4 ms·

> The comment originally was in the context of "I'm not truly sure what the right fix is." ; technically, a pretty decent fix is implemented elsewhere so it's n

> The comment originally was in the context of "I'm not truly sure what the right fix is." ; technically, a pretty decent fix is implemented elsewhere so it's not that hard to find. 3DSecure is implemented widely in Europe due to PSD2 regulation, you just need one like that in US, doesn't even need to be very original, they can copy most of it from EU. I'm not saying there aren't social/political challenges, just that there needs to be a will - because there already is a way. Yeah, I’m saying that the people who could make that happen don’t have the incentives to do it, so the right technical fix is politically, commercially, or financially infeasible for many of the people who would have to agree in this. Solving that problem doesn’t have an obvious right fix. Why is it so different in the US? Simply put, credit cards were widely adopted before 3-D Secure (or even chips) existed, to such an extent that they’re even now far more dominant than they are in Europe, and the number of issuers and merchants is far greater and more evenly distributed across small businesses (yes even many of the issuers). So any modernization of the US credit card infrastructure is hard and slow. You’d be surprised. Even having a chip in US cards only became widespread recently, but they still don’t usually have a PIN used when making a in-person purchase. (The cards still work in most but not all European payment terminals - the machine often requests a signature, though the staff only sometimes bother with it.) Canada does at least have chip and PIN as standard. > Well strong customer authentication is only relevant for online purchases If you’re talking about the EU legal requirement, yeah - although it actually doesn’t apply in full if the cardholder’s bank is outside the EEA, the UK, or one other nearby country, even if the transaction is in the EEA. (Weirdly, Switzerland is also out of scope, despite how integral it is to Central Europe, probably because it’s not in the EEA.) But in the US, plenty of in-person fraud still happens too with cloned or stolen cards. Adding a chip has made this somewhat harder but not as much as you’d like, especially not without a PIN. > I'm willing to bet that the number of non-EU clients purchasing _online_, via _insecure cards only_ is negligible (one can offer other alternative ways of payment). All of this very much depends on the business. For a business like OP’s which sells event tickets, if those event tickets have an international clientele such as tourists traveling from outside Europe or one of the few other countries where these technologies are commonly supported, there may not be any good other way to make the online ticket purchase happen. Yes, credit (or effectively equivalent debit) cards without common 3-D Secure are that dominant in the US and Canada, although some people use PayPal or other local solutions too. In fact, credit and debit cards are the only way to buy online that’s routinely offered by most merchants in the US, so there’s no way to exclude non-European credit cards without excluding many US customers. And lots of US or Canadian tourists in Europe really want to use the credit cards, because the fancy cards that frequent tourists or foreign-resident Americans/Canadians use often zero out the foreign currency cost with no foreign transaction fees, and/or because of reward points offered by the cards that are better for the cardholders (at more cost to the merchants) than what’s offered by issuers in Europe. Traditional bank transfers (wire transfers) to Europe from outside the SEPA region are complicated, often slow, and expensive for both sides. Plus keep in mind, the US and Canada are not the only countries where banks don’t have to offer strong customer authentication. It’s only required in the EEA and a few other countries. So when I said “international clientele” I don’t only mean North Americans. > Also I _think_ that if merchant requires 3DSecure but bank doesn't offer it, the liability passes to the bank (i.e. BoA may decide to authorize the transaction on the card without 3DSecure - but in case of fraud, they will be the ones eating the loss, not the merchant). Not entirely sure on this one, though :) If this does apply to US-issued cards, that might be why the two US-issued cards which I routinely use in Europe have finally added the frictionless flow version of 3-D Secure. However they don’t support the kinds that actually involve the customer in a live authentication, just some fully automated checks.

