4 ms·

You must not be in the US. Many US-issued cards don't have any meaningful form of 3-D Secure, and many of those that do just have an automated set of risk chec

You must not be in the US. Many US-issued cards don't have any meaningful form of 3-D Secure, and many of those that do just have an automated set of risk checks, but not the newest versions common in Europe with live customer authentication through app or one-time passcode. I've actually never seen that level of security on any card from the US or Canada, though I won't guarantee that there isn't some card there which offers it. Similarly, in the US and I suspect also in Canada, a police report is not a routine part of how credit card issuers handle fraud. Not even when the customer is the one to report the fraud to the bank, instead of the bank automatically detecting it.

virgilp 2y ago
Indeed, I'm not in US - I was just pointing out that it's not __that__ hard to fairly solve, in fact it has been solved decently well in other places.
- jkaplowitz 2y ago
  Solutions are path-dependent. Credit card adoption has followed a very different trajectory in the US vs Europe, and on a very different timeline too. Aligning the incentives and the funding to get the US from where it is now to a place that would solve the problems we’re discussing is indeed quite hard - but not technically, as you quite rightly point out, at least when there is adequate time + resources + will available to implement and require the existing technical solutions. Rather it’s hard financially, politically, legally, culturally, and logistically to achieve those circumstances where adopting the existing technical solutions goes from theoretically possible to done. In particular, these problems are hard for Stripe to solve unilaterally from its particular position in the payments ecosystem, and/or for a single major US bank to solve without competitive disadvantage when its peers don’t also make the same changes.
  - virgilp 2y ago
    The comment originally was in the context of "I'm not truly sure what the right fix is." ; technically, a pretty decent fix is implemented elsewhere so it's not that hard to find. 3DSecure is implemented widely in Europe due to PSD2 regulation, you just need one like that in US, doesn't even need to be very original, they can copy most of it from EU. I'm not saying there aren't social/political challenges, just that there needs to be a will - because there already is a way. > So for merchants in any country worldwide, this problem has only been solved decently well if they want to region-restrict their cards. Well strong customer authentication is only relevant for online purchases, and I'm willing to bet that the number of non-EU clients purchasing _online_, via _insecure cards only_ is negligible (one can offer other alternative ways of payment). Also I _think_ that if merchant requires 3DSecure but bank doesn't offer it, the liability passes to the bank (i.e. BoA may decide to authorize the transaction on the card without 3DSecure - but in case of fraud, they will be the ones eating the loss, not the merchant). Not entirely sure on this one, though :)
    - jkaplowitz 2y ago
      > The comment originally was in the context of "I'm not truly sure what the right fix is." ; technically, a pretty decent fix is implemented elsewhere so it's not that hard to find. 3DSecure is implemented widely in Europe due to PSD2 regulation, you just need one like that in US, doesn't even need to be very original, they can copy most of it from EU. I'm not saying there aren't social/political challenges, just that there needs to be a will - because there already is a way. Yeah, I’m saying that the people who could make that happen don’t have the incentives to do it, so the right technical fix is politically, commercially, or financially infeasible for many of the people who would have to agree in this. Solving that problem doesn’t have an obvious right fix. Why is it so different in the US? Simply put, credit cards were widely adopted before 3-D Secure (or even chips) existed, to such an extent that they’re even now far more dominant than they are in Europe, and the number of issuers and merchants is far greater and more evenly distributed across small businesses (yes even many of the issuers). So any modernization of the US credit card infrastructure is hard and slow. You’d be surprised. Even having a chip in US cards only became widespread recently, but