7 ms·

The way credit cards are designed should be illegal. They are basically a piece of plain text that can be used by anyone to purchase things from someone's accou

The way credit cards are designed should be illegal. They are basically a piece of plain text that can be used by anyone to purchase things from someone's account. It's basically the worst security you could possibly have for one of the highest-risk systems (direct access to money) that exist. People need to be angry at the credit card industry for designing such an insecure system, not Target. There are plenty of online payment systems that work far, far better than credit cards that cannot, by design, ever have user account information stolen from a retailer.

MichaelGG 13y ago
How is it bad security? As a consumer, there's practically no issue. Data mining for fraud detection is pushed off onto the card provider - not my problem. There's no "direct access to money". It's a bill from a service provider that I can easily dispute. At worst, it's a slight inconvenience if my CC info is compromised.
- mathattack 13y ago
  Exactly. And fraud is low enough that they're happy to do this.
- cheald 13y ago
  Well, maybe we should talk about debit cards, which are functionally identical. The Target breach included theft of PINs - a purchase made with your debit card plus PIN is on you, not on a CC company.
  - MichaelGG 13y ago
    Debit cards are terrible for this reason. And as I understand, chip-and-PIN models also start moving the security onto the consumer. Nice for merchants, crappy for consumers.
    - jarek 13y ago
      Get back to us when there's a major practical breach of a chip-and-PIN system and consumers aren't compensated.
      - cdcarter 13y ago
        "It's okay that the protections we are used to being afforded aren't afforded to us anymore, because this system hasn't been hacked yet."
        jarek 13y ago
        No. Because when this system is hacked, protections will be afforded to us. Can you even imagine the media storm in the EU or some other similarly consumer-friendly location if the evil American corporations don't compensate consumers for fraud of no fault of their own like they used to? Millions of people would mail in their cards. This is simply not going to happen. I'm in Canada and a colleague had her wallet stolen from a locked car, PIN changed over the phone (that's a whole another subject) and purchases made. Faced with a police report confirming the story and possibility of bad press, you think the processor, the issuer, and the merchant won't budge? They budged.
        cdcarter 13y ago
        Then, if they are going to afford the protections anyway -- they should afford them in writing and contractually. This way, they could only partially refund and say that we're lucky to get anything at all.
        MichaelGG 13y ago
        >They budged See, with the current system, there's no need for "budging". Several times I've had unauthorized charges show up (both Visa and Amex). A quick call, and it's sorted out. If you've got to invoke the possibility of bad press, that sounds absolutely worse for the consumer.
        13y ago
  - ansible 13y ago
    And that's why I only ever have used debit cards for banking, and never for purchases.
jessaustin 13y ago
There are plenty of online payment systems that work far, far better than credit cards that cannot, by design, ever have user account information stolen from a retailer. Why doesn't Target use those payment systems? Wait, I think I know... because their customers don't use those payment systems. Are you saying that customers should "be angry at" themselves? It has been years since I've used a credit card at a big-box store. They all still take cash.
- Guvante 13y ago
  > People need to be angry at the credit card industry for designing such an insecure system, not Target. He explicitly said the blame doesn't lie on Target. Payments systems are a chicken and egg problem, however you would think the entity that feels the most pain from credit card fraud would try harder to replace the broken system.
  - rqebmm 13y ago
    Exactly! Except the entity that feels the most pain isn't the credit card companies or the banks. It's typically the retailer or the payment portal.
    - Guvante 13y ago
      That was actually my point. I am surprised retailers aren't making more of a stink about how insecure payment processing is given they are on the line for fraud 9 times out of 10.
ars 13y ago
Ever heard of worse is better? This simple method works fine. The amount of fraud is not enough to make switching worth it. (And don't forget credit cards need to work even without persistent data connection.)
sliverstorm 13y ago
What system, exactly?
GFK_of_xmaspast 13y ago
Yeah but the cool thing about credit cards is : consumer protection laws.
cynwoody 13y ago
What you say is true. However, it doesn't really matter. Despite all the hue and cry, credit card fraud losses run in the single-digit basis point range as a fraction of transaction volume and around 1.2% as a fraction of issuer expenses.† Losses due to uncollectible debt (the "charge-off rate") are much higher, at around three or four percent in 2013 (but 10.9% in the second quarter of 2010).†† The pain point isn't financial. It's the bad publicity when breaches occur and the nagging fear is that losses could suddenly get out of hand due to some unanticipated vulnerability. †http://web.archive.org/web/20091229101826/http://www.sas.com/news/analysts/mercator_fraud_1208.pdf http://web.archive.org/web/20091229101826/http://www.sas.com... ††http://www.federalreserve.gov/releases/chargeoff/chgallsa.htm http://www.federalreserve.gov/releases/chargeoff/chgallsa.ht...
- fragsworth 13y ago
  So this means we're effectively all paying 1.2% extra (indirectly through retailer's credit card fees) to accept these fraud losses. But you have to add to that some amount for overhead of dealing with fraud reports, and the expense of required security practices in order to be PCI compliant, which is entirely a result of the plain-text nature of credit cards. It probably results in 1.5-2% extra to all purchases, entirely hidden to consumers. And, from your own citation, on average, 10% of Americans are victims of credit card fraud and 7% of debit card fraud - this probably results in about 16% of Americans total if you assume both groups are random samples of the population. If you've ever dealt with credit card fraud, you'd know that it's an ordeal that can be a huge pain in the ass. It can take many hours of your own time, and time from your card issuer. The cost isn't just directly financial, it's the overhead that comes as a result of the fraud. I am certain that if given the choice, nearly everyone would take a 1.5% discount on all of their purchases if they had to do two-factor authentication on all of them in exchange.
  - cynwoody 13y ago
    My point is that the fraud losses are so far not heavy enough to move the payment processing industry off the dime towards a really secure solution. A secure system might use your phone as its platform. E.g., the merchant's POS presents the bill to your phone via Bluetooth. If you approve, your phone prepares a payment request, encrypts it with the bank's public key, and sends it back to the POS. The POS then forwards it to the payment processor and receives back a message accepting or declining the charge. Elapsed time: one or two seconds. The obvious hurdle is winning acceptance for the new protocol and outfitting a zillion POS terminals all over the country and world to run it.
watty 13y ago
Why should I be angry? My credit card has been comprimised twice in my life and both times my credit card company contacted me immediately (before I even noticed) and refunded all fraudelent transactions immediately. I didn't have to do anything. Credit card companies should be pissed at themselves for making it this easy.
ams6110 13y ago
Your checking account is just as insecure. All that's needed to debit your checking account is your bank's routing number (which is public) and your account number. No PIN, nothing else.
akira2501 13y ago
It's a design that's iterated over many decades, and it hasn't always been easy for them; the payment network is huge. Plus, if you think security is bad now, remember that before this we were writing checks for most transactions. At least with credit cards I can discover fraud usually the same day it occurs, and they are far more convenient that checks ever were -- as someone who has used both, I'm not all that bothered by the current state of the system.

