5 ms·

I routinely use different per-company email addresses with most companies I deal with, mainly so that my email is automatically sorted and so that I can deal mo

I routinely use different per-company email addresses with most companies I deal with, mainly so that my email is automatically sorted and so that I can deal more effectively with cases where a spammer gets my email address from a company or an marketing unsubscribe request is ignored. The mere fact that my bank and the merchant have different email addresses for me should not give me an unfair advantage in disputes with a merchant. The main protection the merchant has from me is the fact that I'm too honest to fraudulently start this kind of dispute, which is not something a merchant should rely on for their customer base at large. Bank of America's policy is inappropriately merchant-hostile here, and so is Stripe's policy of so blindly deferring to the bank. That said, I'm not truly sure what the right fix is. Names are not globally unique or authenticated, and a fraudster with the necessary credit card information could easily have gone to the website and made the ticket purchase just as easily as the genuine client, even in the example of the linked article. And the last time I used my credit card (legitimately) to buy flight tickets for relatives to visit my wife and me, the only email address I specified belonged to one of my visiting relatives, not to my wife or me. It's a hard problem to fairly solve.

virgilp 2y ago
Is it? - 3d secure would have made it hard to claim "wasn't me" - banks here cancel cards involved in fraud, and request a police report (not really a very strong deterrent, but at least makes it risky/harder to repeatedly claim fraud, when it isn't)
- jkaplowitz 2y ago
  You must not be in the US. Many US-issued cards don't have any meaningful form of 3-D Secure, and many of those that do just have an automated set of risk checks, but not the newest versions common in Europe with live customer authentication through app or one-time passcode. I've actually never seen that level of security on any card from the US or Canada, though I won't guarantee that there isn't some card there which offers it. Similarly, in the US and I suspect also in Canada, a police report is not a routine part of how credit card issuers handle fraud. Not even when the customer is the one to report the fraud to the bank, instead of the bank automatically detecting it.
  - virgilp 2y ago
    Indeed, I'm not in US - I was just pointing out that it's not __that__ hard to fairly solve, in fact it has been solved decently well in other places.
    - jkaplowitz 2y ago
      Solutions are path-dependent. Credit card adoption has followed a very different trajectory in the US vs Europe, and on a very different timeline too. Aligning the incentives and the funding to get the US from where it is now to a place that would solve the problems we’re discussing is indeed quite hard - but not technically, as you quite rightly point out, at least when there is adequate time + resources + will available to implement and require the existing technical solutions. Rather it’s hard financially, politically, legally, culturally, and logistically to achieve those circumstances where adopting the existing technical solutions goes from theoretically possible to done. In particular, these problems are hard for Stripe to solve unilaterally from its particular position in the payments ecosystem, and/or for a single major US bank to solve without competitive disadvantage when its peers don’t also make the same changes.
      - virgilp 2y ago
        The comment originally was in the context of "I'm not truly sure what the right fix is." ; technically, a pretty decent fix is implemented elsewhere so it's not that hard to find. 3DSecure is implemented widely in Europe due to PSD2 regulation, you just need one like that in US, doesn't even need to be very original, they can copy most of it from EU. I'm not saying there aren't social/political challenges, just that there needs to be a will - because there already is a way. > So for merchants in any country worldwide, this problem has only been solved decently well if they want to region-restrict their cards. Well strong customer authentication is only relevant for online purchases, and I'm willing to bet that the number of non-EU clients purchasing _online_, via _insecure cards only_ is negligible (one can offer other alternative ways of payment). Also I _think_ that if merchant requires 3DSecure but bank doesn't offer it, the liability passes to the bank (i.e. BoA may decide to authorize the transaction on the card without 3DSecure - but in case of fraud, they will be the ones eating the loss, not the merchant). Not entirely sure on this one, though :)
- deleted 2y ago
  [deleted]
Two4 2y ago
The card issuer will always have the final say when it comes to chargebacks. Each issuer has a different policy, and Stripe cannot (or should not) gamble on whether the issuer shares their view on a dispute, lest they be left holding the bag when the issuer claws back the money. Deferring to the issuing bank for disputes is a reasonable policy.
- jkaplowitz 2y ago
  Maybe the solution then is regulation of issuer chargeback policies, or of the ability of issuers to claw back money from payment processors or merchants. Yes, the issuer knows the cardholder better than the merchant, but the payment processor knows the merchant better than the issuer. Why is it right for one of those two sides to automatically get the final say, even when they use such a spurious basis for their decision as Bank of America did here? As I said, figuring out the right fix is not easy. But I don’t see how the current situation is defensible as okay, except as maybe reflecting the natural way for each of the individual actors to behave given the various incentives which are presently applicable to them, or as better than any specific proposal currently available for how to fix the situation.