they still don’t usually have a PIN used when making a in-person purchase. (The cards still work in most but not all European payment terminals - the machine often requests a signature, though the staff only sometimes bother with it.) Canada does at least have chip and PIN as standard. > Well strong customer authentication is only relevant for online purchases If you’re talking about the EU legal requirement, yeah - although it actually doesn’t apply in full if the cardholder’s bank is outside the EEA, the UK, or one other nearby country, even if the transaction is in the EEA. (Weirdly, Switzerland is also out of scope, despite how integral it is to Central Europe, probably because it’s not in the EEA.) But in the US, plenty of in-person fraud still happens too with cloned or stolen cards. Adding a chip has made this somewhat harder but not as much as you’d like, especially not without a PIN. > I'm willing to bet that the number of non-EU clients purchasing _online_, via _insecure cards only_ is negligible (one can offer other alternative ways of payment). All of this very much depends on the business. For a business like OP’s which sells event tickets, if those event tickets have an international clientele such as tourists traveling from outside Europe or one of the few other countries where these technologies are commonly supported, there may not be any good other way to make the online ticket purchase happen. Yes, credit (or effectively equivalent debit) cards without common 3-D Secure are that dominant in the US and Canada, although some people use PayPal or other local solutions too. In fact, credit and debit cards are the only way to buy online that’s routinely offered by most merchants in the US, so there’s no way to exclude non-European credit cards without excluding many US customers. And lots of US or Canadian tourists in Europe really want to use the credit cards, because the fancy cards that frequent tourists or foreign-resident Americans/Canadians use often zero out the foreign currency cost with no foreign transaction fees, and/or because of reward points offered by the cards that are better for the cardholders (at more cost to the merchants) than what’s offered by issuers in Europe. Traditional bank transfers (wire transfers) to Europe from outside the SEPA region are complicated, often slow, and expensive for both sides. Plus keep in mind, the US and Canada are not the only countries where banks don’t have to offer strong customer authentication. It’s only required in the EEA and a few other countries. So when I said “international clientele” I don’t only mean North Americans. > Also I _think_ that if merchant requires 3DSecure but bank doesn't offer it, the liability passes to the bank (i.e. BoA may decide to authorize the transaction on the card without 3DSecure - but in case of fraud, they will be the ones eating the loss, not the merchant). Not entirely sure on this one, though :) If this does apply to US-issued cards, that might be why the two US-issued cards which I routinely use in Europe have finally added the frictionless flow version of 3-D Secure. However they don’t support the kinds that actually involve the customer in a live authentication, just some fully automated checks.
- jkaplowitz 2y ago
  Separate reply to add: the US (or Canadian) rules apply in these regards to the use of US (or Canadian) cards in Europe, unless a particular merchant wants to ban those. I suspect this is only sometimes legal for them to do, but more importantly, it’s often a bad business decision overall for businesses with an international clientele. So for merchants in any country worldwide, this problem has only been solved decently well if they want to region-restrict their cards.
pests 2y ago
I've seen 3d secure in the wild here in Michigan as far back as two years ago. My boss (a pretty high net worth individual) gave me a card to pay for something online with and ended up leaving before I hit pay. Got sent through the flow but couldn't complete the purchase as he wasn't answering his phone. One and only time I've seen it though and I wouldn't doubt its a fancy card or enabled due to account value or something.
- jkaplowitz 2y ago
  Yeah, the good version of 3-D Secure does exist in the US, but it’s rare as you say. If the vast majority of US cards don’t have it, including many from major issuers, then the problem isn’t really solved for merchants (in any country!) who accept US cards.

