4 ms·

How "immoral" is it really, facilitating the sale of stolen CC info? Clearly, it is a bad thing to do. But it seems to me that the CC companies are at least as

by woah 12y ago

How "immoral" is it really, facilitating the sale of stolen CC info? Clearly, it is a bad thing to do. But it seems to me that the CC companies are at least as much to blame for having such a crappy system. Anti-fraud is one of the few things that they can point at as justifying their exorbitant fees for sending a couple of packets. The fact is, their system allows fraud and they are not doing anything about it.

anigbrowl 12y ago
Theya re doing something about it, which is why chip-and-pin will become the norm in the Us in the next couple of years. From October 2015 liability falls on whoever is the weakest link in the security chain, so get used to online vendors demanding a lot more personal info from you so they don't get left holding the bag.
- x0x0 12y ago
  How does chip and pin help with card not present transactions?
- rgbrenner 12y ago
  >From October 2015 liability falls on whoever is the weakest link in the security chain, so get used to online vendors demanding a lot more personal info from you so they don't get left holding the bag. Merchants are already 'holding the bag'... if they accept a fraudulent card for an order, the bank simply reverses the charge (and the merchant eats whatever they lost filling the order). So how does this change anything?
  - anigbrowl 12y ago
    Incorrect. See page 10. http://www.firstdata.com/downloads/thought-leadership/EMV_US.pdf http://www.firstdata.com/downloads/thought-leadership/EMV_US...
    - firepacket 12y ago
      > Currently, POS counterfeit fraud is largely absorbed by card issuers. It's a lie. Why do you think so many stores ask to see ID? From what I've seen, the accepting merchant account is always debited for every chargeback and the card issuers rarely bear any burden from fraud.
    - deleted 12y ago
      [deleted]
    - deleted 12y ago
      [deleted]
    - rgbrenner 12y ago
      POS counterfeit fraud is one type of fraud.. but it's hardly all fraud, and it doesn't apply to online transactions (there's no POS involved in an online transaction). If chip and pin gets anywhere in the US, it'll be because of association requirements, not because they've pushed responsibility for one minute type of fraud on to merchants.
Touche 12y ago
> How "immoral" is it really, facilitating the sale of stolen CC info? Very.
pavel_lishin 12y ago
Given that stolen credit cards create a lot of headaches for the people who actually use the credit cards, I'd say it's pretty immoral. (Yes, yes, the CC companies are on the hook for it, and you're not liable for any money charged to a stolen card, etc., etc., but it doesn't make it pleasant. It's stressful.)
- ultramancool 12y ago
  > (Yes, yes, the CC companies are on the hook for it, and you're not liable for any money charged to a stolen card, etc., etc., but it doesn't make it pleasant. It's stressful.) I think this really depends on who you are. I find it pretty entertaining every time and enjoy trying to figure out where it was, knowing full well I just bitch at the bank and have little to no issue replacing the card.
- desdiv 12y ago
  the CC companies are on the hook for it The CC companies pass it down to the retailers in terms of transaction fees, who in turn pass it down to the consumers. It doesn't matter whether your card gets stolen or not. It doesn't matter whether you even have a credit card or not. Everyone is paying for the cost of credit card fraud in one way or another. Even people who only pay with cash still bear the burden of credit card fraud, since they're still paying the credit-card-fee-inclusive price (unless they only shop at retailers with cash discounts).
  - firepacket 12y ago
    It's not even in the form of transaction fees. Fraudulent charges are withdrawn from the retailers. Even if it has already posted to the bank account, they will take it back. The CC companies never absorb the cost for fraud. Their greatest trick is convincing everyone they do.
- gwern 12y ago
  > the CC companies are on the hook for it In the end, consumers and businesses are on the hook for it.
csommers 12y ago
It's pretty immoral in the grand scheme of things, as the costs are incurred by ALL consumers, regardless if they pay via CC or cash. Yes, CC companies can do a better job of mitigating risk, but it's hardly a case to blame "only" them for this.
- woah 12y ago
  I'm sorry if this is an unpopular opinion on here, but the CC companies are equally as culpable for this as any dark market.
  - logfromblammo 12y ago
    I'd say they are more culpable. They have created a payments system that demands that merchants trust them without reservation, and failed to back that up with technology that makes them unassailably trustworthy. Then, when the fraud inevitably occurs--the crime as old as money itself--the credit card provider disclaims responsibility and places the onus upon the merchant. The banking industry should arguably be a larger employer of top-tier cryptographers and cryptanalysts than the espionage and counter-espionage industry, but instead we get half-assed schemes from them like "How about we just print a secret code on the back of the card and don't write it to the magnetic strip?" Well, your helpful waiter then just swipes the card with his skimmer and photographs both sides before selling the info down the chain of fraud. This is why new tech like digital blockchain currencies are coming into existence. The banks simply are not providing the level of service commensurate with the fees charged, and people are latching on to any available alternative, no matter how much it stinks, just because it is an alternative. Paypal, hawala, eGold, Bitcoin, Rixty, or whatever. People simply don't want to be vulnerable to a replay attack on their bank accounts. The market for credit card numbers and associated personal data would not exist if the issuers had a truly secure means of validating identity and authorizing payments instead of the hand-wavey pretend-secure system they already have in place on thousands of point-of-sale terminals.
innguest 12y ago
What is immoral is all the regulation around it that forbids new credit card companies from entering the playing field. That's why now, instead of the existing companies fixing the mechanisms that allow for fraud to take place, they can afford to ignore that market signal (that their product has a bug) by forcing their customers to pay for it (the retailers, who in turn force their customers, us, to pay for it). This is how, in very real terms, the lack of competition literally hurts everyone, by making everyone pay for thieves, instead of making just incompetent private companies (trying to compete in this market) pay for it.

