111–120 of 377 posts
So I guess one question is: as credit unions are to banks, what missing organization type needs to exist as a counterpoint to payment services, which could return excess to owner-users?
Earlier quoted context omitted.
Yea I’m not proposing to replace low security credit cards with low security debit card this is a silly strawman. EDIT: I see the general problem of origination fraud. But that can be mitigated by imposing limits and requiring extra levels of authentication for bigger payments.
You said you don't want the ability to do chargebacks, but chargebacks solve two different problems: 1) origination fraud (i.e. someone not you originates a transaction from your account) and 2) merchant fraud (i.e. goods not as described/unsatisfactory/undelivered). It's fine if you say, yeah I can do without #2, but realistically you cannot do without #1 in any digital payment scheme that will have wide acceptance…
Earlier quoted context omitted.
> As long as debit cards have a magnetic stripe and have their full number printed on them, and that information is useful, this problem remains. Which the EEA/UK has also (partially) solved by enforcing Strong Customer Authentication (SCA) that mandates that (most) transactions require MFA.
Yeah, Europe is ahead on this; I hedged my earlier statements heavily. It's not a difficult technological problem to solve. A card's chip should be able to guarantee that the card is physically present for any transaction. Obviously online payments would pose a problem, people would need to either own USB card chip readers or banks would need to do something new and special.
The physical card can communicate via NFC, and there's a smartphone app you can use with it. For PCs, you can buy some fancy NFC interface if you want, but you can also have your phone act as a reader, the PC connects to it over the local network.
Maybe something similiar could work for banking cards. They all have NFC anyways.
On the other hand, you might as well just have an app that is registered with the bank on your computer/phone (like how it works for smartphone NFC payments) and skip the card.
Earlier quoted context omitted.
> As long as debit cards have a magnetic stripe and have their full number printed on them, and that information is useful, this problem remains. Which the EEA/UK has also (partially) solved by enforcing Strong Customer Authentication (SCA) that mandates that (most) transactions require MFA.
Yeah, Europe is ahead on this; I hedged my earlier statements heavily. It's not a difficult technological problem to solve. A card's chip should be able to guarantee that the card is physically present for any transaction. Obviously online payments would pose a problem, people would need to either own USB card chip readers or banks would need to do something new and special.
An older example was getting transaction authorisation numbers. You would either get a long indexed list on paper, or you could receive then over the phone (voice or text). This was then mostly replaced (about 10 years ago) with hardware (H/T)OTP type tokens that required your card to be inserted in the token and PIN authenticated. Later on that too was replaced by a cardless version, and that one then was replaced (for consumers) with mobile apps.
The combination of minimum software versions, online authentication, transaction limits, daily limits, and time-locked temporary limit increases (so you can buy a car with your phone, but you have to up the limit a couple of hours ahead of time for it to take effect) make it pretty safe with acceptable risk for the bank. And then there's of course the standard fraud detection and prevention departments, so if you do something unusual that also involves a lot of money, you're likely going to get a call.
For business use, there are other systems, generally two types like EU-wide smartcards or bank-specific smartcards that can be used to authenticate and authorise. You'd use an USB or NFC connected method for that. Sometimes that involves entering a PIN on the device itself before the computer can talk to it, but that does make the OTP exchange very fast. You'd still have limits or multiparty authorisation setup in your organisation so you don't end up with one person just moving a couple of 100K around on their own.
And then there's some overlapping systems, apparently this one is going EU-wide: hhttps://en.wikipedia.org/wiki/EIDAS and apparently some implementations include useful things: https://www.idin.nl/en/businesses/ like age confirmation where the business doesn't need to know who, what or where you are just if you're of age (and not even a specific age). Granted, nothing is perfect, but it's a whole lot better than finding some S3 bucket somewhere with JPEGs of ID cards. As long as they don't do dumb stuff like trying to MITM TLS, it's progress. The overlap is in the concept where you can use some electronic means to prove who you are to get something done.
Stripe, Block, and PayPal each solved a massive pain point. PayPal provided a way to pay people and vendors without giving away your credit card number. Square made it easy to accept payment in person on a phone, without an extensive upfront underwriting experience and without expensive fixed monthly fees. Stripe did the same as Square, but for accepting online payments. Fraud and Risk come in many forms, and these p…
Visa or MC could do the same, without additional parties. But no.
Earlier quoted context omitted.
I thought chargebacks were generally considered a pain: for merchants because it's used by abusive customers, and by customers because it means the merchant (or rather, their payment provider) needs to play a guessing game about whether you're going to do a chargeback and may baselessly deny you the purchase, as well as increasing the cost for everyone due to this increased risk the merchant has Or maybe it's just me…
It's probably just a cultural difference between (broadly) the US, Europe, and Asia. In the US it's increasingly uncommon to buy things with cash or cash-equivalents (Venmo, Zelle, etc.), especially high-value items. Basically we have very few consumer protection laws compared to the EU, and it's very much a "buyer beware" culture here. If you get screwed by a merchant, most of the time it's just too bad for you, unl…
> paying with cash (which leaves you almost always without recourse if anything happens)
One remark about this though: you always have recourse in court. We often hear the USA is incredibly litigious, but it's not like we'd not (threaten to) bring action against a merchant not acting honestly
The main situation where I see chargebacks being useful is when you fell for a scam and the perpetrator cannot be located for enforcement. Which is a legitimate concern for sure, but there's more ways of dealing with that than giving everyone the option to chargeback anything on a whim with no repercussions for them
Earlier quoted context omitted.
This is not right at all (it's mandatory fo all banks and merchants in the EEA), although you're correct that SCA still has loopholes (like a US merchant... just trying, although a bank could just mandate 3DS to solve that).
How do you explain the example I gave where the taxi app only has to SCA me once and not upon every transaction? This is in the EU. What I suspect is that the "mandatory" bit is by law (and the law has flexibility, which covers this taxi app scenario) but there is no technical solution to make it mandatory, thus a non-compliant merchant can still drain your account until your chargeback claim goes through.
I agree with the OP, Visa and MC charging so much is just insane when you think about it. It’s more expensive AND settlement times are days, not seconds. The only barrier is consumer awareness and detrimental UK legislation forbidding card fees to be added to bills which while well intentioned completely ruins any competition on payment methods.
Stripe, Block, and PayPal each solved a massive pain point. PayPal provided a way to pay people and vendors without giving away your credit card number. Square made it easy to accept payment in person on a phone, without an extensive upfront underwriting experience and without expensive fixed monthly fees. Stripe did the same as Square, but for accepting online payments. Fraud and Risk come in many forms, and these p…
You could eliminate a lot of the fraud by moving off a mostly-static identifier to merchant, amount and time-limited tokens the user generates with their bank (or the merchant redirects them there). This would address a lot of the issues - the tokens are useless when leaked (as they only work against the merchant's own account) and can't be misused even by the merchant to go beyond the agreed amount or time limit.
This means with such a system you’d immediately eliminate a whole category of fraud, with the only thing remaining being merchant-level disputes like goods not as described/etc, which can easily be made optional and the user can choose to opt-in for the extra fee. Then you would actually have a good case for lower/no mandatory fees at all.
One problem you need to keep in mind is that fraud mitigation is a big industry in an of itself (some of it is real, some complete snake oil but relies on the underlying problem being real to sell itself) and wouldn't be in favor of a system that is inherently immune to (at least some types of) fraud.