What happens when you swipe a credit card • Hacker News Board

Re: What happens when you swipe a credit card

#81

Post by _delirium » Sat, Mar 04, 2017, 9:31 PM UTC

pjc50 wrote: post #71

digler999 wrote: post #48

What annoys me is the expiry date and CVV. It seems like their solution to "more secure" is just to add more numbers. How about put the last 3 digits on the back, and call it the cvv ? How about use alphanumeric card numbers so we dont have to use as many digits ? Get rid of the expiry date used as validation. It's just more entropy, if you need more entropy then add another digit. It's just annoying having to type t…

CVV is not just more entropy, it's handled differently: https://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3... The whole point is that you can't skim the CVV2 from the magnetic data and then use it to make purchase.

In addition to not being on the magnetic stripe, merchants are also not allowed to save it, so if you steal a merchant's database of stored CCs, you don't get the CVVs.

Re: What happens when you swipe a credit card

#82

Post by abalone » Sat, Mar 04, 2017, 9:33 PM UTC

> Visa and Mastercard alone control 70% of the market based on purchase volume. And lack of competition reduces the incentive for firms to improve the efficiency of their technological systems or price their services fairly.

Some detail about the pricing might help here. Most of the fee is actually going to customers, believe it or not, and sometimes processors. It is an interesting study in complex two-sided market dynamics. This is critical to understand when thinking about how to improve the system, and it's something many startups figure out the hard way.

Most of the processing fee goes back to the issuing banks, not Visa/MC. On a typical transaction:

1. Visa takes "only" 0.11% + 2 cents.

2. Depending on the card maybe 1.5-2% + 10 cents goes to the bank that issued the card (e.g. Chase, Citi, Bank of America). These are fixed and published rates called interchange.[1]

3. The remainder of the fee is processor markup (e.g. Stripe, First Data). They are responsible for merchant fraud so their markup can vary a lot depending on merchant risk profile and bargaining power. E.g. Starbucks pays virtually nothing in processor markup, while Stripe's markup on thinly vetted ecommerce sites is huge.

So while 0.11% of all card transactions is a lot of money for Visa/MC at scale, most of the "high" 2-3% card fee is actually going back to banks. Competition between Visa & MC keeps their cut to where it is. Even though they control "70% of the market", there is two-party competition there.

So what's the deal.. what are fees so high? Don't banks compete with one another? Well, yes, they do, but it's not by picking lower interchange rates. There's one more piece to the picture: card benefits like reward programs that refund 1-2% to the customer, thinning the bank's take considerably. Banks compete on how much reward to pay out to the customer.

Merchants dislike higher fees, obviously, but given the importance of card acceptance to completing a sale, they are more tolerant of fees than customers are tolerant of poor card benefits. The bottom line is banks need to compete for customers more than card networks need to compete for merchants.

The only way merchants have been able to reduce card fees is through regulation. Visa/MC have built systems that effectively leverage the power of customer choice. If you want to build something different you need to look at the customer benefit side of things, not just offering merchants a lower-cost method.

[1] https://usa.visa.com/dam/VCOM/download/merchants/visa-usa-in...

Re: What happens when you swipe a credit card

#83

Post by icantdrive55 » Sat, Mar 04, 2017, 9:37 PM UTC

pmorici wrote: post #63

nodesocket wrote: post #57

Does anybody know if using Stripe if we can pass the 2.9% fee onto our customers? We offer customized consulting plans that vary and typically in the thousands, so thinking of just adding a 3% credit card processing fee to the invoice for clients that use card. Researching around the net, it seems for traditional brick and mortar, some issuers don't allow you to charge a percentage based card processing fee. Any idea…

I use Square and Paypal for my business invoicing because you can send invoices that can be paid via credit card via email. I add a 3% card fee explicitly to all my invoices. No one any of these companies has ever said anything. I also offer the option of Bitcoin and wire transfer payments for invoices w/o a fee.

PayPal used to prohibit it, but things might have changed when they were split up from EBay?

Re: What happens when you swipe a credit card

#84

Post by alkonaut » Sat, Mar 04, 2017, 9:37 PM UTC

coin wrote: post #80

alkonaut wrote: post #39

Earlier quoted context omitted.

The swipe is a 1 second job, but the insert+PIN takes maybe 10sec. I do the card+pin at any point while the cashier is registering my groceries. By the time he finished scanning them all, the card has been back in my pocket a long time. The only thing I do at the end is hit "ok" to confirm the amount. The procedure would be exactly the same with a magnetic card. Even just the convenience of a more reliable read is wo…

This doesn't work in the US. Where I live, for a credit card chipcard, the cashier has to finish, then there's a 2-way authentication with the server whereby the card has to stay in the reader. This is why the card has to stay out until the very end.

I can see the extra security added by having the card in at the time of confirmation - but it seems a pretty heavy price to pay. This certainly isn't worth 10 seconds extra per customer checkout in a supermarket.

