3 ms·
In the situation you describe, the one who is "out" is the merchant. In the card-not-present situation, the merchant has the option to use tools like CVV and ad
by NovemberWhiskey 5y ago
In the situation you describe, the one who is "out" is the merchant. In the card-not-present situation, the merchant has the option to use tools like CVV and address validation to reduce the risk in the transaction, and always has the option to decline a transaction that seems risky.
That seems, to me, like a sensible risk balancing approach. In the cryptocurrency "all sales are final" world - you're the loser. I don't really see that the economic drag is larger one way or the other.
AFAIK the use of symmetric key cryptography in card capture and payment processing is not in any way a significant factor in payment card fraud - where do you get that information from?
- __MatrixMan__ 5y agoWhether it's the merchant or the bank that's left holding the bag often depends on the particulars like whether it was a chip or a magstripe transaction, but the larger point is that in card-not-present scenarios you can't pay once without also exposing secrets that allow whoever gets them to make subsequent transactions without your permission. Better would be to have whatever secret authorizes spend (private key) be separate from the account identifier (public key) and to push money, rather than sharing a symmetric secret which authorizes whoever has it to pull money.