virgilp 2y ago
Paypal - like Apple Pay & Google Pay - require you to authenticate into your account, which takes away the "wasn't me" deniability (if you pay _with paypal_ as opposed to "via paypal, with credit card"). It's funny you bring up tourists - because these are exactly the people who had to get cards with PIN (when their banks didn't offer them), or risk being unable to use them in Europe. So the fact that they "want to" doesn't mean that the merchants do, in fact, bend over backwards to allow them - it was the US tourists that had to adapt. So it's possible! I know the situation in US, I don't believe it's a problem of "cost" or "widespread use" (e.g. haven't heard about beggars taking credit card in the US - the card usage is far more widespread in Europe). Card fraud is not curbed in the US because there's no political will to do it, not because it's not possible or it's too expensive. If there was a PSD2-equivalent law, all banks would quickly implement it and y'all would wonder why this wasn't done sooner.
- jkaplowitz 2y ago
  > Paypal - like Apple Pay & Google Pay - require you to authenticate into your account, which takes away the "wasn't me" deniability (if you pay _with paypal_ as opposed to "via paypal, with credit card"). Yeah, but most Americans who frequently deal with foreign expenses don’t want to pay with PayPal for them, since they are much more expensive for currency conversion than the traveler-focused US credit cards, don’t give the same legal protections to the cardholder in case of merchant misbehavior or data breach, don’t get covered by cardholder benefits like insurance, and don’t give reward points like the good US cards. > It's funny you bring up tourists - because these are exactly the people who had to get cards with PIN (when their banks didn't offer them), or risk being unable to use them in Europe. So the fact that they "want to" doesn't mean that the merchants do, in fact, bend over backwards to allow them - it was the US tourists that had to adapt. So it's possible! My life is a living counterexample to what you say is necessary for US tourists in Europe. I’ve been living in Germany for over 2 years now on various short-term immigration statuses (and yes legally despite the total duration). The main way I pay for most non-invoiced expenses both online and in person is a US-issued credit card with no PIN, only frictionless-flow 3-D Secure (no life customer option), and no foreign transaction or currency conversion fee. It works fine in pretty much every case I’ve encountered in Germany where cards are accepted at all, aside from sometimes having to sign. I do pay certain expenses by SEPA bank transfer or direct debit, but mostly medical or government expenses, rent, and certain peer to peer payments. Cards with no tap to pay and no chip are a problem in Europe, but both of those are widely available in the US now. > I know the situation in US, I don't believe it's a problem of "cost" or "widespread use" (e.g. haven't heard about beggars taking credit card in the US - the card usage is far more widespread in Europe). You’re overgeneralizing about Europe and misgeneralizing about the US. Here in Germany, international cards like Visa and Mastercard were not that widely accepted before the COVID-19 pandemic, and even now most Germans don’t hold an actual credit card. Beggars certainly don’t tend to take cards in Germany, though maybe they do in some of the most cashless European countries. In the US, sure beggars don’t typically take cards there either, although I’ve heard of isolated examples of it happening. Looking overall rather than at atypical subsets like beggars, cards are indeed far more widely held in the US than in Europe, especially true credit cards but also the international type of debit card with a Visa (not Electron) or Mastercard (not Maestro) logo that can be used as if it were a credit card. If you check statistics, be sure to look up statistics on how widely cards are held (and which types), not how widely cash is used. Many US people frequently use both cards and cash. > Card fraud is not curbed in the US because there's no political will to do it, not because it's not possible or it's too expensive. Why is there no political will to do it? Yes, it’s too expensive, a little bit for the merchants but especially for the banks. US merchants simply charge high enough prices to cover high credit card processing fees that let the banks eat the fraud (and/or pay rewards to their good customers). Customers don’t mind because they’re quite strongly legally protected, and the customers who don’t benefit from credit card rewards don’t feel ripped off because the relevant portion of the merchant cost structure is built into the listed prices. Nobody with sufficient influence and awareness of the situation has an incentive to change the system. Even tap to pay was hard to get adopted in the US. Most initial attempts failed and were removed by the banks. It only became common once some major public transit systems started accepted it, and helped along by how the typical chip readers in use in the US at first were annoyingly slow. > If there was a PSD2-equivalent law, all banks would quickly implement it and y'all would wonder why this wasn't done sooner. If there were a PSD2-equivalent law, it would have a long transition period, banks or merchants would probably sue over it, there might be delays, and it might get watered down or repealed. But yes, if the banks and merchants do go along with it, a law like that would be necessary to prevent competitive disadvantage as compared to the banks and merchants that wouldn’t voluntarily choose to do it.