Re: What happens when you swipe a credit card

#85

Post by mseebach » Sat, Mar 04, 2017, 9:41 PM UTC

IanCal wrote: post #64

digler999 wrote: post #48

What annoys me is the expiry date and CVV. It seems like their solution to "more secure" is just to add more numbers. How about put the last 3 digits on the back, and call it the cvv ? How about use alphanumeric card numbers so we dont have to use as many digits ? Get rid of the expiry date used as validation. It's just more entropy, if you need more entropy then add another digit. It's just annoying having to type t…

Expiry date: It checks that you're not using an old card that someone has just thrown away, often card numbers remain the same if you get a new one. This is effectively just specifying the version of the card, and is something that needs to be on cards anyway (so the user knows when they're no longer valid). Additional benefit is that it means your customer has just checked that their card is still valid. CVV: Not su…

That doesn't seem convincing, for the expiry. The issuer needs to keep track of cancelled cards anyway, and they should be cancelling expired cards anyway - it seems like a huge security hole to keep expired cards in an active state and rely on an expiry date check to reject transactions.

I assumed that it's a leftover from early days, before online card checks, so the merchant can check that the card is still valid (besides checking signature and ID or whatever). When introducing online checks of the magnetic swipe, expiry date was part of the data transmitted, and early phone/Internet payment systems relied on reconstructing the data present on the magnetic strip, to "fake" a swipe. Then it just stuck from there.

Re: What happens when you swipe a credit card

#86

Post by barrkel » Sat, Mar 04, 2017, 9:42 PM UTC

chrisseaton wrote: post #8

coin wrote: post #4

> swipe your card Sadly swiping is being replaced by chipcard.

Chip cards replaced swiping over a decade ago, and a couple of years ago contactless replaced chip cards for most purposes. Does anyone literally swipe a credit card any more? I can't remember seeing it done in years except in some parts of Europe.

Only very low value purchases (less than 30 GBP) can be made without a PIN, in the UK at least. That won't cover a decent restaurant meal, refuelling a car or grocery shopping of any significance.

Re: What happens when you swipe a credit card

#87

Post by mhluongo » Sat, Mar 04, 2017, 9:50 PM UTC

shpx wrote: post #67

pmorici wrote: post #63

Earlier quoted context omitted.

I use Square and Paypal for my business invoicing because you can send invoices that can be paid via credit card via email. I add a 3% card fee explicitly to all my invoices. No one any of these companies has ever said anything. I also offer the option of Bitcoin and wire transfer payments for invoices w/o a fee.

Bitcoin fees are around 65 cents per transaction right now. https://bitcoinfees.21.co/ http://www.btcsatoshi.com/ https://en.bitcoin.it/wiki/Transaction_fees

That the sender pays, not the merchant

Re: What happens when you swipe a credit card

#88

Post by digler999 » Sat, Mar 04, 2017, 9:50 PM UTC

leejo wrote: post #56

digler999 wrote: post #48

What annoys me is the expiry date and CVV. It seems like their solution to "more secure" is just to add more numbers. How about put the last 3 digits on the back, and call it the cvv ? How about use alphanumeric card numbers so we dont have to use as many digits ? Get rid of the expiry date used as validation. It's just more entropy, if you need more entropy then add another digit. It's just annoying having to type t…

> if you need more entropy then add another digit. That would break so much as most of the message formats and batch files use fixed width fields. It's probably the same for the databases underneath. Changing to alphanumerics sounds nice but the check digit algorithm would have to change from Luhn to Luhn mod n. More breaking changes. Banking systems are one of the ultimate forms of legacy, which is why most of the s…

> but the check digit algorithm would have to change

or just get rid of it. It was a relic from 20+ years ago when networks and computers were 1/100th the speed they are today. Let them enter invalid numbers. Let the server return an error (as it already does)

Re: What happens when you swipe a credit card

#89

Post by digler999 » Sat, Mar 04, 2017, 9:53 PM UTC

Y_Y wrote: post #52

digler999 wrote: post #48

What annoys me is the expiry date and CVV. It seems like their solution to "more secure" is just to add more numbers. How about put the last 3 digits on the back, and call it the cvv ? How about use alphanumeric card numbers so we dont have to use as many digits ? Get rid of the expiry date used as validation. It's just more entropy, if you need more entropy then add another digit. It's just annoying having to type t…

To play devil's advocate, it may be useful to know when the card expires for a merchant who mightn't charge immediately. And maybe it's significant that the cvv is on the back so you couldn't just use a photo. And mixing letters and numbers is scary. But I agree. Maybe the solution is just having lots of entropy and reading it electronically, who really needs to read out card numbers over the phone?

I agree, keep the exp date, just dont use it to validate the transaction so I dont have to fumble with the keyboard and mouse to select stupid dropdown boxes. Let the server handle the case where the card expires tomorrow. I agree the CVV should be on the back, so just take the 3 numbers off the front and put them on the back.

Re: What happens when you swipe a credit card

#90

Post by digler999 » Sat, Mar 04, 2017, 9:55 PM UTC

IanCal wrote: post #64

digler999 wrote: post #48

What annoys me is the expiry date and CVV. It seems like their solution to "more secure" is just to add more numbers. How about put the last 3 digits on the back, and call it the cvv ? How about use alphanumeric card numbers so we dont have to use as many digits ? Get rid of the expiry date used as validation. It's just more entropy, if you need more entropy then add another digit. It's just annoying having to type t…

Expiry date: It checks that you're not using an old card that someone has just thrown away, often card numbers remain the same if you get a new one. This is effectively just specifying the version of the card, and is something that needs to be on cards anyway (so the user knows when they're no longer valid). Additional benefit is that it means your customer has just checked that their card is still valid. CVV: Not su…

exp date could be checked by the server. I just mean they shouldn't ask me to enter it during a purchase.