MichaelGG 13y ago

How is it bad security? As a consumer, there's practically no issue. Data mining for fraud detection is pushed off onto the card provider - not my problem. There's no "direct access to money". It's a bill from a service provider that I can easily dispute. At worst, it's a slight inconvenience if my CC info is compromised.

mathattack 13y ago
Exactly. And fraud is low enough that they're happy to do this.
cheald 13y ago
Well, maybe we should talk about debit cards, which are functionally identical. The Target breach included theft of PINs - a purchase made with your debit card plus PIN is on you, not on a CC company.
- MichaelGG 13y ago
  Debit cards are terrible for this reason. And as I understand, chip-and-PIN models also start moving the security onto the consumer. Nice for merchants, crappy for consumers.
  - jarek 13y ago
    Get back to us when there's a major practical breach of a chip-and-PIN system and consumers aren't compensated.
    - cdcarter 13y ago
      "It's okay that the protections we are used to being afforded aren't afforded to us anymore, because this system hasn't been hacked yet."
      - jarek 13y ago
        No. Because when this system is hacked, protections will be afforded to us. Can you even imagine the media storm in the EU or some other similarly consumer-friendly location if the evil American corporations don't compensate consumers for fraud of no fault of their own like they used to? Millions of people would mail in their cards. This is simply not going to happen. I'm in Canada and a colleague had her wallet stolen from a locked car, PIN changed over the phone (that's a whole another subject) and purchases made. Faced with a police report confirming the story and possibility of bad press, you think the processor, the issuer, and the merchant won't budge? They budged.
        cdcarter 13y ago
        Then, if they are going to afford the protections anyway -- they should afford them in writing and contractually. This way, they could only partially refund and say that we're lucky to get anything at all.
        MichaelGG 13y ago
        >They budged See, with the current system, there's no need for "budging". Several times I've had unauthorized charges show up (both Visa and Amex). A quick call, and it's sorted out. If you've got to invoke the possibility of bad press, that sounds absolutely worse for the consumer.
        13y ago
- ansible 13y ago
  And that's why I only ever have used debit cards for banking, and never for purchases.

jessaustin 13y ago

There are plenty of online payment systems that work far, far better than credit cards that cannot, by design, ever have user account information stolen from a retailer. Why doesn't Target use those payment systems? Wait, I think I know... because their customers don't use those payment systems. Are you saying that customers should "be angry at" themselves? It has been years since I've used a credit card at a big-box store. They all still take cash.

