2 ms·

> Do CNP transactions not require you to authorise via a second factor in the US? Do we even need to ask this question when cards there are still using signatu

> Do CNP transactions not require you to authorise via a second factor in the US? Do we even need to ask this question when cards there are still using signature-only verification (or even sometimes not even asking for signature nor PIN)? In all seriousness, they're dragging their feet in implementing 3DS2, do not have a rule like PSD2, and from time to time will even accept cards with nearly everything wrong except for card number and expiration. Even Stripe literally has an article titled "Charge succeeded despite CVC or ZIP check mismatch" (https://support.stripe.com/questions/charge-succeeded-despite-cvc-or-zip-check-mismatch https://support.stripe.com/questions/charge-succeeded-despit...) for merchants in other countries because that's how lax US banks are.

happymellon 3y ago
That's insane. Although last time I was in the US I was told by stores that they didn't support contactless payments. I tapped anyway and it went through, after they tried to grab my card out of my hand to swipe it. Yeah, that's not going to work. Swiping is disabled except on a case by case basis, and grabbing my card out of my hard isn't going to get my custom.
- zinekeller 3y ago
  > I tapped anyway and it went through, after they tried to grab my card out of my hand to swipe it. I'm gonna guess since that I don't know the full details, but some merchants' POS and payment terminal are not connected. The swiping is intended for the POS machine to retrieve the card details (like your name and the last 4 digits of your card*) to be printed on your receipt. Good luck on them in the near future when a tourist pays with an European-issued card (which in 2025 will allow banks in Europe to issue cards without the magstripe at all). * For purposes outside of direct payment processing (like recordkeeping), PCI standards only allow the first six digits (which was the Bank Identification Number/Institution Identification Number, but now BIN/IIN are now at least eight digits long) and the last four digits of PAN (primary account number, formal name of that 16ish-digit card number) while US federal law only allow to store the last five digits of PAN. This results in US merchants (in theory) only storing the last four digits of the PAN.

happymellon 3y ago

That's insane. Although last time I was in the US I was told by stores that they didn't support contactless payments. I tapped anyway and it went through, after they tried to grab my card out of my hand to swipe it. Yeah, that's not going to work. Swiping is disabled except on a case by case basis, and grabbing my card out of my hard isn't going to get my custom.

zinekeller 3y ago
> I tapped anyway and it went through, after they tried to grab my card out of my hand to swipe it. I'm gonna guess since that I don't know the full details, but some merchants' POS and payment terminal are not connected. The swiping is intended for the POS machine to retrieve the card details (like your name and the last 4 digits of your card*) to be printed on your receipt. Good luck on them in the near future when a tourist pays with an European-issued card (which in 2025 will allow banks in Europe to issue cards without the magstripe at all). * For purposes outside of direct payment processing (like recordkeeping), PCI standards only allow the first six digits (which was the Bank Identification Number/Institution Identification Number, but now BIN/IIN are now at least eight digits long) and the last four digits of PAN (primary account number, formal name of that 16ish-digit card number) while US federal law only allow to store the last five digits of PAN. This results in US merchants (in theory) only storing the last four digits of the PAN.