5 ms·

BNPL with PayPal in 4 is one reason. Another reason might be encapsulating your payment info?

by dpig_ 3y ago

happymellon 3y ago
> BNPL with PayPal in 4 TIL PayPal offered a BNPL option, although it is apparently 3 rather than 4 here. > Another reason might be encapsulating your payment info? Do CNP transactions not require you to authorise via a second factor in the US? I know that if I buy anything online any debit or credit card would require me to access the bank app to authenticate the transaction to prevent fraud. Encapsulation would reduce the security since I'm relying on PayPal to do this, at best they would match the existing bank verification.
- zinekeller 3y ago
  > Do CNP transactions not require you to authorise via a second factor in the US? Do we even need to ask this question when cards there are still using signature-only verification (or even sometimes not even asking for signature nor PIN)? In all seriousness, they're dragging their feet in implementing 3DS2, do not have a rule like PSD2, and from time to time will even accept cards with nearly everything wrong except for card number and expiration. Even Stripe literally has an article titled "Charge succeeded despite CVC or ZIP check mismatch" (https://support.stripe.com/questions/charge-succeeded-despite-cvc-or-zip-check-mismatch https://support.stripe.com/questions/charge-succeeded-despit...) for merchants in other countries because that's how lax US banks are.
  - happymellon 3y ago
    That's insane. Although last time I was in the US I was told by stores that they didn't support contactless payments. I tapped anyway and it went through, after they tried to grab my card out of my hand to swipe it. Yeah, that's not going to work. Swiping is disabled except on a case by case basis, and grabbing my card out of my hard isn't going to get my custom.
    - zinekeller 3y ago
      > I tapped anyway and it went through, after they tried to grab my card out of my hand to swipe it. I'm gonna guess since that I don't know the full details, but some merchants' POS and payment terminal are not connected. The swiping is intended for the POS machine to retrieve the card details (like your name and the last 4 digits of your card*) to be printed on your receipt. Good luck on them in the near future when a tourist pays with an European-issued card (which in 2025 will allow banks in Europe to issue cards without the magstripe at all). * For purposes outside of direct payment processing (like recordkeeping), PCI standards only allow the first six digits (which was the Bank Identification Number/Institution Identification Number, but now BIN/IIN are now at least eight digits long) and the last four digits of PAN (primary account number, formal name of that 16ish-digit card number) while US federal law only allow to store the last five digits of PAN. This results in US merchants (in theory) only storing the last four digits of the PAN.

BNPL with PayPal in 4 is one reason. Another reason might be encapsulating your payment info?

by dpig_ 3y ago

BNPL with PayPal in 4 is one reason. Another reason might be encapsulating your payment info?

> BNPL with PayPal in 4 TIL PayPal offered a BNPL option, although it is apparently 3 rather than 4 here. > Another reason might be encapsulating your payment info? Do CNP transactions not require you to authorise via a second factor in the US? I know that if I buy anything online any debit or credit card would require me to access the bank app to authenticate the transaction to prevent fraud. Encapsulation would reduce the security since I'm relying on PayPal to do this, at best they would match the existing bank verification.

zinekeller 3y ago
> Do CNP transactions not require you to authorise via a second factor in the US? Do we even need to ask this question when cards there are still using signature-only verification (or even sometimes not even asking for signature nor PIN)? In all seriousness, they're dragging their feet in implementing 3DS2, do not have a rule like PSD2, and from time to time will even accept cards with nearly everything wrong except for card number and expiration. Even Stripe literally has an article titled "Charge succeeded despite CVC or ZIP check mismatch" (https://support.stripe.com/questions/charge-succeeded-despite-cvc-or-zip-check-mismatch https://support.stripe.com/questions/charge-succeeded-despit...) for merchants in other countries because that's how lax US banks are.
- happymellon 3y ago
  That's insane. Although last time I was in the US I was told by stores that they didn't support contactless payments. I tapped anyway and it went through, after they tried to grab my card out of my hand to swipe it. Yeah, that's not going to work. Swiping is disabled except on a case by case basis, and grabbing my card out of my hard isn't going to get my custom.
  - zinekeller 3y ago
    > I tapped anyway and it went through, after they tried to grab my card out of my hand to swipe it. I'm gonna guess since that I don't know the full details, but some merchants' POS and payment terminal are not connected. The swiping is intended for the POS machine to retrieve the card details (like your name and the last 4 digits of your card*) to be printed on your receipt. Good luck on them in the near future when a tourist pays with an European-issued card (which in 2025 will allow banks in Europe to issue cards without the magstripe at all). * For purposes outside of direct payment processing (like recordkeeping), PCI standards only allow the first six digits (which was the Bank Identification Number/Institution Identification Number, but now BIN/IIN are now at least eight digits long) and the last four digits of PAN (primary account number, formal name of that 16ish-digit card number) while US federal law only allow to store the last five digits of PAN. This results in US merchants (in theory) only storing the last four digits of the PAN.