5 ms·
Even without the vulnerability in the OP, card testing is a real problem, and will remain a real problem for anyone relying on credit card payments without some
by hibikir 4y ago
Even without the vulnerability in the OP, card testing is a real problem, and will remain a real problem for anyone relying on credit card payments without some form of one time passcode verification: It's just way too profitable, but banks in the US don't seem to want to add the necessary friction.
A secondary problem is that ultimately those taking payments end up having to either track you, or side with someone that does, as a way to try to detect suspicious activity. Whether it's Stripe directly, or Google via reCaptcha, someone is going to have to be peering into the metadata of your transaction to try to figure out if it's really you that is calling, or it's a fraudster. And when the store gives that traffic to Google, they aren't just going to use it to make sure you are who you say you are.
It's really unfortunate that the card issuers are the ones that can fix the problem, while in practice, it's companies further down the line that are paying for this in fraud and fraud detection spend.
- abigail95 4y agoDoes the US not have Mastercard SecureCode, or Visa equivalent? Every time I make a big purchase locally to a local merchant I have to use an OTP from my bank. American companies never want to do it. Apple wanted me to send them bank statements to verify I was the card owner. I asked their fraud team to just use SecureCode and they had no idea what I was talking about.
- alberth 4y agoIt’s available in the US but it’s a merchants choice to use it (unlike in Europe with PSD2).
- jhugo 4y agoWhy do merchants not use it in the US? It's pretty much universal in Europe and many countries in Asia in my experience, and it would probably almost eliminate this type of fraud. Most of my banks give me an in-app notification in the mobile banking app that I have to accept, but some still use an SMS OTP.
- deleted 4y ago[deleted]
- bombcar 4y agoBecause most American customers have no idea what the hell it is or how to do it, and when it appears would wander off and find some thing else to purchase elsewhere.
- sbierwagen 4y agoIf your fraud rate is 2% and turning on OTP adds 4% to your bounce rate then turning on OTP is net negative. Classic collective action problem. I'd guess the feds will mandate it at some point in the future, like how it took a decade for EMV to be mandatory in the US.
- willnonya 4y agoI think you've identified why in your response. If you're buying something from a website then it's not an issue. If you're buying something in person relying on an app or other otp will result in fewer people wanting to bother with it or more false negatives both of which reduce transactions (and fees) by more than the cost of the fraud on the card issuer.
- SyneRyder 4y agoSecureCode / Verified By Visa / 3DSecure can cause huge crashes in conversion rates. This is old data, but at one point it was a 10-12% drop in sales: https://www.practicalecommerce.com/Are-Verified-by-Visa-and-MasterCard-SecureCode-Conversion-Killers https://www.practicalecommerce.com/Are-Verified-by-Visa-and-... Visa / MC require you to keep your fraud rates under 1-2% anyway, so 12% is an enormous hit to only slightly improve your fraud rates.
- neodypsis 4y ago> Whether it's Stripe directly, or Google via reCaptcha, someone is going to have to be peering into the metadata of your transaction to try to figure out if it's really you that is calling, or it's a fraudster. And when the store gives that traffic to Google, they aren't just going to use it to make sure you are who you say you are. Unfortunately, that's an issue with services like Sift if you need to comply with laws like GDPR. Anybody nows if there's a GDPR-compliant alternative?
- LelouBil 4y agoIn France everyone I know has to confirm by SMS or by otp from the bank app everytime a credit card is used online.