virgilp 2y ago

Indeed, I'm not in US - I was just pointing out that it's not __that__ hard to fairly solve, in fact it has been solved decently well in other places.

jkaplowitz 2y ago
Solutions are path-dependent. Credit card adoption has followed a very different trajectory in the US vs Europe, and on a very different timeline too. Aligning the incentives and the funding to get the US from where it is now to a place that would solve the problems we’re discussing is indeed quite hard - but not technically, as you quite rightly point out, at least when there is adequate time + resources + will available to implement and require the existing technical solutions. Rather it’s hard financially, politically, legally, culturally, and logistically to achieve those circumstances where adopting the existing technical solutions goes from theoretically possible to done. In particular, these problems are hard for Stripe to solve unilaterally from its particular position in the payments ecosystem, and/or for a single major US bank to solve without competitive disadvantage when its peers don’t also make the same changes.
- virgilp 2y ago
  The comment originally was in the context of "I'm not truly sure what the right fix is." ; technically, a pretty decent fix is implemented elsewhere so it's not that hard to find. 3DSecure is implemented widely in Europe due to PSD2 regulation, you just need one like that in US, doesn't even need to be very original, they can copy most of it from EU. I'm not saying there aren't social/political challenges, just that there needs to be a will - because there already is a way. > So for merchants in any country worldwide, this problem has only been solved decently well if they want to region-restrict their cards. Well strong customer authentication is only relevant for online purchases, and I'm willing to bet that the number of non-EU clients purchasing _online_, via _insecure cards only_ is negligible (one can offer other alternative ways of payment). Also I _think_ that if merchant requires 3DSecure but bank doesn't offer it, the liability passes to the bank (i.e. BoA may decide to authorize the transaction on the card without 3DSecure - but in case of fraud, they will be the ones eating the loss, not the merchant). Not entirely sure on this one, though :)
  - jkaplowitz 2y ago
    > The comment originally was in the context of "I'm not truly sure what the right fix is." ; technically, a pretty decent fix is implemented elsewhere so it's not that hard to find. 3DSecure is implemented widely in Europe due to PSD2 regulation, you just need one like that in US, doesn't even need to be very original, they can copy most of it from EU. I'm not saying there aren't social/political challenges, just that there needs to be a will - because there already is a way. Yeah, I’m saying that the people who could make that happen don’t have the incentives to do it, so the right technical fix is politically, commercially, or financially infeasible for many of the people who would have to agree in this. Solving that problem doesn’t have an obvious right fix. Why is it so different in the US? Simply put, credit cards were widely adopted before 3-D Secure (or even chips) existed, to such an extent that they’re even now far more dominant than they are in Europe, and the number of issuers and merchants is far greater and more evenly distributed across small businesses (yes even many of the issuers). So any modernization of the US credit card infrastructure is hard and slow. You’d be surprised. Even having a chip in US cards only became widespread recently, but they still don’t usually have a PIN used when making a in-person purchase. (The cards still work in most but not all European payment terminals - the machine often requests a signature, though the staff only sometimes bother with it.) Canada does at least have chip and PIN as standard. > Well strong customer authentication is only relevant for online purchases If you’re talking about the EU legal requirement, yeah - although it actually doesn’t apply in full if the cardholder’s bank is outside the EEA, the UK, or one other nearby country, even if the transaction is in the EEA. (Weirdly, Switzerland is also out of scope, despite how integral it is to Central Europe, probably because it’s not in the EEA.) But in the US, plenty of in-person fraud still happens too with cloned or stolen cards. Adding a chip has made this somewhat harder but not as much as you’d like, especially not without a PIN. > I'm willing to bet that the number of non-EU clients purchasing _online_, via _insecure cards only_ is negligible (one can offer other alternative ways of payment). All of this very much depends on the business. For a business like OP’s which sells event tickets, if those event tickets have an international clientele such as tourists traveling from outside Europe or one of the few other countries where these technologies are commonly supported, there may not be any good other way to make the online ticket purchase happen. Yes, credit (or effectively equivalent debit) cards without common 3-D Secure are that dominant in the US and Canada, although some people use PayPal or other local solutions too. In fact, credit and debit cards are the only way to buy online that’s routinely offered by most merchants in the US, so there’s no way to exclude non-European credit cards without excluding many US customers. And lots of US or Canadian tourists in Europe really want to use the credit cards, because the fancy cards that frequent tourists or foreign-resident Americans/Canadians use often zero out the foreign currency cost with no foreign transaction fees, and/or because of reward points offered by the cards that are better for the cardholders (at more cost to the merchants) than what’s offered by issuers in Europe. Traditional bank transfers (wire transfers) to Europe from outside the SEPA region are complicated, often slow, and expensive for both sides. Plus keep in mind, the US and Canada are not the only countries where banks don’t have to offer strong customer authentication. It’s only required in the EEA and a few other countries. So when I said “international clientele” I don’t only mean North Americans. > Also I _think_ that if merchant requires 3DSecure but bank doesn't offer it, the liability passes to the bank (i.e. BoA may decide to authorize the transaction on the card without 3DSecure - but in case of fraud, they will be the ones eating the loss, not the merchant). Not entirely sure on this one, though :) If this does apply to US-issued cards, that might be why the two US-issued cards which I routinely use in Europe have finally added the frictionless flow version of 3-D Secure. However they don’t support the kinds that actually involve the customer in a live authentication, just some fully automated checks.
jkaplowitz 2y ago
Separate reply to add: the US (or Canadian) rules apply in these regards to the use of US (or Canadian) cards in Europe, unless a particular merchant wants to ban those. I suspect this is only sometimes legal for them to do, but more importantly, it’s often a bad business decision overall for businesses with an international clientele. So for merchants in any country worldwide, this problem has only been solved decently well if they want to region-restrict their cards.

pests 2y ago

I've seen 3d secure in the wild here in Michigan as far back as two years ago. My boss (a pretty high net worth individual) gave me a card to pay for something online with and ended up leaving before I hit pay. Got sent through the flow but couldn't complete the purchase as he wasn't answering his phone. One and only time I've seen it though and I wouldn't doubt its a fancy card or enabled due to account value or something.

jkaplowitz 2y ago
Yeah, the good version of 3-D Secure does exist in the US, but it’s rare as you say. If the vast majority of US cards don’t have it, including many from major issuers, then the problem isn’t really solved for merchants (in any country!) who accept US cards.