7 ms·

I'm curious what the solutions are. People, including myself, feel this should legally be the bank's problem. Someone pretended to be the account owner and the

by nox101 2y ago

I'm curious what the solutions are. People, including myself, feel this should legally be the bank's problem. Someone pretended to be the account owner and the bank gave them money. That seems pretty clearly the bank at fault But, let's say the laws got fixed and it became the bank's fault. Would there be un-intended consequences or only good ones? I'd expect banks to maybe get rid of checks. Or, require every check to be approved when received. You send a check, the check gets deposited, the bank pings you (email, sms, app) .. did you write this check? Or maybe something else. If I understand correctly, some countries (Estonia?, Singapore?) when you use a credit card, the bank requires some form of 2 factor. I've seen that once in a while with USA cards, usually only when ordering something abroad. In Japan some banks require a 2 factor calculator that generates codes. No idea if that's prevented much fraud.

deleted 2y ago
[deleted]
Boltgolt 2y ago
A second factor (like 3-D Secure) is required by EU directive in the whole block for online payments. For in person payments having access to the card and knowing the code already satisfies the 2 factors, and checks are extremely rare and have been for decades
- nox101 2y ago
  So you sign up for a subscription and every month you must use a 2nd factor to secure it? Do you have amazon or equivalent? Does every time you order you have to second factor or do you just have to do it once when you sign up for an account?
  - m1n7 2y ago
    nah you only need to do it once for subscriptions, but you can revoke access. with other purchases it depends on the site. some ask you every time and others don't. i'd assume charges in the same range don't have to be approved again, but idk how it works exactly
  - piva00 2y ago
    Subscriptions don't need to 3-D Secure every transaction, the initial transaction is considered identified and the auth code is re-used for subsequent charges until you revoke it. For Amazon and other larger merchants I feel there is some rules system taking as parameters the merchant size (also as a "trustworthiness" score of sorts), recency of last identified purchase (or even some kind of re-using identified auth codes on that merchant), and amount of purchase since almost all larger purchases I make online seem to require 3-D Secure even on larger merchants. It's not a big hassle, sometimes buying through a new checkout process requires me to authorise the transaction even for small amounts but where I live I can do it through a electronic identification app on my phone, takes some seconds.
  - daveoc64 2y ago
    The second factor isn't always needed. The banks use the sort of risk factors they do for other kinds of fraud protection. If you make a larger transaction than usual, or try to make a transaction with a merchant you've not used before, then you'll usually be prompted to authenticate. There's also a limit to how many unauthenticated transactions you can make within a period of time.
surfingdino 2y ago
2-factor is common for online card transactions in the UK.
joelccr 2y ago
All major CC companies have the extra layer (3-D Secure) available to merchants. Whenever I make a card transaction online that is in any way unusual the bank makes me do an app/SMS 2-factor. As with any extra step in a purchase its a balance between security and conversion rates. It seems companies have decided it reduces conversion too much in the US hence the low uptake, whereas UK/EU seem to use it very often.
remus 2y ago
> People, including myself, feel this should legally be the bank's problem. Someone pretended to be the account owner and the bank gave them money. That seems pretty clearly the bank at fault I think it is a little more nuanced. While I think banks should shoulder more of the responsibility account owners also need to be invested in keeping their personal information secure. If I left my passport, driving license, pin, password, phone (unlocked of course) and 5 years of bank statements by the side of the road a stranger could pick those up and pretend to be me with very little effort, and the bank would be very hard pushed to distinguish the stranger from the real person. If it was purely the bank's problem what incentive would there be for people to secure their information? They'd just reclaim the loss back from the bank.
- xwolfi 2y ago
  But we didn't ask the bank for any of this. They can just check my fingerprint each time I go to an ATM and provide no card, and I'll survive. They built these systems, we can't do without them anymore, and on top of it I have to secure their identity checks? Someone stole 2k$ from me by using my CC number recently. Well, awesome, why wasn't there even an OTP ? When I want to buy a 10$ crap on Amazon they send me 3 SMS... They leave these things a bit open to reduce friction, they have to pay for it. My bank paid me back the same day, and that was the least they could do.
  - ako 2y ago
    You’d survive, but loose your fingers in the next robbery… Plus, fingerprint is super unreliable. Every time I’m hand sanding a wood project, or go windsurfing or wingfoiling for a couple of hours, my fingerprints are unusable for some days.
- deleted 2y ago
  [deleted]
- yencabulator 2y ago
  > If I left my passport, driving license, pin, password, phone (unlocked of course) and 5 years of bank statements by the side of the road a stranger could pick those up and pretend to be me with very little effort, and the bank would be very hard pushed to distinguish the stranger from the real person. Until you report those items as stolen, after which they should be not useful at all. Especially the 5 years of bank statements should have no power of authenticating you.
Am4TIfIsER0ppos 2y ago
In-person banking only where the employees are long term and recognize the customers, you can see the manager, and you can close your account at any time and are handed a stack of bills. Yes, reversing 50+ years of "progress".
mindslight 2y ago
First, it essentially already is the banks' problem legally. This does not stop a bank from defrauding the customer into giving the bank a loan for months while performing hundreds of hours of paralegal work, but in most cases the bank will eventually be on the hook. So we're not talking about any new risk, but rather for banks to stop giving people the runaround pretending they aren't directly responsible. Checks would be completely unaffected, as they're already reversible like any other ACH transaction. If there is any affect it would be on cash withdrawals and wire transfers seeing increased authentication requirements (places where the transaction "hardness" of money increases). But that's precisely what we want to happen! I do personally withdraw thousands of dollars in cash at a time. But if say I had to use my ATM card + PIN instead of merely writing my 9-digit account number on a paper withdrawal slip, I would certainly understand.
yencabulator 2y ago
Most European cards are chip cards now. (Many of them might require a PIN too.) American cards still have magnetic stripes that are very vulnerable to skimming. But credit card companies (/banks) can't get rid of the magnetic stripes (in a commercially viable way) until readers are upgraded to support chips. In Europe, you'd probably just have a law saying this needs to perform to that security level by this date, and make the companies upgrade -- but the US theme is "stuck in the 70s" for this kind of stuff. I have high hopes for contactless payments to finally force reader upgrades, because the difference is something the consumer notices and might appreciate. With magnetic strip vs chip, the user experience was too similar. (Of course, my phone fails to pay about half the time at the local grocery store, but at least the credit card tap works.)
rstuart4133 2y ago
Part of the problem is the government issued licence. The old paper / dumb card versions are easy to duplicate, and that's what happened. Now they can be a smartcard signed with a government key which can't so easily be forged. "Now" means any time in the last 30 years. Ditto all government credentials - birth certificates, passports, other licences. All should have been changed decades ago. But we are talking about the USA. The credit / debit card industry figured this out and published the EMV standard (aka "chip and PIN") in 1995. A few countries made EMV mandatory for credit/debit cards in 2003, most had done it by 2015. The USA waited to 2021 to force the issue using a liability shift. Now identify fraud is approaching epidemic proportions. In Australia at least the major source of these identity document leaks is data breaches of organisations who were forced by the government to collect copies of licences by Know Your Customer regulations. The penny has finally dropped finally here, with our Feds finally moving to mandating electric ID's and licences. If the governments in haven't realised they a similar position now, they will be soon.

