6 ms·

Damn it i want two way verification on any purchase over X amount! Meaning anytime a charge over X amount (an amount i set) tries to go thru I get a text messa

Damn it i want two way verification on any purchase over X amount! Meaning anytime a charge over X amount (an amount i set) tries to go thru I get a text message asking for me to approve or deny it. This is getting ridiculous! 1st Adobe who I will never do business with again (had to cancel my accounts & open new ones) and now Target!

objclxt 13y ago
Although it's not two-factor, some banks will send you push messages or texts for every transaction taking place on the card. I use Simple, they do the former. One nice feature about Simple is you can disable the debit card directly from within the app, and then re-enable it if you need to (for example, if you lose your wallet temporarily). Simple also sent me a new debit card automatically without prompting, their systems having noticed I'd shopped at Target last week. The problem with the two factor system as you describe is that while it works for 'cardholder not present' transactions (and there already exist standard two-factor methods for such payments, not that many banks use them), it would make retail POS payments incredibly slow. You'd have to wait for a text/push, you might not have any reception, then you've got to reply, etc. This is one reason why EMV is, for all its failings, more attractive than mag-stripe: it is considerably harder and more expensive to clone EMV cards.
- toomuchtodo 13y ago
  +1 for Simple. I LOVE the transaction push notification feature, as well as the enable/disabled card functionality in-app.
- panarky 13y ago
  You don't need to wait for a text or push notification, and you don't have to be online. Just use a time-based one-time password. It's instant, secure, and simple. And already available free in Google Authenticator. https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_A... http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/
philwelch 13y ago
So it's closing time at the bar, everyone who's left at 2 AM is probably drunk, they're all closing out at the same time, and you want them to have to fish out their phones and correctly respond to a challenge/response SMS before they're ushered out the door? Sorry, this sounds like a nightmare to implement.
- w1ntermute 13y ago
  It doesn't have to be on by default. Just make it an option, so that those of us who don't get shitfaced on a regular basis can safeguard our credit cards.
  - philwelch 13y ago
    I find that response insufficient, not to mention insufferably smug. You can't control when other people leave it turned on, merchants can't control when their customers have it turned on, and there are cases where people spend large enough amounts of money to worry about, get bottlenecked at checkout, and for whatever reason might not do a great job at smoothly handling SMS challenge/response. If having an expensive night out at the bar is too déclassé for you, how about the Christmas shopping rush at a high end department store that has shitty wireless reception? Just because a solution solves your use case doesn't mean it's a good idea. The fact is, this would be a total nightmare to bars and B&M retail establishments, to name two examples, and any significant change to the credit card system requires merchants to be on board. The best solution for customers is still chargebacks. Unfortunately, merchants still have to eat the cost when a chargeback happens, which is why security provisions like chip and PIN typically come with the revocation of chargeback privileges. But if merchants are the ones driving these security features, they have absolutely no reason to go along with something that creates a worse experience for them.
    - paul9290 13y ago
      hey it would no doubt stop billions of dollars being stolen. Also, if you have this enabled, your purchase doesn't go through until you approve the charge. As for wireless reception... 4G & 3G solves that as it justs a text message going through. Further banks who offer this could set a high default amount like $500 and the end user could change it to something higher. Further, further as noted by another here, the user has the ability to enable this or not. If you know you are a irresponsible drinker then this would not be a solution for you. Also, if your passed out drunk how are you going to pay your bill anyway? This is something I want after being hacked and a solution that would suit my needs and many others who choose it. Anyone have any other solutions?
ugexe 13y ago
Yeah just what I want, to wait behind some slow old person to figure out how to authorize their purchase.
seanmcdirmid 13y ago
> Damn it i want two way verification on any purchase over X amount! Meaning anytime a charge over X amount (an amount i set) tries to go thru I get a text message asking for me to approve or deny it I generally agree, but it would suck if I'm travelling and my phone isn't roaming.

objclxt 13y ago

Although it's not two-factor, some banks will send you push messages or texts for every transaction taking place on the card. I use Simple, they do the former. One nice feature about Simple is you can disable the debit card directly from within the app, and then re-enable it if you need to (for example, if you lose your wallet temporarily). Simple also sent me a new debit card automatically without prompting, their systems having noticed I'd shopped at Target last week. The problem with the two factor system as you describe is that while it works for 'cardholder not present' transactions (and there already exist standard two-factor methods for such payments, not that many banks use them), it would make retail POS payments incredibly slow. You'd have to wait for a text/push, you might not have any reception, then you've got to reply, etc. This is one reason why EMV is, for all its failings, more attractive than mag-stripe: it is considerably harder and more expensive to clone EMV cards.

toomuchtodo 13y ago
+1 for Simple. I LOVE the transaction push notification feature, as well as the enable/disabled card functionality in-app.
panarky 13y ago
You don't need to wait for a text or push notification, and you don't have to be online. Just use a time-based one-time password. It's instant, secure, and simple. And already available free in Google Authenticator. https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm https://en.wikipedia.org/wiki/Time-based_One-time_Password_A... http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/

philwelch 13y ago

So it's closing time at the bar, everyone who's left at 2 AM is probably drunk, they're all closing out at the same time, and you want them to have to fish out their phones and correctly respond to a challenge/response SMS before they're ushered out the door? Sorry, this sounds like a nightmare to implement.

w1ntermute 13y ago
It doesn't have to be on by default. Just make it an option, so that those of us who don't get shitfaced on a regular basis can safeguard our credit cards.
- philwelch 13y ago
  I find that response insufficient, not to mention insufferably smug. You can't control when other people leave it turned on, merchants can't control when their customers have it turned on, and there are cases where people spend large enough amounts of money to worry about, get bottlenecked at checkout, and for whatever reason might not do a great job at smoothly handling SMS challenge/response. If having an expensive night out at the bar is too déclassé for you, how about the Christmas shopping rush at a high end department store that has shitty wireless reception? Just because a solution solves your use case doesn't mean it's a good idea. The fact is, this would be a total nightmare to bars and B&M retail establishments, to name two examples, and any significant change to the credit card system requires merchants to be on board. The best solution for customers is still chargebacks. Unfortunately, merchants still have to eat the cost when a chargeback happens, which is why security provisions like chip and PIN typically come with the revocation of chargeback privileges. But if merchants are the ones driving these security features, they have absolutely no reason to go along with something that creates a worse experience for them.
  - paul9290 13y ago
    hey it would no doubt stop billions of dollars being stolen. Also, if you have this enabled, your purchase doesn't go through until you approve the charge. As for wireless reception... 4G & 3G solves that as it justs a text message going through. Further banks who offer this could set a high default amount like $500 and the end user could change it to something higher. Further, further as noted by another here, the user has the ability to enable this or not. If you know you are a irresponsible drinker then this would not be a solution for you. Also, if your passed out drunk how are you going to pay your bill anyway? This is something I want after being hacked and a solution that would suit my needs and many others who choose it. Anyone have any other solutions?

ugexe 13y ago

Yeah just what I want, to wait behind some slow old person to figure out how to authorize their purchase.

seanmcdirmid 13y ago

> Damn it i want two way verification on any purchase over X amount! Meaning anytime a charge over X amount (an amount i set) tries to go thru I get a text message asking for me to approve or deny it I generally agree, but it would suck if I'm travelling and my phone isn't roaming.