Guvante 13y ago
> People need to be angry at the credit card industry for designing such an insecure system, not Target. He explicitly said the blame doesn't lie on Target. Payments systems are a chicken and egg problem, however you would think the entity that feels the most pain from credit card fraud would try harder to replace the broken system.
- rqebmm 13y ago
  Exactly! Except the entity that feels the most pain isn't the credit card companies or the banks. It's typically the retailer or the payment portal.
  - Guvante 13y ago
    That was actually my point. I am surprised retailers aren't making more of a stink about how insecure payment processing is given they are on the line for fraud 9 times out of 10.

ars 13y ago

Ever heard of worse is better? This simple method works fine. The amount of fraud is not enough to make switching worth it. (And don't forget credit cards need to work even without persistent data connection.)

sliverstorm 13y ago

What system, exactly?

GFK_of_xmaspast 13y ago

Yeah but the cool thing about credit cards is : consumer protection laws.

cynwoody 13y ago

What you say is true. However, it doesn't really matter. Despite all the hue and cry, credit card fraud losses run in the single-digit basis point range as a fraction of transaction volume and around 1.2% as a fraction of issuer expenses.† Losses due to uncollectible debt (the "charge-off rate") are much higher, at around three or four percent in 2013 (but 10.9% in the second quarter of 2010).†† The pain point isn't financial. It's the bad publicity when breaches occur and the nagging fear is that losses could suddenly get out of hand due to some unanticipated vulnerability. †http://web.archive.org/web/20091229101826/http://www.sas.com/news/analysts/mercator_fraud_1208.pdf http://web.archive.org/web/20091229101826/http://www.sas.com... ††http://www.federalreserve.gov/releases/chargeoff/chgallsa.htm http://www.federalreserve.gov/releases/chargeoff/chgallsa.ht...

fragsworth 13y ago
So this means we're effectively all paying 1.2% extra (indirectly through retailer's credit card fees) to accept these fraud losses. But you have to add to that some amount for overhead of dealing with fraud reports, and the expense of required security practices in order to be PCI compliant, which is entirely a result of the plain-text nature of credit cards. It probably results in 1.5-2% extra to all purchases, entirely hidden to consumers. And, from your own citation, on average, 10% of Americans are victims of credit card fraud and 7% of debit card fraud - this probably results in about 16% of Americans total if you assume both groups are random samples of the population. If you've ever dealt with credit card fraud, you'd know that it's an ordeal that can be a huge pain in the ass. It can take many hours of your own time, and time from your card issuer. The cost isn't just directly financial, it's the overhead that comes as a result of the fraud. I am certain that if given the choice, nearly everyone would take a 1.5% discount on all of their purchases if they had to do two-factor authentication on all of them in exchange.
- cynwoody 13y ago
  My point is that the fraud losses are so far not heavy enough to move the payment processing industry off the dime towards a really secure solution. A secure system might use your phone as its platform. E.g., the merchant's POS presents the bill to your phone via Bluetooth. If you approve, your phone prepares a payment request, encrypts it with the bank's public key, and sends it back to the POS. The POS then forwards it to the payment processor and receives back a message accepting or declining the charge. Elapsed time: one or two seconds. The obvious hurdle is winning acceptance for the new protocol and outfitting a zillion POS terminals all over the country and world to run it.

watty 13y ago

Why should I be angry? My credit card has been comprimised twice in my life and both times my credit card company contacted me immediately (before I even noticed) and refunded all fraudelent transactions immediately. I didn't have to do anything. Credit card companies should be pissed at themselves for making it this easy.

ams6110 13y ago

Your checking account is just as insecure. All that's needed to debit your checking account is your bank's routing number (which is public) and your account number. No PIN, nothing else.

akira2501 13y ago

It's a design that's iterated over many decades, and it hasn't always been easy for them; the payment network is huge. Plus, if you think security is bad now, remember that before this we were writing checks for most transactions. At least with credit cards I can discover fraud usually the same day it occurs, and they are far more convenient that checks ever were -- as someone who has used both, I'm not all that bothered by the current state of the system.