3 ms·

It's funny how the main initial problems listed in the article don't exist in the EU. When adding my cards (from different banks) to Google Pay, I had to autho

by sofixa 2y ago

It's funny how the main initial problems listed in the article don't exist in the EU. When adding my cards (from different banks) to Google Pay, I had to authorise it via my bank's app (as all online payments, as per PSD2). When my card expires, all subscriptions using it contact me to update it. Including Google Pay the wallet. If I don't, they stop working. I would assume the same would apply to lost/stolen cards. So, US banking and most importantly, banking regulators, just need to follow the EU's lead. Banking here is around a decade ahead of the US.

PaulHoule 2y ago
Part of it in the current credit card system with high fees, banks can afford to eat a lot of fraud so they really don't care. If margins were small, say 0.1% it would be necessary to defeat fraud by technical measures to a much higher degree than today. With recurring payments being such a theme I think the system needs to change such that your credit card web site has a list of all your recurring payments and you ought to have one place to go to cancel subscriptions with a consistent interface.
- stavros 2y ago
  > Part of it in the current credit card system with high fees, banks can afford to eat a lot of fraud so they really don't care. You're saying the banks don't want to fix fraud because they just make me pay for it?
  - literalAardvark 2y ago
    Uhm, who did you think pays for it?
    - stavros 2y ago
      Well, I'm in the EU, so nobody, because the fee cap forced the banks to fix this, which is my entire point. I didn't "think" anything.
  - bigfatkitten 2y ago
    They mostly make the merchants pay for it (if you're not otherwise paying interest or annual fees), and some merchants will pass that cost on to you.
    - stavros 2y ago
      Merchants make all their money from customers, so all costs are always passed on to customers. Nobody cuts their margins.
      - bigfatkitten 2y ago
        Very few, if any of those costs are passed along as a direct surcharge like small stores do with card payments.
- sofixa 2y ago
  You guessed it right, the EU has a cap on card fees (0.2% for debit, 0.3% for credit).
Crosseye_Jack 2y ago
Came here after reading the article to say that I don't have the issues described in the article, and you have bet me too it (In the UK here). > First, there is the issue of the initial authentication. "Any malicious actor who knows the [physical] card number can pretend to be the cardholder," says Raza. "The digital wallet does not have sufficient mechanism to authenticate whether the card user is the cardholder or not." He emphasizes that existing authentication methods can easily be bypassed. When adding my physical card to Apple Pay, I had to auth my card being added with my bank via the banking app. (I also had a message in my "recent activity" section of my banking app that the card had been added to Apple Pay). > Another issue is that, once a victim reports their card stolen, the banks only block transactions from a physical card, not ones made through a digital wallet. Banks assume that their authentication system has sufficient security to prevent attackers from adding someone else's card to their wallet, which, as Raza points out, is not the case. My bank offers Virtual Cards, which I can use online via the "virtual" PAN issued or add the virtual card to Apple pay and use that to pay in store. Personally I found this more convenient with budgeting than using my physical card, so I choose to use my banks "Freeze Card" option on my physical card because honestly I only use it once in a blue moon, so might as well "freeze" it, just in case I misplace the wallet I keep it in and use virtual card(s) in Apple Pay IRL. The second I froze the physical card in the banking app I got a notification from Apple Pay telling me that card was no longer usable as a payment method. (The same would happen if I lost the card, its just that my banks process for reporting a card lost/stolen involves you freezing the card first) So IMO, its not an issue with "digital wallet security", but how card issuers handle that security.
- sofixa 2y ago
  > So IMO, its not an issue with "digital wallet security", but how card issuers handle that security And mostly that unless forced by regulations, companies will more often than not do the bare minimum at the expense of consumers.
  - Crosseye_Jack 2y ago
    I've been thinking about this and there might be ways to do it without regulations. The "big gun" without regulation would be if the likes of Apple and Google (and/or Visa / MasterCard) telling the card issuers that they have to use these security standards. But in my "ideal world" I don't like giving Visa/MC even more "power", however in this case at least it would be kicking the card issuers and not the consumer (same could be said for Apple/Google) The other way would be to hit the US card issuers in their pocket via class action that they were not using these security practices which could have protected customers from fraud. But yeah you are right, until external forces (be it the card networks, digital wallets, lawsuits, the feds, etc) make entities do the "right thing" they will often just do the bare minimum.

