Criminals can guess Visa number and security code in six seconds, experts find

For US based transactions, AVS failures (address, zip) don't typically fail the transactions.

Most often, the api has 3 possible return values "Success", "Success With Warnings" and "Failure".

The "Success with Warnings" will have some error codes for AVS failures (street address, zip). Usually the same for invalid CVV2. I've also noticed that cardholder name matching isn't universally supported...AMEX does it well, but VISA/MC is hit or miss.

Most merchants choose to allow for "Success with Warnings" and then manually check them.

It's hard to automate, because it's very typical for real customers to mistype billing addresses, CVV2, etc. One good example is small business owners. They, very often, use their business address as billing, even when the billing address is actually their home address.

In short, you can configure for hard failure on address mismatch or CVV2 mismatch, but you're throwing away a lot of legit transactions if you do so.

The merchant is not just left holding the bag. The merchant has to buy the bag...and it is not a cheap paper or plastic bad. It is a fancy, expensive, designer bag. When a charge is disputed, the merchant pays a fee of typically $15-30, regardless of who wins the dispute.

In other words, there are two possible outcomes to a dispute:

1. Merchant loses. Merchant refunds in full that amount of the charge plus $15-30 for the charge back processing fee.

2. Merchant wins. Merchants gets to keep the amount of the charge, but still must pay the $15-30 charge back processing fee.

From the merchant point of view, the credit card system is very annoying in that regard. If anything happens that requires that someone gets screwed, that someone will be the merchant.

The banks will not allow themselves to be screwed, because they run the system.

The credit card holder is a direct client of the banks, and the banks protect them to keep them happy.

The merchant account provider, which is where the credit card companies actually send the money for the merchant's sales, and is the entity that the credit card companies turn directly to in the case of chargebacks or fraud, protects itself by holding back part of the money it owes the merchant. The merchant account provider ends up holding a buffer of sometimes tens of thousands of dollars of the merchant's sales.

Worse, the merchant does not appear to be able to really know when payment from a credit card is actually final. According to nearly everything I can find on the net and in credit card company documentation, the limit on how old a charge can be charged back is 6 months or 1 year.

I know that is wrong because at a company whose payment handling software I maintain, we got a charge back on a transaction that was several months past a year old.

Another thing I saw that I would have thought impossible had I not actually saw it, was we had a customer who bought a subscription to a monthly service. The initial purchase went through fine (transaction comes back approved, and a day or two later shows up as settled and paid). The renewal next month went through, and so on, for the next six months or so.

Then we got a notice that the last several of these had not actually went through. The issuing bank had told the credit card processor that the transaction was approved, but we were told it was really declined, and no money was actually transferred.

It does, but the only allowable reason is "not authorized". Of course, for this type of fraud, that's the reason that matters.

Thought it worth mentioning though, because in the CC world, a lot of the fraud is return fraud. Like "Item Not Received" or "Not as Described" being used when they aren't true.

>the loss those banks are adding to their books

There is no loss to the banks, assuming the fraudulent purchases are "card not present". The loss goes to the selling merchant. Your point of it being collectively passed on to the consumer is still true, of course.

As a customer they are also entirely to your disadvantage as in any 3dsecure transaction the customer is liable for unauthorized transactions as the assumption is they are the only ones with the ability to authorize. This makes disputing charges extremely difficult for the customer, and shifts liability from the bank and merchant to the customer end.