by woah 12y ago

anigbrowl 12y ago

Theya re doing something about it, which is why chip-and-pin will become the norm in the Us in the next couple of years. From October 2015 liability falls on whoever is the weakest link in the security chain, so get used to online vendors demanding a lot more personal info from you so they don't get left holding the bag.

x0x0 12y ago
How does chip and pin help with card not present transactions?
rgbrenner 12y ago
>From October 2015 liability falls on whoever is the weakest link in the security chain, so get used to online vendors demanding a lot more personal info from you so they don't get left holding the bag. Merchants are already 'holding the bag'... if they accept a fraudulent card for an order, the bank simply reverses the charge (and the merchant eats whatever they lost filling the order). So how does this change anything?
- anigbrowl 12y ago
  Incorrect. See page 10. http://www.firstdata.com/downloads/thought-leadership/EMV_US.pdf http://www.firstdata.com/downloads/thought-leadership/EMV_US...
  - firepacket 12y ago
    > Currently, POS counterfeit fraud is largely absorbed by card issuers. It's a lie. Why do you think so many stores ask to see ID? From what I've seen, the accepting merchant account is always debited for every chargeback and the card issuers rarely bear any burden from fraud.
  - deleted 12y ago
    [deleted]
  - deleted 12y ago
    [deleted]
  - rgbrenner 12y ago
    POS counterfeit fraud is one type of fraud.. but it's hardly all fraud, and it doesn't apply to online transactions (there's no POS involved in an online transaction). If chip and pin gets anywhere in the US, it'll be because of association requirements, not because they've pushed responsibility for one minute type of fraud on to merchants.

Touche 12y ago

> How "immoral" is it really, facilitating the sale of stolen CC info? Very.

pavel_lishin 12y ago

Given that stolen credit cards create a lot of headaches for the people who actually use the credit cards, I'd say it's pretty immoral. (Yes, yes, the CC companies are on the hook for it, and you're not liable for any money charged to a stolen card, etc., etc., but it doesn't make it pleasant. It's stressful.)

ultramancool 12y ago
> (Yes, yes, the CC companies are on the hook for it, and you're not liable for any money charged to a stolen card, etc., etc., but it doesn't make it pleasant. It's stressful.) I think this really depends on who you are. I find it pretty entertaining every time and enjoy trying to figure out where it was, knowing full well I just bitch at the bank and have little to no issue replacing the card.
desdiv 12y ago
the CC companies are on the hook for it The CC companies pass it down to the retailers in terms of transaction fees, who in turn pass it down to the consumers. It doesn't matter whether your card gets stolen or not. It doesn't matter whether you even have a credit card or not. Everyone is paying for the cost of credit card fraud in one way or another. Even people who only pay with cash still bear the burden of credit card fraud, since they're still paying the credit-card-fee-inclusive price (unless they only shop at retailers with cash discounts).
- firepacket 12y ago
  It's not even in the form of transaction fees. Fraudulent charges are withdrawn from the retailers. Even if it has already posted to the bank account, they will take it back. The CC companies never absorb the cost for fraud. Their greatest trick is convincing everyone they do.
gwern 12y ago
> the CC companies are on the hook for it In the end, consumers and businesses are on the hook for it.

csommers 12y ago

It's pretty immoral in the grand scheme of things, as the costs are incurred by ALL consumers, regardless if they pay via CC or cash. Yes, CC companies can do a better job of mitigating risk, but it's hardly a case to blame "only" them for this.

woah 12y ago
I'm sorry if this is an unpopular opinion on here, but the CC companies are equally as culpable for this as any dark market.
- logfromblammo 12y ago
  I'd say they are more culpable. They have created a payments system that demands that merchants trust them without reservation, and failed to back that up with technology that makes them unassailably trustworthy. Then, when the fraud inevitably occurs--the crime as old as money itself--the credit card provider disclaims responsibility and places the onus upon the merchant. The banking industry should arguably be a larger employer of top-tier cryptographers and cryptanalysts than the espionage and counter-espionage industry, but instead we get half-assed schemes from them like "How about we just print a secret code on the back of the card and don't write it to the magnetic strip?" Well, your helpful waiter then just swipes the card with his skimmer and photographs both sides before selling the info down the chain of fraud. This is why new tech like digital blockchain currencies are coming into existence. The banks simply are not providing the level of service commensurate with the fees charged, and people are latching on to any available alternative, no matter how much it stinks, just because it is an alternative. Paypal, hawala, eGold, Bitcoin, Rixty, or whatever. People simply don't want to be vulnerable to a replay attack on their bank accounts. The market for credit card numbers and associated personal data would not exist if the issuers had a truly secure means of validating identity and authorizing payments instead of the hand-wavey pretend-secure system they already have in place on thousands of point-of-sale terminals.

innguest 12y ago

What is immoral is all the regulation around it that forbids new credit card companies from entering the playing field. That's why now, instead of the existing companies fixing the mechanisms that allow for fraud to take place, they can afford to ignore that market signal (that their product has a bug) by forcing their customers to pay for it (the retailers, who in turn force their customers, us, to pay for it). This is how, in very real terms, the lack of competition literally hurts everyone, by making everyone pay for thieves, instead of making just incompetent private companies (trying to compete in this market) pay for it.