3 ms·

The only “secret sauce” is the liability shift. Traditional online and contactless payments are classed as “cardholder not present” transactions which place mor

The only “secret sauce” is the liability shift. Traditional online and contactless payments are classed as “cardholder not present” transactions which place more liability for fraud on the merchant. Apple and Google Pay (and other bank-provided payment apps) use biometrics to confirm cardholder authorisation, switching a subset of payment types to cardholder present. This means some chargeback types are instantly declined, and others have a lower requirement for merchant proof. This is all part of the card network standards, which are freely available if you’re interested from https://www.emvco.com/ https://www.emvco.com/ The reason there’s no open source option is the requirement to certify the implementation’s security, so you need a commercial entity to work with the banks. Oh, and every bank has to integrate separately - that’s a lot of banks to talk to.

Nursie 3y ago
Contactless card transactions are not “Cardholder not present” transactions! They are usually “No Cardholder Verification Method” transactions, though they can do ask for PIN entry in some circumstances. And no, the liability is not with the merchant for contactless, or they never would have accepted it! It’s firmly with the banks, which is why the limits were initially so low - to limit potential fraud. When it transpired that fraud was more than acceptably low, they raised the limits a bit. The liability is only with the merchant if the merchant chooses to accept a magnetic swipe transaction, or keyed card details. Not contactless EMV.
- anticensor 3y ago
  > They are usually “No Cardholder Verification Method” transactions, though they can do ask for PIN entry in some circumstances. In Turkey, contactless transactions are "Special Cardholder Verification Required, no PIN" or "Cardholder Present, PIN required" depending on the amount. And they are legally required to be performed online with immediate confirmation.

Nursie 3y ago

Contactless card transactions are not “Cardholder not present” transactions! They are usually “No Cardholder Verification Method” transactions, though they can do ask for PIN entry in some circumstances. And no, the liability is not with the merchant for contactless, or they never would have accepted it! It’s firmly with the banks, which is why the limits were initially so low - to limit potential fraud. When it transpired that fraud was more than acceptably low, they raised the limits a bit. The liability is only with the merchant if the merchant chooses to accept a magnetic swipe transaction, or keyed card details. Not contactless EMV.

anticensor 3y ago
> They are usually “No Cardholder Verification Method” transactions, though they can do ask for PIN entry in some circumstances. In Turkey, contactless transactions are "Special Cardholder Verification Required, no PIN" or "Cardholder Present, PIN required" depending on the amount. And they are legally required to be performed online with immediate confirmation.