5 ms·

> ZIP code: Length must be minimum 5 characters, maximum 10 characters There goes Australia and their 4 digit zip codes...

by NolF 11y ago

imrehg 11y ago
I wonder if they have customer beyond US/Canada that they mention. Otherwise this would fail spectacularly in other countries in general (eg, UK: both letters + numbers, Taiwan: 3 digit zip code)
- robinson7d 11y ago
  Canadian postal codes are both letters+numbers as well (formatted AxByCz, where A,B,C are letters, x,y,z are numbers), so UK seems like it would be safe. Too many or few characters, like you point out as the case for Taiwan, would be the problem.
mrweasel 11y ago
I don't get the name and zip code requirements, is that standard in some countries? I only ever encounter the "Name on card" when shopping on US and UK sites. Danish online stores don't care. Is the name and zip actually used as part of a validation process? If not it should just be left out.
- Symbiote 11y ago
  The article says it helps with validation, and in my experience (living in the UK) many sites ask for it. Postcodes are quite specific, they only cover around 1-30 addresses. My workplace has at least 4 postcodes to itself (different buildings). My home address shares the postcode with about 15 other houses on the same side of the road (odd numbers 1-31). Minimal British address examples: "SW1A 1AA" (Buckingham Palace), "6, M1 4EX" (could be a house).
- dchest 11y ago
  From the article: "As an extra security measure, we have to ask customers for the ZIP code associated with their card. There is a trade-off here: adding extra inputs to the form can increase bounce rates, but by adding it, our business is more secure and less prone to fraud."
  - mrweasel 11y ago
    Is the zip sent to the card processing company? Do they check that the zip matches your address? What if the customer just moved? I've implemented card payments on multiple occasions, but not once have I seen a credit card processor that offered to validate the zip code. Unless the name and zip can actually be sent to the credit card processor, and they have access to that information based on the credit card number alone, I don't see the use. Which brings up names, how fare of can your name be? I know plenty of people who wouldn't think twice about leaving out a middle name that they hate.
    - eli 11y ago
      Yes. They are asking so that it can be sent to the credit card processing and used as part of a anti-fraud algorithm. Have you implemented credit card processing yourself or used something like Stripe? It's honestly a pretty common option. At least around me in the North Eastern US, pretty much every gas pump will refuse to sell you gas if you can't provide the billing zip for the credit card.
      - mrweasel 11y ago
        We use multiple companies, all of which are "something like Stripe", to avoid dealing with PCI requirements. I've never seen any of them check zip or name, if you want added security you ask for 3D Secure/Verified by VISA. That will either require the customer to login via their online banking solution of enter the code sent to them via SMS. On of our payment providers just told us today that by August 1st. 3D Secure will be required for all online transaction in the EU. It might be later, less than one month doesn't seem like a reasonable notice. Honestly name and zip seems like something that's easily obtained by a scammer.
        eli 11y ago
        Stripe actually has a checkbox in the settings to check the zip code and address: https://support.stripe.com/questions/what-is-avs https://support.stripe.com/questions/what-is-avs I don't know how many people actually use it, but it's definitely a common option. The idea is that it would be another layer in your anti-fraud protection, not that it would replace something else.
- jimktrains2 11y ago
  http://jimkeener.com/posts/everyday-numbers-1 http://jimkeener.com/posts/everyday-numbers-1 Zip codes are used for avs checks, along with house number, not the street.
- kalleboo 11y ago
  We implemented our payments with PayPal Website Payments Pro, and we actually get back the name and address verification information and can choose to ignore it (at our own peril re chargebacks)
masklinn 11y ago
> There goes Australia and their 4 digit zip codes... To say nothing of Iceland, the Faroes or Madagascar (3 digits) let alone Jamaica (2 digits, and only in Kingston and St Andrew elsewhere there's no zip code) or Somalia (2 letters)
- david-given 11y ago
  Or Ireland, which until two days ago, didn't have postcodes at all! https://www.eircode.ie/home https://www.eircode.ie/home
spacehunt 11y ago
And as someone from a place with no "ZIP codes" or postcodes (Hong Kong): goodbye.

