Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Japan facing credit card number shortage

mainichi.jp

Post reply on HN
Print view View original

241–250 of 360 posts

Re: Japan facing credit card number shortage

#241

Post by Broken_Hippo »

alkonaut wrote: post #226
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

I was shocked to hear that my mastercard which I always use with CVC and 2FA or PIN actually works like a normal third world mastercard in some places. So while the security problem is kind of solved where I live, if someone stole my CC details they can still skim my card! Obviously I can block it for all transactions abroad but that doesn't seem like the best idea either. The only working solution is to generate tem…

Isn't that a feature to make sure you can use it when you travel? Not everywhere supports chip and pin, do they? Has it ever been rolled out in the US, for example - or is 2FA something everyone can get? (I know it wasn't generally a thing before I moved).

Re: Japan facing credit card number shortage

#242

Post by lukebennett »

franga2000 wrote: post #204
xfer wrote: post #187

Earlier quoted context omitted.

It's called 3D Secure and requires a PIN to verify transaction(typically with SMS), or a security device provided by bank.

Except that 3D Secure is opt-in by the merchant. All you need to do is find a web store that is more than 2 years old and you can use stolen/skimmed cards all day long.

Not for long, it will be mandatory in the EU from the end of the year under the PSD2 regulations (though the deadline has moved back into 2021 for some countries, including the UK which is adopting them despite Brexit).

Issuers will start to decline card transactions for any merchants that submit payments that haven't gone through 3DS.

Re: Japan facing credit card number shortage

#243

Post by lukebennett »

rtpg wrote: post #221
franga2000 wrote: post #211

Earlier quoted context omitted.

That's how it works for all credit card fraud. But do they treat 3D Secure transactions any differently?

Yes, 3D secure leads to a different liability layout. Stores that don't implement it face liability on chargeback, whereas stores that do use it are protected, and the banks themselves take liability. At least that's my understanding of it, might not be that clearcut.

Yep that's right, the liability shifts from the merchant to the bank.

Re: Japan facing credit card number shortage

#244

Post by franga2000 »

lukebennett wrote: post #242
franga2000 wrote: post #204

Earlier quoted context omitted.

Except that 3D Secure is opt-in by the merchant. All you need to do is find a web store that is more than 2 years old and you can use stolen/skimmed cards all day long.

Not for long, it will be mandatory in the EU from the end of the year under the PSD2 regulations (though the deadline has moved back into 2021 for some countries, including the UK which is adopting them despite Brexit). Issuers will start to decline card transactions for any merchants that submit payments that haven't gone through 3DS.

Hell yeah! Now we just need to get banks to stop using SMS 2FA and embrace an open 2FA standard like TOTP and our money (!!) will finally be almost as secure as our Facebook accounts have been for 5 years...

Re: Japan facing credit card number shortage

#245

Post by Broken_Hippo »

ViViDboarder wrote: post #170
i386 wrote: post #151

Earlier quoted context omitted.

That’s very US centric. In every other place except America, credit card issuers mandate the use EMV’s and pin codes.

How does that chip work online? As far as I know, CCs around the world still depend on numbers. For what it’s worth, in the US, chip is pretty much everywhere. Main difference is that it’s chip and signature vs chip and pin. I wish we’d switch to pins as well, but it’s not like it’s the dark ages or anything.

I have two options, both provided for by the bank.

1. I have a dongle that creates a number code when prompted. 2. My phone is set up for 2fa, again through the bank. The screen shows the same keyword as the website and I enter a pin into my phone to authorize the transaction. I can't remember if I need to use the fingerprint option on the phone or if that's just for the bank's app.

Re: Japan facing credit card number shortage

#246

Post by jokethrowaway »

bartvk wrote: post #232
mcv wrote: post #229

Earlier quoted context omitted.

The prevalence of credit cards has baffled me for decades now. I admit I have one, but the only thing I need it for is to buy things from webshops that don't cater to the Dutch market. Every webshop that's vaguely aware of the Dutch market supports iDeal, which is specifically designed to handle internet payment and doesn't involve sharing any sensitive information with merchants or other unknown parties; my bank han…

The Dutch system is not on the side of the consumer. It's simply a bank transaction before they send you the goods.

Protecting the consumer with chargebacks or regulations quickly becomes "Only big corporations can afford the risk of selling to consumers, small businesses can't risk losing 15$ on every transaction (on which they also pay 3%)"

I'd rather have a market protecting me with verified reviews and as close to zero costs for sellers. Not unlimited refunds that put small sellers out of business, leaving only Amazons and eBays.

Re: Japan facing credit card number shortage

#247

Post by michannne »

CameronNemo wrote: post #205
michannne wrote: post #107

Earlier quoted context omitted.

At that point why even show the number? It would be useless without the encryption. And if you have some way to enter the numbers so online transactions still work, then what is the point of the encryption? I don't believe the majority of fraud is stolen physical credit cards

> And if you have some way to enter the numbers so online transactions still work, then what is the point of the encryption? Why not allow plugging the card into the computer just like a yubikey for online payments? It would be quite difficult to pull off, but credit card companies can save a lot on fraudulent transactions if it is implemented.

Seems ridiculous to have to buy a device just to use my card. I would have to carry it around as well otherwise I wouldn't be able to use my card online

Re: Japan facing credit card number shortage

#248

Post by kenniskrag »

joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

There also exist 2FA solutions where they want an accept on a mobile app for example.

Re: Japan facing credit card number shortage

#249

Post by vinay427 »

i386 wrote: post #151
joshfraser wrote: post #96

What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.

That’s very US centric. In every other place except America, credit card issuers mandate the use EMV’s and pin codes.

At least in the US, to be fair, they don't really take your money but rather the bank's money. Credit cards tend to be much more lenient and generous with fraud protection (among other benefits) in the US than in some other countries in which I've had cards.
Post reply on HN