5 ms·

I moved back to Finland after years in the USA, and found out that credit cards from Finnish banks now require a 2FA system for online payments. It works fine.

by pavlov 4y ago

I moved back to Finland after years in the USA, and found out that credit cards from Finnish banks now require a 2FA system for online payments. It works fine. The online purchase enters a short flow with my bank, they send a request to the bank’s app on my phone, I approve it there and the purchase flow returns to the vendor’s site. Everything about banking in the USA was seemingly decades behind my experiences in Northern Europe, so it may take a while for American banks to figure out credit card 2FA… (They still regularly use paper checks in America. Bank transfers don’t exist. Many operations require a visit to a bank branch, of which there are absurdly many. I’m surprised they didn’t have mechanical calculators.)

DanAtC 4y ago
> they send a request to the bank’s app on my phone I'm glad US banks don't require me to install proprietary apps on my phone.
- MagnumOpus 4y ago
  You might be unsurprised to know that alternatives exist. Generally SMS/email auth or hardware token auth. (Less secure and more unwieldy respectively, but there are still surprisingly many dumbphone users with a lot of money.)
- aPoCoMiLogin 4y ago
  it doesn't have to be an app, it can be SMS
ezfe 4y ago
I've gotten the same thing from Capital One
eythian 4y ago
This also applies in the Netherlands, I approve them through the app.
- hocuspocus 4y ago
  It's part of the mandatory security requirements coming with the EU directive regarding PSD 2.
- JohnFen 4y ago
  What do people without smartphones or cell phones do?
  - aPoCoMiLogin 4y ago
    I believe all banks implemented SMS and an APP, and some banks also have hardware OTP tokens
  - alibarber 4y ago
    Amex offer to email me with a OTP. I guess those without email probably don’t have much to worry about given that they’re unlikely to be doing much online shopping.
  - hocuspocus 4y ago
    SMS tokens are on their way out as they don't satisfy the security requirements. In this case you need to log in to your bank website and accept the transaction.
  - hpaavola 4y ago
    Many banks offer simple device for 2FA. It'a good idea to have it as a backup anyway for those situations when you cant access you phone for any reason. https://www.nordea.fi/en/personal/our-services/online-mobile-services/code-calculator.html https://www.nordea.fi/en/personal/our-services/online-mobile...
t3rabytes 4y ago
I get this occasionally with purchases via my US American Express card, but it requires merchant participation: https://www.americanexpress.com/us/security-center/safekey/ https://www.americanexpress.com/us/security-center/safekey/
e12e 4y ago
Similar system in Norway - where there's common 2fa Id system where banks are identity provider, and mechanism for 2fa is app, sim app (deprecated) or otp token: https://www.bankid.no/en/company/ https://www.bankid.no/en/company/ It's also used as a general digital ID provider.
davchana 4y ago
The Indian Banks also require the same. The central bank forced them to adopt this. Any txn over certain amount (I think Rs 500, $5) needs a one time code, sent to user's phone, valid for like 10 minutes. Merchants always get a token of validation from bank, not the actual credit card number.
- YetAnotherNick 4y ago
  Any domestic transaction requires OTP. Any international transaction by default requires OTP.
  - davchana 4y ago
    Any transactions using Indian Banks need OTP over certain amount, indian website or not. Any transactions using non-indian banks or cards go through without asking any OTP.
humanistbot 4y ago
I agree with your sentiment, but we don't "regularly" use paper checks in the US. Many stores simply do not accept them anymore, and I can remember just a few times in the past few years where someone in front of me at a checkout was using a paper check --- because it happens so rarely that it is memorable. Edit: And bank transfers do exist, I don't know how you can get away with just flat out asserting they don't. That's ridiculous. Wire transfers are very old but still supported for a fee, and ACH transfers are ubiquitous. They aren't as quick and easy as in Europe, but they certainly do exist. Zelle is also a pretty recent cross-bank platform for transfers that has made things much easier.
- pavlov 4y ago
  How do I make an ACH transfer to a third person (i.e. not my own account in another bank)? Can I send you money using ACH with an account number you provide? If it's possible, this functionality must be extremely well hidden. Wire transfers aren't the same as European-style bank transfers because they're slow, expensive and seem to have weird manual validation steps. Zelle is a proprietary kludge that has very low transfer limits, and most people don't seem to know it exists. I certainly wasn't able to pay my Manhattan rent using Zelle, so it's not a replacement for bank transfers either.
- Symbiote 4y ago
  How would you pay a plumber who came at short notice to unblock a drain? Or, say, the fees paid for your child's karate class? Or a 'cash' gift for a teenage nephew? Those are/were cases where cheques were used in Britain, but the first and second are now often a portable chip debit/credit card reader, or else an electronic transfer. The third could still be a cheque, or could be an electronic bank transfer. (No-one has paid by cheque in a shop since about 2011, when the system to protect against fraud in this case was removed.)
  - humanistbot 4y ago
    > How would you pay a plumber who came at short notice to unblock a drain? > Or, say, the fees paid for your child's karate class? I forgot a third development, which is thanks to Stripe and other mobile-friendly payment processors. All you need is a smartphone, and they send you a mini card reader that plugs into your phone. I see them all the time at farmers markets and even paid for a tow truck using one once. > Or a 'cash' gift for a teenage nephew? Kids these days use Venmo or rarely paypal. I don't like them and my family uses Zelle to send money to each other from our different banks. Same when we do collections at work for an employee's retirement gift, the organizer just sent their mobile and asked everyone to send money through Zelle. People even pay their landlords with Zelle now.
blueblisters 4y ago
> Everything about banking in the USA was seemingly decades behind my experiences in Northern Europe, so it may take a while for American banks to figure out credit card 2FA… Having worked closely with multiple banks' credit card departments, this assertion is incorrect. American banks (and merchants) choose to not implement more security for card-not-present transactions because it meaningfully dents conversion rates for online commerce. Same goes for credit card PINs which are extremely common in Europe but rarely seen in the US. Most merchants and banks are okay with a non-zero level of fraud because stricter fraud prevention methods negatively impact user experience. Here's an article going into more depth about the tradeoffs involved: https://bam.kalzumeus.com/archive/optimal-amount-of-fraud/ https://bam.kalzumeus.com/archive/optimal-amount-of-fraud/
- Youden 4y ago
  You claim that the assertion is false but you've only looked at one aspect for why the parent might think the US banking system is behind. To put another one out there, there's no universal and practical way to electronically transfer money from one person to another. The only options are cash, checks, wire transfers and ACH. Wire transfers are expensive and ACH is difficult to use. In the SEPA area you can transfer money to anybody else within about a day for the cost of a local transfer (usually free) with nothing but an IBAN (which can be freely-given, unlike a US bank account number). Plus, the US has been behind for a long time for card-present transactions as well. Only in the past few years have chips started to see widespread use.
  - sidpatil 4y ago
    > To put another one out there, there's no universal and practical way to electronically transfer money from one person to another. The only options are cash, checks, wire transfers and ACH. Wire transfers are expensive and ACH is difficult to use. The FedNow system, scheduled to roll out next year, is designed to fulfill this purpose. https://www.federalreserve.gov/paymentsystems/fednow_about.htm https://www.federalreserve.gov/paymentsystems/fednow_about.h...
    - 4y ago

