3 ms·

> Mastercard treats their technology as infallible They're not unlikely to claim that it was me because machine reports seeing my eyes (because it doesn't hurt

> Mastercard treats their technology as infallible They're not unlikely to claim that it was me because machine reports seeing my eyes (because it doesn't hurt them to try to deny the claim), but generally industry is well aware that fraud exists. > Mastercard fails to take responsibility and continues to allow you to be exploited True for debit, but for credit the idea is that it's card issuer's problem if they still authorize those biometrics-authenticated transactions afterwards. The most probable scenario is that they'll immediately block the card and ability to use biometric payments after receiving the fraud report. Then start figuring out what happened. So, I guess, as long as I don't have all eggs in one basket (MasterCard), I will be inconvenienced but not really exploited. And given that it's not exactly trivial to quietly steal then impersonate someone's eyes and face, until that actually happens (low-probability event) it seems convenient to pay (high-frequency event) without reaching for a wallet or device.

makeitdouble 2y ago
> it's card issuer's problem if they still authorize those biometrics-authenticated transactions afterwards. Isn't it the reverse, with the issuer declining fraud allegations as they can "prove" you originated the transaction ? That's the building block of 3DSecure and other additional authentication, where the merchant is protected from chargebacks in exchange for pushing stronger check on the customer.
- drdaeman 2y ago
  If it wasn't me who made the transaction, they won't be able to prove it because such proof cannot exist by definition. They can (and most likely will) try to claim otherwise, but best they can do is say that they've scanned something that resembled my eyes to them. It's like with cloned cards (or even EMV proxy attacks) - yea, they've read the magstripe that read as my card, but they can't counter the fact that I was not physically present in that store paired with a statement that I haven't made that transaction. Also, in my experience, when a fraudulent transaction happens, banks tend to not challenge it much. When someone impersonated my card (I'm not sure but I suspect it was a BIN stuffing attack, since it was a sock drawer card) they just handled it without any issues. 3-D Secure shifts the risk/convenience balance and adds additional security checks, but it doesn't make customers liable for fraud.

makeitdouble 2y ago

> it's card issuer's problem if they still authorize those biometrics-authenticated transactions afterwards. Isn't it the reverse, with the issuer declining fraud allegations as they can "prove" you originated the transaction ? That's the building block of 3DSecure and other additional authentication, where the merchant is protected from chargebacks in exchange for pushing stronger check on the customer.

drdaeman 2y ago
If it wasn't me who made the transaction, they won't be able to prove it because such proof cannot exist by definition. They can (and most likely will) try to claim otherwise, but best they can do is say that they've scanned something that resembled my eyes to them. It's like with cloned cards (or even EMV proxy attacks) - yea, they've read the magstripe that read as my card, but they can't counter the fact that I was not physically present in that store paired with a statement that I haven't made that transaction. Also, in my experience, when a fraudulent transaction happens, banks tend to not challenge it much. When someone impersonated my card (I'm not sure but I suspect it was a BIN stuffing attack, since it was a sock drawer card) they just handled it without any issues. 3-D Secure shifts the risk/convenience balance and adds additional security checks, but it doesn't make customers liable for fraud.