India also offer payment via bank account, including amazon.in. The benefit from my POV was the same as you describe. I don't want random websites to have my credit card info and I don't want to deal with paypal. Paying by bank account doesn't mean handing over bank account info. But the merchant just redirects to your bank as part of the payment flow. The bank knows how much money the merchant wants and you authorize it for that one transaction. Bank redirects back to the merchant who confirms the payment was successful. They can't make any further charges at a later date.

logifail 5y ago
> Paying by bank account doesn't mean handing over bank account info Tell that to the people behind the "Sofortüberweisung" [ roughly: "Immediate bank transfer"] scheme - run by Sofort GmbH, now part of Klarna. I've seen this offered several times but never (dared to) try it personally, but by all accounts* it works something like this: At the merchant's checkout page you are offered choice of payment methods, Sofortüberweisung is on the list, you select it, then you end up on a third-party site(!) where you provide the login details to your bank account(!!) including PIN and/or one-time TAN(!!!). The third party site checks your balance, then executes a transfer to the merchant for the total of your cart, then confirms the transaction to the merchant. When I first read about how this works, I assumed I'd understood it wrong. From a security PoV, doesn't this make one's skin crawl? * sorry, pun intended ;)
- charsi 5y ago
  Yep this flow is ripe for phishing. But I prefer it over just giving a card number that a merchant has the ability to store and eventually leak. With bank payments I just have to be careful to check I am actually at the bank website when entering the login info. Makes me feel more in control. I guess people in the west were already used to giving out their card info over the phone to make purchases so wasn't a big deal when online sites started doing it. In India credit cards were still not wide spread (still aren't) in the early 2000s.
  - logifail 5y ago
    > I prefer it over just giving a card number that a merchant has the ability to store and eventually leak Even if you know that your card provider will refund you if the card leaks? In the last decade I've twice had a credit card cloned, and twice I've been pleasantly surprised how quickly the card provider a) detected the issue, b) blocked the old card and re-issued a new card, and c) refunded the fraudent transactions. Based on that, I'd trust my credit card provider far more than my bank(s).
    - Cu3PO42 5y ago
      Which cards are you using? AMEX? For the most commonly accepted schemes in Europe, i.e., Visa and MasterCard, requesting a chargeback typically goes through your card issuer which almost always is your bank.
      - logifail 5y ago
        > requesting a chargeback Don't chargebanks typically involve a dispute between buyer and merchant? In neither of the instances where I personally experienced card fraud was the typical chargeback process involked, both times I had to confirm which recent transasctions were and weren't "mine", and after that the card provider did all the running. The second time I had many thousands of euros of fraudulent transactions refunded onto my account within 48h of the fraud being detected by the card issuer. > your card issuer which almost always is your bank Sorry, I wasn't very clear. I trust how credit-card-issuing-banks (in my case it was Barclaycard ie Barclays PLC) treat their card customers more than I trust current/checking/giro account banks treat _their_ customers. It makes a lot of sense when you think about the underlying incentives to treat customers well. Changing your current/checking/giro account can take quite a lot of work and has the potential to cause problems for a long time. Applying for a new credit card takes a few minutes and the entire process is complete in a few days.
- BrandoElFollito 5y ago
  Well, to be frank when you provide someone your credentials you oprn yourself to a new world of pain. But this is also the case when you allow your bank to aggregate info from other banks. At least you can hope that they protect it somehow (because of bank regulations, but this is a very thin hope)
Cu3PO42 5y ago
> Paying by bank account doesn't mean handing over bank account info. It's nice that it works that way for you, but it does in Germany. You don't need to hand over your login information or anything, but wiring money in any form means that they have your account number. The account number is sufficient to debit the account at a later point. Obviously they're not allowed to do that without your explicit consent, but a malicious actor could.
- BrandoElFollito 5y ago
  If you mean that some organization (not an individual) could Direct Debit you, then you have to hive your bank an explicit agreement for that. If you do not, you reject the payment and it is now the bank problem. An IBAN is never a secret.
  - Cu3PO42 5y ago
    Yes, you can have the charge reversed, but they can still make the charge initially. In that sense it is no different from a credit card: if they have your info, they can charge you again and you can have the charge reversed.
    - BrandoElFollito 5y ago
      Direct Debit requires a special license - this is not something any company can dio. Making a fraudulent charge will have this license revoked. The authorization from the person being debited is required but in practical terms it does not always happen. People request DD and then forget to make the paperwork (today this is better because more and more DD agreements is arranged electronically). The bank will the allow the DD without the paperwork to make it easier for everyone (and ask the case to be fixed). In any case this i stheir risk but in the vast majority of cases it works.
      - Cu3PO42 5y ago
        > Making a fraudulent charge will have this license revoked. Absolutely, but the same is true for credit card charges as well. Your acquirer will terminate your contract if you make fraudulent charges against credit/debit cards. I am not arguing that you shouldn't wire money or use direct debit. I am just pointing out that it carries much of the same risks to the consumer as using a credit or debit card. (Which is virtually none since you can have charges revoked.) This observation is, in my opinion, relevant since many people in Germany seem to think that one is much safer than the other.

