Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What happens when you swipe a credit card

tech.affirm.com

Post reply on HN
Print view View original

121–130 of 178 posts

Re: What happens when you swipe a credit card

#121

Post by lewiseason »

mseebach wrote: post #85
IanCal wrote: post #64

Earlier quoted context omitted.

Expiry date: It checks that you're not using an old card that someone has just thrown away, often card numbers remain the same if you get a new one. This is effectively just specifying the version of the card, and is something that needs to be on cards anyway (so the user knows when they're no longer valid). Additional benefit is that it means your customer has just checked that their card is still valid. CVV: Not su…

That doesn't seem convincing, for the expiry. The issuer needs to keep track of cancelled cards anyway, and they should be cancelling expired cards anyway - it seems like a huge security hole to keep expired cards in an active state and rely on an expiry date check to reject transactions. I assumed that it's a leftover from early days, before online card checks, so the merchant can check that the card is still valid…

One reason for this is that it's at the discretion of the issuing bank whether or not to accept an expired card (in fact, you can get into trouble for handling this locally with some processors).

I believe it's a convenience thing for the end user, when issuing a new card - offer a couple of days "grace" - and arguably there isn't much risk associated with this practice: lost/stolen cards are always cancelled immediately.

Re: What happens when you swipe a credit card

#122

Post by lewiseason »

Nullabillity wrote: post #114
jdmichal wrote: post #74

Earlier quoted context omitted.

Which is (roughly) exactly how EMV chips work. Crypographic challenges that result in unique tokens for every transaction.

Of course, EMV is still a broken piece of crap, because the signer can't actually verify the transaction being signed.

Plus, you still have to support plaintext between the EMV chip and the reader. This opens an entirely new class of places to steal card details (like PINs)

Re: What happens when you swipe a credit card

#123

Post by murukesh_s »

hibikir wrote: post #77
Cyph0n wrote: post #11

I'm kind of disappointed that you didn't go into the security features present in a typical credit card transaction. For example, you could describe the crypto protocols used to communicate with the gateway and/or card processor, what kind of data the stripe and chip contain and how it is used for authentication, etc. Another thing I find interesting is the anti-tamper features that are present in a standard credit c…

The way I see it, this is describing the system exactly as much as it needs to make its case that 'banking system is bad and expensive, use our stuff'. Covering security, or the lower fees in Europe (thanks mostly to the security features), goes against the narrative. An interesting tidbit: An extra reason US fees are so high are premium credit cards choke full of rewards: Not every card has the same fees, and the hi…

2FA I guess you mean 2 factor authentication? I guess the cost burden is overestimated. India has made it mandatory for all POS and even online transactions to have 2FA, like Visa's 3D secure service for online and ATM pin for POS. Other providers also have it implemented. It must be not very expensive to make the same service in other parts of the world. Wondering why they are not doing it. In India, RBI had released stricter guidelines for that after initial spike in card fraud during the online business boom. Not sure of how much percentage it helped to reduce the fraud, but it's a safe feeling that even if your card is lost or it's details are stolen, you are not robbed of your money in the bank.

[Edit] And if you are wondering how companies can store the creditcard data for automated payments like Uber, they cant .Uber have tied up with payment wallets to make payments seamless or you have option to pay by cash. For business there is an option for interbank automated transfer but that require you explicitly singing agreements.

Re: What happens when you swipe a credit card

#124

Post by abalone »

cmurf wrote: post #93
hibikir wrote: post #77

Earlier quoted context omitted.

The way I see it, this is describing the system exactly as much as it needs to make its case that 'banking system is bad and expensive, use our stuff'. Covering security, or the lower fees in Europe (thanks mostly to the security features), goes against the narrative. An interesting tidbit: An extra reason US fees are so high are premium credit cards choke full of rewards: Not every card has the same fees, and the hi…

Well if we really believed in the free market and consumer protection, there'd be a law requiring the total transaction cost be printed on the sales slip. Whether the merchant pays it or passes it onto the consumer would be up to the merchant, but the amount would appear on the slip so the consumer sees these costs and who is paying for it. What we really have is mercantilism, where the issuer by contract disallows f…

No longer. Merchants can elect to publish and pass fees to customers. Durbin amendment legalized it. Didn't change anything though. Pretty much no one does it for competitive reasons.

Re: What happens when you swipe a credit card

#125

Post by glitch003 »

ikeboy wrote: post #7

>If the merchant doesn’t settle within a certain time frame specified by the network, then the authorization expires and the reserved funds are released (as with every complex system, there are caveats here too). Where can I read specifics for each network? Also, the post doesn't do a good job of explaining what affirm is. All I know is it's some kind of alternative.