by sofixa 2y ago

PaulHoule 2y ago

Part of it in the current credit card system with high fees, banks can afford to eat a lot of fraud so they really don't care. If margins were small, say 0.1% it would be necessary to defeat fraud by technical measures to a much higher degree than today. With recurring payments being such a theme I think the system needs to change such that your credit card web site has a list of all your recurring payments and you ought to have one place to go to cancel subscriptions with a consistent interface.

stavros 2y ago
> Part of it in the current credit card system with high fees, banks can afford to eat a lot of fraud so they really don't care. You're saying the banks don't want to fix fraud because they just make me pay for it?
- literalAardvark 2y ago
  Uhm, who did you think pays for it?
  - stavros 2y ago
    Well, I'm in the EU, so nobody, because the fee cap forced the banks to fix this, which is my entire point. I didn't "think" anything.
- bigfatkitten 2y ago
  They mostly make the merchants pay for it (if you're not otherwise paying interest or annual fees), and some merchants will pass that cost on to you.
  - stavros 2y ago
    Merchants make all their money from customers, so all costs are always passed on to customers. Nobody cuts their margins.
    - bigfatkitten 2y ago
      Very few, if any of those costs are passed along as a direct surcharge like small stores do with card payments.
sofixa 2y ago
You guessed it right, the EU has a cap on card fees (0.2% for debit, 0.3% for credit).

Crosseye_Jack 2y ago

Came here after reading the article to say that I don't have the issues described in the article, and you have bet me too it (In the UK here). > First, there is the issue of the initial authentication. "Any malicious actor who knows the [physical] card number can pretend to be the cardholder," says Raza. "The digital wallet does not have sufficient mechanism to authenticate whether the card user is the cardholder or not." He emphasizes that existing authentication methods can easily be bypassed. When adding my physical card to Apple Pay, I had to auth my card being added with my bank via the banking app. (I also had a message in my "recent activity" section of my banking app that the card had been added to Apple Pay). > Another issue is that, once a victim reports their card stolen, the banks only block transactions from a physical card, not ones made through a digital wallet. Banks assume that their authentication system has sufficient security to prevent attackers from adding someone else's card to their wallet, which, as Raza points out, is not the case. My bank offers Virtual Cards, which I can use online via the "virtual" PAN issued or add the virtual card to Apple pay and use that to pay in store. Personally I found this more convenient with budgeting than using my physical card, so I choose to use my banks "Freeze Card" option on my physical card because honestly I only use it once in a blue moon, so might as well "freeze" it, just in case I misplace the wallet I keep it in and use virtual card(s) in Apple Pay IRL. The second I froze the physical card in the banking app I got a notification from Apple Pay telling me that card was no longer usable as a payment method. (The same would happen if I lost the card, its just that my banks process for reporting a card lost/stolen involves you freezing the card first) So IMO, its not an issue with "digital wallet security", but how card issuers handle that security.

sofixa 2y ago
> So IMO, its not an issue with "digital wallet security", but how card issuers handle that security And mostly that unless forced by regulations, companies will more often than not do the bare minimum at the expense of consumers.
- Crosseye_Jack 2y ago
  I've been thinking about this and there might be ways to do it without regulations. The "big gun" without regulation would be if the likes of Apple and Google (and/or Visa / MasterCard) telling the card issuers that they have to use these security standards. But in my "ideal world" I don't like giving Visa/MC even more "power", however in this case at least it would be kicking the card issuers and not the consumer (same could be said for Apple/Google) The other way would be to hit the US card issuers in their pocket via class action that they were not using these security practices which could have protected customers from fraud. But yeah you are right, until external forces (be it the card networks, digital wallets, lawsuits, the feds, etc) make entities do the "right thing" they will often just do the bare minimum.