virgilp 2y ago

Is it? - 3d secure would have made it hard to claim "wasn't me" - banks here cancel cards involved in fraud, and request a police report (not really a very strong deterrent, but at least makes it risky/harder to repeatedly claim fraud, when it isn't)

jkaplowitz 2y ago
You must not be in the US. Many US-issued cards don't have any meaningful form of 3-D Secure, and many of those that do just have an automated set of risk checks, but not the newest versions common in Europe with live customer authentication through app or one-time passcode. I've actually never seen that level of security on any card from the US or Canada, though I won't guarantee that there isn't some card there which offers it. Similarly, in the US and I suspect also in Canada, a police report is not a routine part of how credit card issuers handle fraud. Not even when the customer is the one to report the fraud to the bank, instead of the bank automatically detecting it.
- virgilp 2y ago
  Indeed, I'm not in US - I was just pointing out that it's not __that__ hard to fairly solve, in fact it has been solved decently well in other places.
  - jkaplowitz 2y ago
    Solutions are path-dependent. Credit card adoption has followed a very different trajectory in the US vs Europe, and on a very different timeline too. Aligning the incentives and the funding to get the US from where it is now to a place that would solve the problems we’re discussing is indeed quite hard - but not technically, as you quite rightly point out, at least when there is adequate time + resources + will available to implement and require the existing technical solutions. Rather it’s hard financially, politically, legally, culturally, and logistically to achieve those circumstances where adopting the existing technical solutions goes from theoretically possible to done. In particular, these problems are hard for Stripe to solve unilaterally from its particular position in the payments ecosystem, and/or for a single major US bank to solve without competitive disadvantage when its peers don’t also make the same changes.
    - virgilp 2y ago
      The comment originally was in the context of "I'm not truly sure what the right fix is." ; technically, a pretty decent fix is implemented elsewhere so it's not that hard to find. 3DSecure is implemented widely in Europe due to PSD2 regulation, you just need one like that in US, doesn't even need to be very original, they can copy most of it from EU. I'm not saying there aren't social/political challenges, just that there needs to be a will - because there already is a way. > So for merchants in any country worldwide, this problem has only been solved decently well if they want to region-restrict their cards. Well strong customer authentication is only relevant for online purchases, and I'm willing to bet that the number of non-EU clients purchasing _online_, via _insecure cards only_ is negligible (one can offer other alternative ways of payment). Also I _think_ that if merchant requires 3DSecure but bank doesn't offer it, the liability passes to the bank (i.e. BoA may decide to authorize the transaction on the card without 3DSecure - but in case of fraud, they will be the ones eating the loss, not the merchant). Not entirely sure on this one, though :)
deleted 2y ago
[deleted]

Two4 2y ago

The card issuer will always have the final say when it comes to chargebacks. Each issuer has a different policy, and Stripe cannot (or should not) gamble on whether the issuer shares their view on a dispute, lest they be left holding the bag when the issuer claws back the money. Deferring to the issuing bank for disputes is a reasonable policy.

jkaplowitz 2y ago
Maybe the solution then is regulation of issuer chargeback policies, or of the ability of issuers to claw back money from payment processors or merchants. Yes, the issuer knows the cardholder better than the merchant, but the payment processor knows the merchant better than the issuer. Why is it right for one of those two sides to automatically get the final say, even when they use such a spurious basis for their decision as Bank of America did here? As I said, figuring out the right fix is not easy. But I don’t see how the current situation is defensible as okay, except as maybe reflecting the natural way for each of the individual actors to behave given the various incentives which are presently applicable to them, or as better than any specific proposal currently available for how to fix the situation.