I know Stripe is 7 days

Re: What happens when you swipe a credit card

#126

Post by abalone »

nodesocket wrote: post #57

Does anybody know if using Stripe if we can pass the 2.9% fee onto our customers? We offer customized consulting plans that vary and typically in the thousands, so thinking of just adding a 3% credit card processing fee to the invoice for clients that use card. Researching around the net, it seems for traditional brick and mortar, some issuers don't allow you to charge a percentage based card processing fee. Any idea…

Yes. The Durbin amendment specifically prohibits processors from restricting you from offering a discount for payment by other means.[1] What you found on the net probably is out of date.

Incidentally it also regulates debit interchange down to practically nothing. Processors like Stripe are making a killing on debit. Try to find one that does "interchange plus" pricing, and then you can accept debit at no additional cost to your customers.

[1] see p7 http://blog.legalsolutions.thomsonreuters.com/wp-content/upl...

Re: What happens when you swipe a credit card

#127

Post by ec109685 »

GrinningFool wrote: post #49
coin wrote: post #4

> swipe your card Sadly swiping is being replaced by chipcard.

> Sadly swiping is being replaced by chipcard. I see this being downvoted, and I'm wondering if it's not simply just misinterpreted. Most places in the US I've used chip&pin, the process goes like this: - arrive at merchant, select goods, get total. - look for a sign that says chip is not enabled. - failing that, move assuredly towards the chip reader and keep an eye on the cashier to ensure he or she doesn't move to…

Where does the pin come into play for chip based credit card purchases?

Re: What happens when you swipe a credit card

#128

Post by abalone »

Hannan wrote: post #94
nodesocket wrote: post #57

Does anybody know if using Stripe if we can pass the 2.9% fee onto our customers? We offer customized consulting plans that vary and typically in the thousands, so thinking of just adding a 3% credit card processing fee to the invoice for clients that use card. Researching around the net, it seems for traditional brick and mortar, some issuers don't allow you to charge a percentage based card processing fee. Any idea…

It's complicated and depends on things like where you're charging and whether or not it's a "fee" for using the card vs. offering a cash discount (how these are not essentially equivalent is beyond me): Sections 1.5.4.2 & 5.6 https://usa.visa.com/dam/VCOM/download/about-visa/15-April-2... Section 5.11.2 https://www.mastercard.us/content/dam/mccom/en-us/documents/... IANAL, etc.

Those sections specifically state that those rules don't apply in the U.S. (anymore). That's the Durbin amendment.

Re: What happens when you swipe a credit card

#129

Post by abalone »

nodesocket wrote: post #68
digler999 wrote: post #48

What annoys me is the expiry date and CVV. It seems like their solution to "more secure" is just to add more numbers. How about put the last 3 digits on the back, and call it the cvv ? How about use alphanumeric card numbers so we dont have to use as many digits ? Get rid of the expiry date used as validation. It's just more entropy, if you need more entropy then add another digit. It's just annoying having to type t…

I think we can all agree the correct model is a card that generates a globally unique card number for each and every transaction (e.g. coin failed , final). It should also have a 2nd factor authorization like CVV which is not embedded in the magnetic strip (can't be read by swipers).

I don't agree about the unique account number every time. That's nice to opt into when you want maximum privacy but it screws up things like loyalty programs or recurring billing where you actually do want a merchant to remember you.

What we can agree on is that there should be strong authentication. Apple Pay is the best system I've seen. It creates a unique but static account number that can only be used with Apple Pay, which has strong authentication which is also convenient (Touch ID), so it can be mandatory. Thus it doesn't matter if the number gets stolen as it's useless without Apple Pay.

Re: What happens when you swipe a credit card

#130

Post by sandGorgon »

icebraining wrote: post #62
sandGorgon wrote: post #26

Earlier quoted context omitted.

This is NOT a consequence of chip card. In India, everything is chip and pin. Our ATM machines just need you to put the card in , chip side facing up and then take it out 2 seconds later (it glows green). Then you can put in your PIN number and move forward.

I think that's because ATMs are trusted devices, and only need a generic signed authorization to do anything. Payment terminals need to have the specific transaction amounts signed by the card, IIRC. At least that's the model I've learned here in my (European) country.

No. ATM need to sign amounts as well,but keep the key in memory. I don't think it's a consequence of swipe vs chip or anything. It just the UX built into the machine.

IMHO , consumers find it reassuring that they are asked for a pin AFTER the amount is entered into a swipe machine in a bar (where you are much more likely to be drunk). This kind of a mechanism is very nice when amount is entered by someone else (the retailer/cashier).

At the ATM, you are the only one that enters the amount.

So the pin entry at the end of the workflow is not a bug..It's a feature.

Post reply on HN