What happens when you swipe a credit card • Hacker News Board

Re: What happens when you swipe a credit card

#131

Post by umeshunni » Sun, Mar 05, 2017, 7:01 AM UTC

mperham wrote: post #100

umeshunni wrote: post #79

Earlier quoted context omitted.

The transactions on the network (i.e. between the banks and the association) typically use the ISO 8583 protocol: https://en.wikipedia.org/wiki/ISO_8583 The actual implementation (for e.g. between the hardware terminal and their gateway) is usually using some custom API/protocol - for e.g. Stripe/Braintree have their own APIs as do other older players like like PTI ( https://www.chasepaymentech.com/developercenter/in…

FYI "e.g." means "for example", so "for e.g." means "for for example".

I didn't actually know that was incorrect usage till right now! Thanks!

Re: What happens when you swipe a credit card

#132

Post by elastic_church » Sun, Mar 05, 2017, 7:31 AM UTC

gaadd33 wrote: post #105

elastic_church wrote: post #104

Earlier quoted context omitted.

JP Morgan Chase pays their reward costs out of pocket.

Really? Do you know where you can find that information? I'm surprised that Chase does it given the amount they could recoup from their rewards programs.

https://www.bloomberg.com/news/articles/2016-12-06/dimon-say...

Re: What happens when you swipe a credit card

#133

Post by tehlike » Sun, Mar 05, 2017, 7:32 AM UTC

murukesh_s wrote: post #123

hibikir wrote: post #77

Earlier quoted context omitted.

The way I see it, this is describing the system exactly as much as it needs to make its case that 'banking system is bad and expensive, use our stuff'. Covering security, or the lower fees in Europe (thanks mostly to the security features), goes against the narrative. An interesting tidbit: An extra reason US fees are so high are premium credit cards choke full of rewards: Not every card has the same fees, and the hi…

2FA I guess you mean 2 factor authentication? I guess the cost burden is overestimated. India has made it mandatory for all POS and even online transactions to have 2FA, like Visa's 3D secure service for online and ATM pin for POS. Other providers also have it implemented. It must be not very expensive to make the same service in other parts of the world. Wondering why they are not doing it. In India, RBI had release…

Every friction you introduce means less transactions made. Friction probably introduces more transaction volume than it reduces fraud.

Also there might certain us customs that might make certain things hard, like tips. I am not entirely sure if this is true though.

Re: What happens when you swipe a credit card

#134

Post by tony101 » Sun, Mar 05, 2017, 8:23 AM UTC

murukesh_s wrote: post #123

hibikir wrote: post #77

Earlier quoted context omitted.

The way I see it, this is describing the system exactly as much as it needs to make its case that 'banking system is bad and expensive, use our stuff'. Covering security, or the lower fees in Europe (thanks mostly to the security features), goes against the narrative. An interesting tidbit: An extra reason US fees are so high are premium credit cards choke full of rewards: Not every card has the same fees, and the hi…

2FA I guess you mean 2 factor authentication? I guess the cost burden is overestimated. India has made it mandatory for all POS and even online transactions to have 2FA, like Visa's 3D secure service for online and ATM pin for POS. Other providers also have it implemented. It must be not very expensive to make the same service in other parts of the world. Wondering why they are not doing it. In India, RBI had release…

You make some good points, but with regards to the security of money in the bank, credit card customers in the U.S. are typically not liable for fraudulent transactions. By law liability is limited to $50, and Visa and MasterCard rules make liability effectively zero.

Re: What happens when you swipe a credit card

#135

Post by Johnie » Sun, Mar 05, 2017, 8:28 AM UTC

coin wrote: post #12

jwilk wrote: post #5

Earlier quoted context omitted.

Why sadly?

Because swiping is so much more convenient. With a magnetic transaction I can just swipe and put my card away. Most of the time I swipe at the beginning of a long checkout (grocery store). With a chip transaction, I need to leave the card in until the very end. I now need to leave my wallet out, or put the wallet away and then remember to take the card back. More card readers are optimized for swiping with card inser…

> With a chip transaction, I need to leave the card in until the very end.

Visa announced Quick Chip EMV that enable you to dip your card at any time of the transaction for it to generate and capture a cryptogram before the end of the transaction. This will allow Visa EMV to be almost as fast as swiping.

https://www.visa.com/chip/merchants/grow-your-business/payme...

http://www.pymnts.com/news/emv/2016/visa-puts-the-quick-into...