by charsi 5y ago

logifail 5y ago

> Paying by bank account doesn't mean handing over bank account info Tell that to the people behind the "Sofortüberweisung" [ roughly: "Immediate bank transfer"] scheme - run by Sofort GmbH, now part of Klarna. I've seen this offered several times but never (dared to) try it personally, but by all accounts* it works something like this: At the merchant's checkout page you are offered choice of payment methods, Sofortüberweisung is on the list, you select it, then you end up on a third-party site(!) where you provide the login details to your bank account(!!) including PIN and/or one-time TAN(!!!). The third party site checks your balance, then executes a transfer to the merchant for the total of your cart, then confirms the transaction to the merchant. When I first read about how this works, I assumed I'd understood it wrong. From a security PoV, doesn't this make one's skin crawl? * sorry, pun intended ;)

charsi 5y ago
Yep this flow is ripe for phishing. But I prefer it over just giving a card number that a merchant has the ability to store and eventually leak. With bank payments I just have to be careful to check I am actually at the bank website when entering the login info. Makes me feel more in control. I guess people in the west were already used to giving out their card info over the phone to make purchases so wasn't a big deal when online sites started doing it. In India credit cards were still not wide spread (still aren't) in the early 2000s.
- logifail 5y ago
  > I prefer it over just giving a card number that a merchant has the ability to store and eventually leak Even if you know that your card provider will refund you if the card leaks? In the last decade I've twice had a credit card cloned, and twice I've been pleasantly surprised how quickly the card provider a) detected the issue, b) blocked the old card and re-issued a new card, and c) refunded the fraudent transactions. Based on that, I'd trust my credit card provider far more than my bank(s).
  - Cu3PO42 5y ago
    Which cards are you using? AMEX? For the most commonly accepted schemes in Europe, i.e., Visa and MasterCard, requesting a chargeback typically goes through your card issuer which almost always is your bank.
    - logifail 5y ago
      > requesting a chargeback Don't chargebanks typically involve a dispute between buyer and merchant? In neither of the instances where I personally experienced card fraud was the typical chargeback process involked, both times I had to confirm which recent transasctions were and weren't "mine", and after that the card provider did all the running. The second time I had many thousands of euros of fraudulent transactions refunded onto my account within 48h of the fraud being detected by the card issuer. > your card issuer which almost always is your bank Sorry, I wasn't very clear. I trust how credit-card-issuing-banks (in my case it was Barclaycard ie Barclays PLC) treat their card customers more than I trust current/checking/giro account banks treat _their_ customers. It makes a lot of sense when you think about the underlying incentives to treat customers well. Changing your current/checking/giro account can take quite a lot of work and has the potential to cause problems for a long time. Applying for a new credit card takes a few minutes and the entire process is complete in a few days.
BrandoElFollito 5y ago
Well, to be frank when you provide someone your credentials you oprn yourself to a new world of pain. But this is also the case when you allow your bank to aggregate info from other banks. At least you can hope that they protect it somehow (because of bank regulations, but this is a very thin hope)

Cu3PO42 5y ago

> Paying by bank account doesn't mean handing over bank account info. It's nice that it works that way for you, but it does in Germany. You don't need to hand over your login information or anything, but wiring money in any form means that they have your account number. The account number is sufficient to debit the account at a later point. Obviously they're not allowed to do that without your explicit consent, but a malicious actor could.

BrandoElFollito 5y ago
If you mean that some organization (not an individual) could Direct Debit you, then you have to hive your bank an explicit agreement for that. If you do not, you reject the payment and it is now the bank problem. An IBAN is never a secret.
- Cu3PO42 5y ago
  Yes, you can have the charge reversed, but they can still make the charge initially. In that sense it is no different from a credit card: if they have your info, they can charge you again and you can have the charge reversed.
  - BrandoElFollito 5y ago
    Direct Debit requires a special license - this is not something any company can dio. Making a fraudulent charge will have this license revoked. The authorization from the person being debited is required but in practical terms it does not always happen. People request DD and then forget to make the paperwork (today this is better because more and more DD agreements is arranged electronically). The bank will the allow the DD without the paperwork to make it easier for everyone (and ask the case to be fixed). In any case this i stheir risk but in the vast majority of cases it works.
    - Cu3PO42 5y ago
      > Making a fraudulent charge will have this license revoked. Absolutely, but the same is true for credit card charges as well. Your acquirer will terminate your contract if you make fraudulent charges against credit/debit cards. I am not arguing that you shouldn't wire money or use direct debit. I am just pointing out that it carries much of the same risks to the consumer as using a credit or debit card. (Which is virtually none since you can have charges revoked.) This observation is, in my opinion, relevant since many people in Germany seem to think that one is much safer than the other.