What annoys me is the expiry date and CVV. It seems like their solution to "more secure" is just to add more numbers. How about put the last 3 digits on the back, and call it the cvv ? How about use alphanumeric card numbers so we dont have to use as many digits ? Get rid of the expiry date used as validation. It's just more entropy, if you need more entropy then add another digit. It's just annoying having to type t…
never thought of this.Simpyfying the number system would be beneficial for the consumer but also for the companies who make money out of this CC system
What annoys me is the expiry date and CVV. It seems like their solution to "more secure" is just to add more numbers. How about put the last 3 digits on the back, and call it the cvv ? How about use alphanumeric card numbers so we dont have to use as many digits ? Get rid of the expiry date used as validation. It's just more entropy, if you need more entropy then add another digit. It's just annoying having to type t…
To play devil's advocate, it may be useful to know when the card expires for a merchant who mightn't charge immediately. And maybe it's significant that the cvv is on the back so you couldn't just use a photo. And mixing letters and numbers is scary. But I agree. Maybe the solution is just having lots of entropy and reading it electronically, who really needs to read out card numbers over the phone?
Because swiping is so much more convenient. With a magnetic transaction I can just swipe and put my card away. Most of the time I swipe at the beginning of a long checkout (grocery store). With a chip transaction, I need to leave the card in until the very end. I now need to leave my wallet out, or put the wallet away and then remember to take the card back. More card readers are optimized for swiping with card inser…
> With a chip transaction, I need to leave the card in until the very end.
Visa announced Quick Chip EMV that enable you to dip your card at any time of the transaction for it to generate and capture a cryptogram before the end of the transaction. This will allow Visa EMV to be almost as fast as swiping.
What annoys me is the expiry date and CVV. It seems like their solution to "more secure" is just to add more numbers. How about put the last 3 digits on the back, and call it the cvv ? How about use alphanumeric card numbers so we dont have to use as many digits ? Get rid of the expiry date used as validation. It's just more entropy, if you need more entropy then add another digit. It's just annoying having to type t…
> if you need more entropy then add another digit.
That would break so much as most of the message formats and batch files use fixed width fields. It's probably the same for the databases underneath. Changing to alphanumerics sounds nice but the check digit algorithm would have to change from Luhn to Luhn mod n. More breaking changes.
Banking systems are one of the ultimate forms of legacy, which is why most of the security additions have been bolted on. Just look at 3D secure - they added an entire subsection to the message format and it was still just another single factor auth method that nobody wanted and everybody hated.
Does anybody know if using Stripe if we can pass the 2.9% fee onto our customers? We offer customized consulting plans that vary and typically in the thousands, so thinking of just adding a 3% credit card processing fee to the invoice for clients that use card.
Researching around the net, it seems for traditional brick and mortar, some issuers don't allow you to charge a percentage based card processing fee. Any idea is this is allowed on Stripe?
i've always found it to be profoundly messed up that address validation (AVS) and security code validation (CVV/CSC) happen after the funds are authorized and held by the issuing bank. this means if you choose to decline transactions for cvv or avs reasons in your gateway settings, those funds are still actually held by the customer's bank as pending for ~24h, preventing them from trying the auth again if it puts the…
This isn't quite true. It is up to your issuer if they decide to approve the transaction despite failing AVS or CVV checks. Often they will decline the authorization, but depending on their risk signals, might decide to approve it. Then, the merchant (or the processor they are using) can decide if they want to let the transaction go through despite the failed checks, or call it a decline and reverse the authorization, which removes the pending charge. Crappy terminals might cause the pending authorization to sit there for 1-3 days by delaying or not sending the reversal, but in general that shouldn't be the case.
That was easy enough to infer, what wasn't was where in the world contact-less payment systems came to dominate. Even in Europe chip appears to be the norm. China? Japan?