3 ms·

> Paying by bank account doesn't mean handing over bank account info Tell that to the people behind the "Sofortüberweisung" [ roughly: "Immediate bank transfer

> Paying by bank account doesn't mean handing over bank account info Tell that to the people behind the "Sofortüberweisung" [ roughly: "Immediate bank transfer"] scheme - run by Sofort GmbH, now part of Klarna. I've seen this offered several times but never (dared to) try it personally, but by all accounts* it works something like this: At the merchant's checkout page you are offered choice of payment methods, Sofortüberweisung is on the list, you select it, then you end up on a third-party site(!) where you provide the login details to your bank account(!!) including PIN and/or one-time TAN(!!!). The third party site checks your balance, then executes a transfer to the merchant for the total of your cart, then confirms the transaction to the merchant. When I first read about how this works, I assumed I'd understood it wrong. From a security PoV, doesn't this make one's skin crawl? * sorry, pun intended ;)

charsi 5y ago
Yep this flow is ripe for phishing. But I prefer it over just giving a card number that a merchant has the ability to store and eventually leak. With bank payments I just have to be careful to check I am actually at the bank website when entering the login info. Makes me feel more in control. I guess people in the west were already used to giving out their card info over the phone to make purchases so wasn't a big deal when online sites started doing it. In India credit cards were still not wide spread (still aren't) in the early 2000s.
- logifail 5y ago
  > I prefer it over just giving a card number that a merchant has the ability to store and eventually leak Even if you know that your card provider will refund you if the card leaks? In the last decade I've twice had a credit card cloned, and twice I've been pleasantly surprised how quickly the card provider a) detected the issue, b) blocked the old card and re-issued a new card, and c) refunded the fraudent transactions. Based on that, I'd trust my credit card provider far more than my bank(s).
  - Cu3PO42 5y ago
    Which cards are you using? AMEX? For the most commonly accepted schemes in Europe, i.e., Visa and MasterCard, requesting a chargeback typically goes through your card issuer which almost always is your bank.
    - logifail 5y ago
      > requesting a chargeback Don't chargebanks typically involve a dispute between buyer and merchant? In neither of the instances where I personally experienced card fraud was the typical chargeback process involked, both times I had to confirm which recent transasctions were and weren't "mine", and after that the card provider did all the running. The second time I had many thousands of euros of fraudulent transactions refunded onto my account within 48h of the fraud being detected by the card issuer. > your card issuer which almost always is your bank Sorry, I wasn't very clear. I trust how credit-card-issuing-banks (in my case it was Barclaycard ie Barclays PLC) treat their card customers more than I trust current/checking/giro account banks treat _their_ customers. It makes a lot of sense when you think about the underlying incentives to treat customers well. Changing your current/checking/giro account can take quite a lot of work and has the potential to cause problems for a long time. Applying for a new credit card takes a few minutes and the entire process is complete in a few days.
BrandoElFollito 5y ago
Well, to be frank when you provide someone your credentials you oprn yourself to a new world of pain. But this is also the case when you allow your bank to aggregate info from other banks. At least you can hope that they protect it somehow (because of bank regulations, but this is a very thin hope)

charsi 5y ago

Yep this flow is ripe for phishing. But I prefer it over just giving a card number that a merchant has the ability to store and eventually leak. With bank payments I just have to be careful to check I am actually at the bank website when entering the login info. Makes me feel more in control. I guess people in the west were already used to giving out their card info over the phone to make purchases so wasn't a big deal when online sites started doing it. In India credit cards were still not wide spread (still aren't) in the early 2000s.

logifail 5y ago
> I prefer it over just giving a card number that a merchant has the ability to store and eventually leak Even if you know that your card provider will refund you if the card leaks? In the last decade I've twice had a credit card cloned, and twice I've been pleasantly surprised how quickly the card provider a) detected the issue, b) blocked the old card and re-issued a new card, and c) refunded the fraudent transactions. Based on that, I'd trust my credit card provider far more than my bank(s).
- Cu3PO42 5y ago
  Which cards are you using? AMEX? For the most commonly accepted schemes in Europe, i.e., Visa and MasterCard, requesting a chargeback typically goes through your card issuer which almost always is your bank.
  - logifail 5y ago
    > requesting a chargeback Don't chargebanks typically involve a dispute between buyer and merchant? In neither of the instances where I personally experienced card fraud was the typical chargeback process involked, both times I had to confirm which recent transasctions were and weren't "mine", and after that the card provider did all the running. The second time I had many thousands of euros of fraudulent transactions refunded onto my account within 48h of the fraud being detected by the card issuer. > your card issuer which almost always is your bank Sorry, I wasn't very clear. I trust how credit-card-issuing-banks (in my case it was Barclaycard ie Barclays PLC) treat their card customers more than I trust current/checking/giro account banks treat _their_ customers. It makes a lot of sense when you think about the underlying incentives to treat customers well. Changing your current/checking/giro account can take quite a lot of work and has the potential to cause problems for a long time. Applying for a new credit card takes a few minutes and the entire process is complete in a few days.

BrandoElFollito 5y ago

Well, to be frank when you provide someone your credentials you oprn yourself to a new world of pain. But this is also the case when you allow your bank to aggregate info from other banks. At least you can hope that they protect it somehow (because of bank regulations, but this is a very thin hope)