Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A simple solution to credit card fraud, and why you won't see it any time soon

blog.rongarret.info

Post reply on HN
Print view View original

21–30 of 130 posts

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#21

Post by Retric »

pbreit wrote: post #17
jarrett wrote: post #14

To expand upon the author's idea, the problem is not just that credit card data is reusable, but that possession of credit card data amounts to permission to charge any arbitrary amount to it . Not legal permission, mind you, but permission in the sense that the infrastructure lets you do it, and you have to sort out the consequences through social/legal channels after the fact. Not only should future payment systems…

But "pushing" has proven to be problematic for US consumers. They've basically traded the 5 or 10 basis points of fraud losses for a substantially better user experience (although they didn't really get to make that tradeoff decision).

If I could save .5% a transactin by looking at thr transaction cost on the card and then physically clicking ok I would probably do so. The problem is I have no choice one way or another.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#22

Post by davidu »

I've thought about this "problem" and decided there's no problem. You're solving a non-problem if you try to solve credit card fraud.

The reason we don't deal with credit card fraud is that there are no consequences for being a victim, for any definition of victim. If the victims had consequences, then there would be demand for action. But there is none. Further, because there are no consequences, the cost to solve credit card fraud isn't worth it.

Edit: This is a true statement. I feel capable to comment on this topic and have spent time working with this industry. I've dealt with abuse and fraud for years on many sides of the transaction (there are more than two). If you think you have a retort, please think carefully if you really understand what I just wrote above. There are no consequences for the victims. No matter how you define victim.

Edit 2: You deserve better explanations. I'll work on a blog post. But one case of a financially tight victim having to call the bank, etc. isn't enough. In the aggregate, nobody is inconvenienced. There are no consequences. If merchants had consequences, they'd stop accepting credit cards, but in the aggregate, that's a non-starter. Issuers similarly have no consequences. There's no arbitrage for improvement either.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#23

Post by zanny »

pbreit wrote: post #6

So...what's the solution?? "Use public key encryption" doesn't help us much. Especially when you claim "it's not hard". Disposable numbers have been tried many, many times and the user experience stinks. Maybe with the prevalence of good mobile experiences, their time has come?

I think the other thing is that most online credit fraud doesn't come intercepting credentials over wires but by dupe sites that imitate real realtors. I think two factor authentication might help with that, if it has to verify both sender and recipient on some mutual third party server of the credit card provider, but that costs them money, which gets back to the root problem, it doesn't cost the companies that would implement these schema anything now, and any change does cost them, and the market is rigged so you can't introduce competition.

I think it is much more likely bitcoin takes off as a real currency for exchange and people just start using banks that facilitates transparent conversion between the two when buying stuff online. It doesn't help with using a credit card online from a CC company, but it does skip them entirely.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#25

Post by qeorge »

Some banks will let you generate single-use credit card numbers (e.g., Chase). So you have one CC # for the power company, a different one for Netflix, and so forth. Then if e.g., Netflix gets hacked you can just cancel that one card number. You can also generate cards with hard spending limits, cards that only work for a specific merchant, etc. And of course you can delete them anytime. Its a pretty good system.

That said, I agree with the author. Signature based debit should have long since been replaced by something more secure (e.g., Chip and PIN), yet its much higher fee structure creates a perverse incentive to maintain its use.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#26

Post by sokoloff »

Retric wrote: post #21
pbreit wrote: post #17

Earlier quoted context omitted.

But "pushing" has proven to be problematic for US consumers. They've basically traded the 5 or 10 basis points of fraud losses for a substantially better user experience (although they didn't really get to make that tradeoff decision).

If I could save .5% a transactin by looking at thr transaction cost on the card and then physically clicking ok I would probably do so. The problem is I have no choice one way or another.

If the true costs of fraud are 5-10 basis points, suggesting that we eliminate fraud by replacing that with a 50 basis point drain on the system seems unlikely to succeed.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#27

Post by dangrossman »

It's easy to envision a future without this inherent problem -- it's PayPal, it's Dwolla, or any other service where payments are pushed instead of pulled. If you pay someone with PayPal, online or off, you don't leave them with anything they (or the hacker that steals the store's DB) can use to charge you again in the future. For recurring payments, in the background all you're giving out are tokens you can revoke at will.

Getting stores to adopt these services is a lot easier than getting Visa to change how their product fundamentally works.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#28

Post by lmkg »

pbreit wrote: post #17
jarrett wrote: post #14

To expand upon the author's idea, the problem is not just that credit card data is reusable, but that possession of credit card data amounts to permission to charge any arbitrary amount to it . Not legal permission, mind you, but permission in the sense that the infrastructure lets you do it, and you have to sort out the consequences through social/legal channels after the fact. Not only should future payment systems…

But "pushing" has proven to be problematic for US consumers. They've basically traded the 5 or 10 basis points of fraud losses for a substantially better user experience (although they didn't really get to make that tradeoff decision).

I don't think that consumers are aware of what they traded to get that convenience, though. Card companies have gone to great lengths to keep the costs hidden. They've even lobbied (so far, unsucessfully) to prevent merchants from charging extra for card transactions, which would make those costs all but invisible.

Anecdotally, I know that I'm much more hesitant to whip out my card for that burrito when they added a $.45 convenience charge. I still use the card sometimes, but that one charge is enough to make me keep cash on hand. I wonder whether people would pay for the convenience if the true cost of it were more visible.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#29

Post by dangrossman »

davidu wrote: post #22

I've thought about this "problem" and decided there's no problem. You're solving a non-problem if you try to solve credit card fraud. The reason we don't deal with credit card fraud is that there are no consequences for being a victim, for any definition of victim. If the victims had consequences, then there would be demand for action. But there is none. Further, because there are no consequences, the cost to solve c…

The merchants are the victims, and the consequences include lost payments, lost merchandise, chargeback fees, lost cashflow when the merchant account provider starts requiring a risk reserve, and lost cashflow when their account gets terminated for exceeding the acceptable chargeback ratio. It can even lead to loss of the entire business. How is that not a consequence of credit card fraud?

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#30

Post by ebiester »

Retric wrote: post #21
pbreit wrote: post #17

Earlier quoted context omitted.

But "pushing" has proven to be problematic for US consumers. They've basically traded the 5 or 10 basis points of fraud losses for a substantially better user experience (although they didn't really get to make that tradeoff decision).

If I could save .5% a transactin by looking at thr transaction cost on the card and then physically clicking ok I would probably do so. The problem is I have no choice one way or another.

You wouldn't save that money.

The kind of work that would require would be on the order of hundreds of millions of dollars of work, an entirely new infrastructure, and massive retraining. The return on investment is a very long term issue.

I currently work in the sector, so can't say too much about it, but the problem is that it's a hard problem at scale.

Post reply on HN