Re: What happens when you swipe a credit card

#136

Post by icebraining » Sun, Mar 05, 2017, 8:42 AM UTC

sandGorgon wrote: post #130

icebraining wrote: post #62

Earlier quoted context omitted.

I think that's because ATMs are trusted devices, and only need a generic signed authorization to do anything. Payment terminals need to have the specific transaction amounts signed by the card, IIRC. At least that's the model I've learned here in my (European) country.

No. ATM need to sign amounts as well,but keep the key in memory. I don't think it's a consequence of swipe vs chip or anything. It just the UX built into the machine. IMHO , consumers find it reassuring that they are asked for a pin AFTER the amount is entered into a swipe machine in a bar (where you are much more likely to be drunk). This kind of a mechanism is very nice when amount is entered by someone else (the r…

ATM need to sign amounts as well,but keep the key in memory.

That's not possible with the model used around here. The card's key never leaves the card, all the crypto is performed inside the card's chip itself.

Re: What happens when you swipe a credit card

#137

Post by icebraining » Sun, Mar 05, 2017, 9:00 AM UTC

criddell wrote: post #115

icebraining wrote: post #59

Earlier quoted context omitted.

Sure they do, it's not a secret: http://www.mastercardadvisors.com/information-services.html https://www.americanexpress.com/uk/content/merchant/business... https://usa.visa.com/run-your-business/commercial-solutions/...

The data doesn't really end up with advertisers though, does it? I can't call up AMEX and ask for a list of all the places my member of Congress uses his card, can I?

You can't ask for individual data points; you ask for a segment of the population (eg. "musicians over 40 with children") and they'll return the data aggregated in bulk.

Re: What happens when you swipe a credit card

#138

Post by shabda » Sun, Mar 05, 2017, 9:00 AM UTC

tony101 wrote: post #134

murukesh_s wrote: post #123

Earlier quoted context omitted.

2FA I guess you mean 2 factor authentication? I guess the cost burden is overestimated. India has made it mandatory for all POS and even online transactions to have 2FA, like Visa's 3D secure service for online and ATM pin for POS. Other providers also have it implemented. It must be not very expensive to make the same service in other parts of the world. Wondering why they are not doing it. In India, RBI had release…

You make some good points, but with regards to the security of money in the bank, credit card customers in the U.S. are typically not liable for fraudulent transactions. By law liability is limited to $50, and Visa and MasterCard rules make liability effectively zero.

US customers are paying in form of higher transaction fees which merchants are obviously pushing to the customers.

Re: What happens when you swipe a credit card

#139

Post by fauigerzigerk » Sun, Mar 05, 2017, 9:17 AM UTC

JoshTriplett wrote: post #111

cmurf wrote: post #93

Earlier quoted context omitted.

Well if we really believed in the free market and consumer protection, there'd be a law requiring the total transaction cost be printed on the sales slip. Whether the merchant pays it or passes it onto the consumer would be up to the merchant, but the amount would appear on the slip so the consumer sees these costs and who is paying for it. What we really have is mercantilism, where the issuer by contract disallows f…

> Well if we really believed in the free market and consumer protection, there'd be a law requiring the total transaction cost be printed on the sales slip. So "if we really believed in the free market", we should regulate the details of how a private transaction can take place? Leaving aside any other aspects of that proposal, whether positive or negative, it doesn't seem reasonable to describe it as "free market".

>So "if we really believed in the free market", we should regulate the details of how a private transaction can take place?

The information that has to be expressly stated as part of a contract is not some minor detail. It is at the very core of enabling free markets in the first place.

Some seem to think of free markets as a sort of natural phenomenon and of regulations as a distortion. But that isn't true at all.

Contracts, property rights and the responsibilities of all participants in a trade are concepts of law. Without them you would have to rely on implicit cultural conventions and resolve disputes by means of duels and vendettas.

Re: What happens when you swipe a credit card

#140

Post by rconti » Sun, Mar 05, 2017, 9:55 AM UTC

IanCal wrote: post #102

mseebach wrote: post #85

Earlier quoted context omitted.

That doesn't seem convincing, for the expiry. The issuer needs to keep track of cancelled cards anyway, and they should be cancelling expired cards anyway - it seems like a huge security hole to keep expired cards in an active state and rely on an expiry date check to reject transactions. I assumed that it's a leftover from early days, before online card checks, so the merchant can check that the card is still valid…

Expired cards and active cards generally have the same card number. I've certainly had multiple cards with the same long number across them. If you have to write the expiry date on anyway then why not use it?

Wait, I thought the expiration date was just theoretical. Nobody keeps the same card number that long without having the card compromised, do they? :)