by pavlov 4y ago

DanAtC 4y ago

> they send a request to the bank’s app on my phone I'm glad US banks don't require me to install proprietary apps on my phone.

MagnumOpus 4y ago
You might be unsurprised to know that alternatives exist. Generally SMS/email auth or hardware token auth. (Less secure and more unwieldy respectively, but there are still surprisingly many dumbphone users with a lot of money.)
aPoCoMiLogin 4y ago
it doesn't have to be an app, it can be SMS

ezfe 4y ago

I've gotten the same thing from Capital One

eythian 4y ago

This also applies in the Netherlands, I approve them through the app.

hocuspocus 4y ago
It's part of the mandatory security requirements coming with the EU directive regarding PSD 2.
JohnFen 4y ago
What do people without smartphones or cell phones do?
- aPoCoMiLogin 4y ago
  I believe all banks implemented SMS and an APP, and some banks also have hardware OTP tokens
- alibarber 4y ago
  Amex offer to email me with a OTP. I guess those without email probably don’t have much to worry about given that they’re unlikely to be doing much online shopping.
- hocuspocus 4y ago
  SMS tokens are on their way out as they don't satisfy the security requirements. In this case you need to log in to your bank website and accept the transaction.
- hpaavola 4y ago
  Many banks offer simple device for 2FA. It'a good idea to have it as a backup anyway for those situations when you cant access you phone for any reason. https://www.nordea.fi/en/personal/our-services/online-mobile-services/code-calculator.html https://www.nordea.fi/en/personal/our-services/online-mobile...

t3rabytes 4y ago

I get this occasionally with purchases via my US American Express card, but it requires merchant participation: https://www.americanexpress.com/us/security-center/safekey/ https://www.americanexpress.com/us/security-center/safekey/

e12e 4y ago

Similar system in Norway - where there's common 2fa Id system where banks are identity provider, and mechanism for 2fa is app, sim app (deprecated) or otp token: https://www.bankid.no/en/company/ https://www.bankid.no/en/company/ It's also used as a general digital ID provider.

davchana 4y ago

The Indian Banks also require the same. The central bank forced them to adopt this. Any txn over certain amount (I think Rs 500, $5) needs a one time code, sent to user's phone, valid for like 10 minutes. Merchants always get a token of validation from bank, not the actual credit card number.

