Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Do we need to pay billions in fees to Stripe, Block, PayPal and Visa/MC?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 377 posts

Re: Ask HN: Do we need to pay billions in fees to Stripe, Block, PayPal and Visa/MC?

#101

Post by Nextgrid »

Deathmax wrote: post #88
margalabargala wrote: post #66

Earlier quoted context omitted.

I understand that Europe is more secure with chip+pin, but in the US, debit cards do exactly what you describe. If fraud happens, you are out money until it is resolved. The key difference from cash, in the US, is the ability to abuse cards at a later date without the physical card. For someone to steal your wallet, they have to be colocated with you and can only steal as much as you're walking around with. As long a…

> As long as debit cards have a magnetic stripe and have their full number printed on them, and that information is useful, this problem remains. Which the EEA/UK has also (partially) solved by enforcing Strong Customer Authentication (SCA) that mandates that (most) transactions require MFA.

I don’t believe SCA is enforced by the bank. It’s voluntary by the merchant. It acts as a liability shift but won’t save you from someone not caring about it and emptying your account (temporarily until the chargeback goes though). I don’t think any bank offers an option of “allow SCA-only transactions” and I don’t think it would be even possible (I’m not sure there is any token/session identifier to tie the SCA request and the actual subsequent transaction even).

When adding a card to a taxi app for example I get SCA prompt for a zero amount, but then they can charge me for any amount without subsequent SCA flows.

Presumably those subsequent transactions wouldn’t have a liability shift to the issuer but it still means that they can at least temporarily steal all your money until your chargeback claim goes through.

The whole concept of “card number” is rotten. What’s needed is an oAuth2-type system where every payment needs to redirect to the bank (actual redirect, no stupid hacky iframe like SCA/3DSecure is) and where you can see the merchant and set the max amount (and whether one-off or recurring) and the bank records that and keeps a list of authorized merchants so you can revoke them at any time. The merchant then must use this token to pull money, and can't pull more than what the token allows - just like your usual oAuth2 scopes.

Re: Ask HN: Do we need to pay billions in fees to Stripe, Block, PayPal and Visa/MC?

#102

Post by tonyarkles »

thesausageking wrote: post #39
oldprogrammer2 wrote: post #9

Stripe, Block, and PayPal each solved a massive pain point. PayPal provided a way to pay people and vendors without giving away your credit card number. Square made it easy to accept payment in person on a phone, without an extensive upfront underwriting experience and without expensive fixed monthly fees. Stripe did the same as Square, but for accepting online payments. Fraud and Risk come in many forms, and these p…

The challenger to these will solve for a different problem. Not every transaction needs complex fraud detection or being able for the customer do to chargebacks. For a 3% discount, would customers agree to use something that worked just like cash, where the transfer was instant and couldn't be undone? Then you don't have to worry about fraud, chargebacks, etc.

There's an issue that you're not addressing: what happens when someone who isn't me spends my money? I think people would be happy for the theoretical 3% discount until their account is drained and sent to North Korea with no recourse.

Re: Ask HN: Do we need to pay billions in fees to Stripe, Block, PayPal and Visa/MC?

#103

Post by oneplane »

konschubert wrote: post #99
oneplane wrote: post #98

Earlier quoted context omitted.

What he's saying is that you (konschubert) involved VISA in the transaction. And since VISA is a paid service, you were charged. As for why you involved them, that is the actual issue at hand, because it's a choice, not something that was forced upon you. But the choice isn't the first one that comes to mind; the choice was between protecting consumers or protecting corporations. And in the US, corporations are bette…

And what I (konschubert) am saying is: I would like to have more choices, as a customer and especially as a merchant, so I don’t have to pay visa 3% next time. And I think this means there is opportunity for disruption.

Creating those choices requires societal adjustment. It is not something that can be manufactured by a market, and as such is the purpose of government. Many examples of this exist in production all over the world, with high degrees of success.

Re: Ask HN: Do we need to pay billions in fees to Stripe, Block, PayPal and Visa/MC?

#104

Post by tonyarkles »

abakker wrote: post #97
dkasper wrote: post #87

Earlier quoted context omitted.

Absolutely not true. Some places still don’t even take tap to pay and still use chip.

