Earlier quoted context omitted.
Think standard oAuth. Github has multiple flows that should cover most purposes here: https://docs.github.com/en/apps/oauth-apps/building-oauth-ap... . The key is that payment data is encoded in oAuth-like scopes, so all authorizations are scoped by amount and lifetime, and are implicitly merchant-specific. Browser-based flow, where you're already logged into the bank in an existing browser tab: * Amazon redirects yo…
This is no different than chip+pin for physical purchases. There are still other major areas of fraud that has to be addressed. It doesn’t cover credit risk-even on a debit card, there can be a “hold” period of an arbitrary amount before the final transaction clears. When you swipe a card at a gas station, they often run a $50 authorization hold on your account. It also doesn’t cover merchant fraud—- Visa/MC covers y…
Safeway gas stations upgraded their pumps to have tap-to-pay.
But with increasing gas prices (and not getting into that), they upped the auth hold to up to $125.
Except many card issuers limit contactless payments to $100... rendering tap to pay useless on the pump because it'll deny the preauth and require chip insertion.