YetAnotherNick 4y ago
Any domestic transaction requires OTP. Any international transaction by default requires OTP.
- davchana 4y ago
  Any transactions using Indian Banks need OTP over certain amount, indian website or not. Any transactions using non-indian banks or cards go through without asking any OTP.

humanistbot 4y ago

I agree with your sentiment, but we don't "regularly" use paper checks in the US. Many stores simply do not accept them anymore, and I can remember just a few times in the past few years where someone in front of me at a checkout was using a paper check --- because it happens so rarely that it is memorable. Edit: And bank transfers do exist, I don't know how you can get away with just flat out asserting they don't. That's ridiculous. Wire transfers are very old but still supported for a fee, and ACH transfers are ubiquitous. They aren't as quick and easy as in Europe, but they certainly do exist. Zelle is also a pretty recent cross-bank platform for transfers that has made things much easier.

pavlov 4y ago
How do I make an ACH transfer to a third person (i.e. not my own account in another bank)? Can I send you money using ACH with an account number you provide? If it's possible, this functionality must be extremely well hidden. Wire transfers aren't the same as European-style bank transfers because they're slow, expensive and seem to have weird manual validation steps. Zelle is a proprietary kludge that has very low transfer limits, and most people don't seem to know it exists. I certainly wasn't able to pay my Manhattan rent using Zelle, so it's not a replacement for bank transfers either.
Symbiote 4y ago
How would you pay a plumber who came at short notice to unblock a drain? Or, say, the fees paid for your child's karate class? Or a 'cash' gift for a teenage nephew? Those are/were cases where cheques were used in Britain, but the first and second are now often a portable chip debit/credit card reader, or else an electronic transfer. The third could still be a cheque, or could be an electronic bank transfer. (No-one has paid by cheque in a shop since about 2011, when the system to protect against fraud in this case was removed.)
- humanistbot 4y ago
  > How would you pay a plumber who came at short notice to unblock a drain? > Or, say, the fees paid for your child's karate class? I forgot a third development, which is thanks to Stripe and other mobile-friendly payment processors. All you need is a smartphone, and they send you a mini card reader that plugs into your phone. I see them all the time at farmers markets and even paid for a tow truck using one once. > Or a 'cash' gift for a teenage nephew? Kids these days use Venmo or rarely paypal. I don't like them and my family uses Zelle to send money to each other from our different banks. Same when we do collections at work for an employee's retirement gift, the organizer just sent their mobile and asked everyone to send money through Zelle. People even pay their landlords with Zelle now.

blueblisters 4y ago

> Everything about banking in the USA was seemingly decades behind my experiences in Northern Europe, so it may take a while for American banks to figure out credit card 2FA… Having worked closely with multiple banks' credit card departments, this assertion is incorrect. American banks (and merchants) choose to not implement more security for card-not-present transactions because it meaningfully dents conversion rates for online commerce. Same goes for credit card PINs which are extremely common in Europe but rarely seen in the US. Most merchants and banks are okay with a non-zero level of fraud because stricter fraud prevention methods negatively impact user experience. Here's an article going into more depth about the tradeoffs involved: https://bam.kalzumeus.com/archive/optimal-amount-of-fraud/ https://bam.kalzumeus.com/archive/optimal-amount-of-fraud/

Youden 4y ago
You claim that the assertion is false but you've only looked at one aspect for why the parent might think the US banking system is behind. To put another one out there, there's no universal and practical way to electronically transfer money from one person to another. The only options are cash, checks, wire transfers and ACH. Wire transfers are expensive and ACH is difficult to use. In the SEPA area you can transfer money to anybody else within about a day for the cost of a local transfer (usually free) with nothing but an IBAN (which can be freely-given, unlike a US bank account number). Plus, the US has been behind for a long time for card-present transactions as well. Only in the past few years have chips started to see widespread use.
- sidpatil 4y ago
  > To put another one out there, there's no universal and practical way to electronically transfer money from one person to another. The only options are cash, checks, wire transfers and ACH. Wire transfers are expensive and ACH is difficult to use. The FedNow system, scheduled to roll out next year, is designed to fulfill this purpose. https://www.federalreserve.gov/paymentsystems/fednow_about.htm https://www.federalreserve.gov/paymentsystems/fednow_about.h...
  - 4y ago