by nox101 2y ago

deleted 2y ago

[deleted]

Boltgolt 2y ago

A second factor (like 3-D Secure) is required by EU directive in the whole block for online payments. For in person payments having access to the card and knowing the code already satisfies the 2 factors, and checks are extremely rare and have been for decades

nox101 2y ago
So you sign up for a subscription and every month you must use a 2nd factor to secure it? Do you have amazon or equivalent? Does every time you order you have to second factor or do you just have to do it once when you sign up for an account?
- m1n7 2y ago
  nah you only need to do it once for subscriptions, but you can revoke access. with other purchases it depends on the site. some ask you every time and others don't. i'd assume charges in the same range don't have to be approved again, but idk how it works exactly
- piva00 2y ago
  Subscriptions don't need to 3-D Secure every transaction, the initial transaction is considered identified and the auth code is re-used for subsequent charges until you revoke it. For Amazon and other larger merchants I feel there is some rules system taking as parameters the merchant size (also as a "trustworthiness" score of sorts), recency of last identified purchase (or even some kind of re-using identified auth codes on that merchant), and amount of purchase since almost all larger purchases I make online seem to require 3-D Secure even on larger merchants. It's not a big hassle, sometimes buying through a new checkout process requires me to authorise the transaction even for small amounts but where I live I can do it through a electronic identification app on my phone, takes some seconds.
- daveoc64 2y ago
  The second factor isn't always needed. The banks use the sort of risk factors they do for other kinds of fraud protection. If you make a larger transaction than usual, or try to make a transaction with a merchant you've not used before, then you'll usually be prompted to authenticate. There's also a limit to how many unauthenticated transactions you can make within a period of time.

surfingdino 2y ago

2-factor is common for online card transactions in the UK.