> ZIP code: Length must be minimum 5 characters, maximum 10 characters There goes Australia and their 4 digit zip codes...

by NolF 11y ago

> ZIP code: Length must be minimum 5 characters, maximum 10 characters There goes Australia and their 4 digit zip codes...

imrehg 11y ago

I wonder if they have customer beyond US/Canada that they mention. Otherwise this would fail spectacularly in other countries in general (eg, UK: both letters + numbers, Taiwan: 3 digit zip code)

robinson7d 11y ago
Canadian postal codes are both letters+numbers as well (formatted AxByCz, where A,B,C are letters, x,y,z are numbers), so UK seems like it would be safe. Too many or few characters, like you point out as the case for Taiwan, would be the problem.

mrweasel 11y ago

I don't get the name and zip code requirements, is that standard in some countries? I only ever encounter the "Name on card" when shopping on US and UK sites. Danish online stores don't care. Is the name and zip actually used as part of a validation process? If not it should just be left out.

Symbiote 11y ago
The article says it helps with validation, and in my experience (living in the UK) many sites ask for it. Postcodes are quite specific, they only cover around 1-30 addresses. My workplace has at least 4 postcodes to itself (different buildings). My home address shares the postcode with about 15 other houses on the same side of the road (odd numbers 1-31). Minimal British address examples: "SW1A 1AA" (Buckingham Palace), "6, M1 4EX" (could be a house).
dchest 11y ago
From the article: "As an extra security measure, we have to ask customers for the ZIP code associated with their card. There is a trade-off here: adding extra inputs to the form can increase bounce rates, but by adding it, our business is more secure and less prone to fraud."
- mrweasel 11y ago
  Is the zip sent to the card processing company? Do they check that the zip matches your address? What if the customer just moved? I've implemented card payments on multiple occasions, but not once have I seen a credit card processor that offered to validate the zip code. Unless the name and zip can actually be sent to the credit card processor, and they have access to that information based on the credit card number alone, I don't see the use. Which brings up names, how fare of can your name be? I know plenty of people who wouldn't think twice about leaving out a middle name that they hate.
  - eli 11y ago
    Yes. They are asking so that it can be sent to the credit card processing and used as part of a anti-fraud algorithm. Have you implemented credit card processing yourself or used something like Stripe? It's honestly a pretty common option. At least around me in the North Eastern US, pretty much every gas pump will refuse to sell you gas if you can't provide the billing zip for the credit card.
    - mrweasel 11y ago
      We use multiple companies, all of which are "something like Stripe", to avoid dealing with PCI requirements. I've never seen any of them check zip or name, if you want added security you ask for 3D Secure/Verified by VISA. That will either require the customer to login via their online banking solution of enter the code sent to them via SMS. On of our payment providers just told us today that by August 1st. 3D Secure will be required for all online transaction in the EU. It might be later, less than one month doesn't seem like a reasonable notice. Honestly name and zip seems like something that's easily obtained by a scammer.
      - eli 11y ago
        Stripe actually has a checkbox in the settings to check the zip code and address: https://support.stripe.com/questions/what-is-avs https://support.stripe.com/questions/what-is-avs I don't know how many people actually use it, but it's definitely a common option. The idea is that it would be another layer in your anti-fraud protection, not that it would replace something else.
jimktrains2 11y ago
http://jimkeener.com/posts/everyday-numbers-1 http://jimkeener.com/posts/everyday-numbers-1 Zip codes are used for avs checks, along with house number, not the street.
kalleboo 11y ago
We implemented our payments with PayPal Website Payments Pro, and we actually get back the name and address verification information and can choose to ignore it (at our own peril re chargebacks)

masklinn 11y ago

> There goes Australia and their 4 digit zip codes... To say nothing of Iceland, the Faroes or Madagascar (3 digits) let alone Jamaica (2 digits, and only in Kingston and St Andrew elsewhere there's no zip code) or Somalia (2 letters)

david-given 11y ago
Or Ireland, which until two days ago, didn't have postcodes at all! https://www.eircode.ie/home https://www.eircode.ie/home

spacehunt 11y ago

And as someone from a place with no "ZIP codes" or postcodes (Hong Kong): goodbye.