Yes - for example, Home Depot does not take tap payments yet.

This is something I find so fascinating about the American financial system... Home Depot in Canada has taken tap payments and Apple Pay for a long time now.

Re: Ask HN: Do we need to pay billions in fees to Stripe, Block, PayPal and Visa/MC?

#105

Post by welder »

abakker wrote: post #97
dkasper wrote: post #87

Earlier quoted context omitted.

Absolutely not true. Some places still don’t even take tap to pay and still use chip.

Yes - for example, Home Depot does not take tap payments yet.

Home Depot only exists in the USA. I was talking about EU where tap is everywhere.

Re: Ask HN: Do we need to pay billions in fees to Stripe, Block, PayPal and Visa/MC?

#106

Post by zinekeller »

Nextgrid wrote: post #101
Deathmax wrote: post #88

Earlier quoted context omitted.

> As long as debit cards have a magnetic stripe and have their full number printed on them, and that information is useful, this problem remains. Which the EEA/UK has also (partially) solved by enforcing Strong Customer Authentication (SCA) that mandates that (most) transactions require MFA.

I don’t believe SCA is enforced by the bank. It’s voluntary by the merchant. It acts as a liability shift but won’t save you from someone not caring about it and emptying your account (temporarily until the chargeback goes though). I don’t think any bank offers an option of “allow SCA-only transactions” and I don’t think it would be even possible (I’m not sure there is any token/session identifier to tie the SCA requ…

This is not right at all (it's mandatory fo all banks and merchants in the EEA), although you're correct that SCA still has loopholes (like a US merchant... just trying, although a bank could just mandate 3DS to solve that).

Re: Ask HN: Do we need to pay billions in fees to Stripe, Block, PayPal and Visa/MC?

#107

Post by alberth »

thesausageking wrote: post #39
oldprogrammer2 wrote: post #9

Stripe, Block, and PayPal each solved a massive pain point. PayPal provided a way to pay people and vendors without giving away your credit card number. Square made it easy to accept payment in person on a phone, without an extensive upfront underwriting experience and without expensive fixed monthly fees. Stripe did the same as Square, but for accepting online payments. Fraud and Risk come in many forms, and these p…

The challenger to these will solve for a different problem. Not every transaction needs complex fraud detection or being able for the customer do to chargebacks. For a 3% discount, would customers agree to use something that worked just like cash, where the transfer was instant and couldn't be undone? Then you don't have to worry about fraud, chargebacks, etc.

You just described debit cards.

And there fees are 1/10 of that of credit cards, as a result of giving up these benefits.

Re: Ask HN: Do we need to pay billions in fees to Stripe, Block, PayPal and Visa/MC?

#108

Post by Nextgrid »

zinekeller wrote: post #106
Nextgrid wrote: post #101

Earlier quoted context omitted.

I don’t believe SCA is enforced by the bank. It’s voluntary by the merchant. It acts as a liability shift but won’t save you from someone not caring about it and emptying your account (temporarily until the chargeback goes though). I don’t think any bank offers an option of “allow SCA-only transactions” and I don’t think it would be even possible (I’m not sure there is any token/session identifier to tie the SCA requ…

This is not right at all (it's mandatory fo all banks and merchants in the EEA), although you're correct that SCA still has loopholes (like a US merchant... just trying, although a bank could just mandate 3DS to solve that).

How do you explain the example I gave where the taxi app only has to SCA me once and not upon every transaction? This is in the EU.

What I suspect is that the "mandatory" bit is by law (and the law has flexibility, which covers this taxi app scenario) but there is no technical solution to make it mandatory, thus a non-compliant merchant can still drain your account until your chargeback claim goes through.

Re: Ask HN: Do we need to pay billions in fees to Stripe, Block, PayPal and Visa/MC?

#110

Post by textlapse »

You mean like UPI? For a nascent industry such as India I imagine you could: but for a legacy infrastructure such as that of the US - very advanced a few decades ago but now showing its age - the momentum is too hard to deprecate and start over. Just like how fast the developing world had pretty good mobile networks in a short amount of time.

There are still a lot of lessons to learn from the Indian model but I guess the US incumbents would artificially add road blocks via legal or subtle measures to maintain the status quo and instead offer band aid solutions.

Post reply on HN