virgilp 2y ago

Paypal - like Apple Pay & Google Pay - require you to authenticate into your account, which takes away the "wasn't me" deniability (if you pay _with paypal_ as opposed to "via paypal, with credit card"). It's funny you bring up tourists - because these are exactly the people who had to get cards with PIN (when their banks didn't offer them), or risk being unable to use them in Europe. So the fact that they "want to" doesn't mean that the merchants do, in fact, bend over backwards to allow them - it was the US tourists that had to adapt. So it's possible! I know the situation in US, I don't believe it's a problem of "cost" or "widespread use" (e.g. haven't heard about beggars taking credit card in the US - the card usage is far more widespread in Europe). Card fraud is not curbed in the US because there's no political will to do it, not because it's not possible or it's too expensive. If there was a PSD2-equivalent law, all banks would quickly implement it and y'all would wonder why this wasn't done sooner.

jkaplowitz 2y ago
> Paypal - like Apple Pay & Google Pay - require you to authenticate into your account, which takes away the "wasn't me" deniability (if you pay _with paypal_ as opposed to "via paypal, with credit card"). Yeah, but most Americans who frequently deal with foreign expenses don’t want to pay with PayPal for them, since they are much more expensive for currency conversion than the traveler-focused US credit cards, don’t give the same legal protections to the cardholder in case of merchant misbehavior or data breach, don’t get covered by cardholder benefits like insurance, and don’t give reward points like the good US cards. > It's funny you bring up tourists - because these are exactly the people who had to get cards with PIN (when their banks didn't offer them), or risk being unable to use them in Europe. So the fact that they "want to" doesn't mean that the merchants do, in fact, bend over backwards to allow them - it was the US tourists that had to adapt. So it's possible! My life is a living counterexample to what you say is necessary for US tourists in Europe. I’ve been living in Germany for over 2 years now on various short-term immigration statuses (and yes legally despite the total duration). The main way I pay for most non-invoiced expenses both online and in person is a US-issued credit card with no PIN, only frictionless-flow 3-D Secure (no life customer option), and no foreign transaction or currency conversion fee. It works fine in pretty much every case I’ve encountered in Germany where cards are accepted at all, aside from sometimes having to sign. I do pay certain expenses by SEPA bank transfer or direct debit, but mostly medical or government expenses, rent, and certain peer to peer payments. Cards with no tap to pay and no chip are a problem in Europe, but both of those are widely available in the US now. > I know the situation in US, I don't believe it's a problem of "cost" or "widespread use" (e.g. haven't heard about beggars taking credit card in the US - the card usage is far more widespread in Europe). You’re overgeneralizing about Europe and misgeneralizing about the US. Here in Germany, international cards like Visa and Mastercard were not that widely accepted before the COVID-19 pandemic, and even now most Germans don’t hold an actual credit card. Beggars certainly don’t tend to take cards in Germany, though maybe they do in some of the most cashless European countries. In the US, sure beggars don’t typically take cards there either, although I’ve heard of isolated examples of it happening. Looking overall rather than at atypical subsets like beggars, cards are indeed far more widely held in the US than in Europe, especially true credit cards but also the international type of debit card with a Visa (not Electron) or Mastercard (not Maestro) logo that can be used as if it were a credit card. If you check statistics, be sure to look up statistics on how widely cards are held (and which types), not how widely cash is used. Many US people frequently use both cards and cash. > Card fraud is not curbed in the US because there's no political will to do it, not because it's not possible or it's too expensive. Why is there no political will to do it? Yes, it’s too expensive, a little bit for the merchants but especially for the banks. US merchants simply charge high enough prices to cover high credit card processing fees that let the banks eat the fraud (and/or pay rewards to their good customers). Customers don’t mind because they’re quite strongly legally protected, and the customers who don’t benefit from credit card rewards don’t feel ripped off because the relevant portion of the merchant cost structure is built into the listed prices. Nobody with sufficient influence and awareness of the situation has an incentive to change the system. Even tap to pay was hard to get adopted in the US. Most initial attempts failed and were removed by the banks. It only became common once some major public transit systems started accepted it, and helped along by how the typical chip readers in use in the US at first were annoyingly slow. > If there was a PSD2-equivalent law, all banks would quickly implement it and y'all would wonder why this wasn't done sooner. If there were a PSD2-equivalent law, it would have a long transition period, banks or merchants would probably sue over it, there might be delays, and it might get watered down or repealed. But yes, if the banks and merchants do go along with it, a law like that would be necessary to prevent competitive disadvantage as compared to the banks and merchants that wouldn’t voluntarily choose to do it.