joelccr 2y ago

All major CC companies have the extra layer (3-D Secure) available to merchants. Whenever I make a card transaction online that is in any way unusual the bank makes me do an app/SMS 2-factor. As with any extra step in a purchase its a balance between security and conversion rates. It seems companies have decided it reduces conversion too much in the US hence the low uptake, whereas UK/EU seem to use it very often.

remus 2y ago

> People, including myself, feel this should legally be the bank's problem. Someone pretended to be the account owner and the bank gave them money. That seems pretty clearly the bank at fault I think it is a little more nuanced. While I think banks should shoulder more of the responsibility account owners also need to be invested in keeping their personal information secure. If I left my passport, driving license, pin, password, phone (unlocked of course) and 5 years of bank statements by the side of the road a stranger could pick those up and pretend to be me with very little effort, and the bank would be very hard pushed to distinguish the stranger from the real person. If it was purely the bank's problem what incentive would there be for people to secure their information? They'd just reclaim the loss back from the bank.

xwolfi 2y ago
But we didn't ask the bank for any of this. They can just check my fingerprint each time I go to an ATM and provide no card, and I'll survive. They built these systems, we can't do without them anymore, and on top of it I have to secure their identity checks? Someone stole 2k$ from me by using my CC number recently. Well, awesome, why wasn't there even an OTP ? When I want to buy a 10$ crap on Amazon they send me 3 SMS... They leave these things a bit open to reduce friction, they have to pay for it. My bank paid me back the same day, and that was the least they could do.
- ako 2y ago
  You’d survive, but loose your fingers in the next robbery… Plus, fingerprint is super unreliable. Every time I’m hand sanding a wood project, or go windsurfing or wingfoiling for a couple of hours, my fingerprints are unusable for some days.
deleted 2y ago
[deleted]
yencabulator 2y ago
> If I left my passport, driving license, pin, password, phone (unlocked of course) and 5 years of bank statements by the side of the road a stranger could pick those up and pretend to be me with very little effort, and the bank would be very hard pushed to distinguish the stranger from the real person. Until you report those items as stolen, after which they should be not useful at all. Especially the 5 years of bank statements should have no power of authenticating you.

Am4TIfIsER0ppos 2y ago

In-person banking only where the employees are long term and recognize the customers, you can see the manager, and you can close your account at any time and are handed a stack of bills. Yes, reversing 50+ years of "progress".

mindslight 2y ago

First, it essentially already is the banks' problem legally. This does not stop a bank from defrauding the customer into giving the bank a loan for months while performing hundreds of hours of paralegal work, but in most cases the bank will eventually be on the hook. So we're not talking about any new risk, but rather for banks to stop giving people the runaround pretending they aren't directly responsible. Checks would be completely unaffected, as they're already reversible like any other ACH transaction. If there is any affect it would be on cash withdrawals and wire transfers seeing increased authentication requirements (places where the transaction "hardness" of money increases). But that's precisely what we want to happen! I do personally withdraw thousands of dollars in cash at a time. But if say I had to use my ATM card + PIN instead of merely writing my 9-digit account number on a paper withdrawal slip, I would certainly understand.

yencabulator 2y ago

Most European cards are chip cards now. (Many of them might require a PIN too.) American cards still have magnetic stripes that are very vulnerable to skimming. But credit card companies (/banks) can't get rid of the magnetic stripes (in a commercially viable way) until readers are upgraded to support chips. In Europe, you'd probably just have a law saying this needs to perform to that security level by this date, and make the companies upgrade -- but the US theme is "stuck in the 70s" for this kind of stuff. I have high hopes for contactless payments to finally force reader upgrades, because the difference is something the consumer notices and might appreciate. With magnetic strip vs chip, the user experience was too similar. (Of course, my phone fails to pay about half the time at the local grocery store, but at least the credit card tap works.)

rstuart4133 2y ago

Part of the problem is the government issued licence. The old paper / dumb card versions are easy to duplicate, and that's what happened. Now they can be a smartcard signed with a government key which can't so easily be forged. "Now" means any time in the last 30 years. Ditto all government credentials - birth certificates, passports, other licences. All should have been changed decades ago. But we are talking about the USA. The credit / debit card industry figured this out and published the EMV standard (aka "chip and PIN") in 1995. A few countries made EMV mandatory for credit/debit cards in 2003, most had done it by 2015. The USA waited to 2021 to force the issue using a liability shift. Now identify fraud is approaching epidemic proportions. In Australia at least the major source of these identity document leaks is data breaches of organisations who were forced by the government to collect copies of licences by Know Your Customer regulations. The penny has finally dropped finally here, with our Feds finally moving to mandating electric ID's and licences. If the governments in haven't realised they a similar position now, they will be soon.