Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A simple solution to credit card fraud, and why you won't see it any time soon

blog.rongarret.info

Post reply on HN
Print view View original

51–60 of 130 posts

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#51

Post by nitrogen »

bradleyland wrote: post #49
jarrett wrote: post #14

To expand upon the author's idea, the problem is not just that credit card data is reusable, but that possession of credit card data amounts to permission to charge any arbitrary amount to it . Not legal permission, mind you, but permission in the sense that the infrastructure lets you do it, and you have to sort out the consequences through social/legal channels after the fact. Not only should future payment systems…

> possession of credit card data amounts to permission to charge any arbitrary amount to it The word you're looking for is "capability", not permission. Permission requires consent, which is something you give separately from the actual card number. A minor point, but I think it changes the tone of that statement. > possession of credit card data amounts to the capability to charge any arbitrary amount to it I'm not…

Ugh, no thanks. The system you describe is more like cash. I have to actively dole out the necessary amount, and then receive change that is counted at each transition. I abhor these types of transactions.

Not in this case. There's no reason the merchant can't send a request for a specific amount, encrypted using your credit account's public key and signed by their private key. Your credit authorizing device (smartphone, desktop app, phone call, whatever) then asks you to confirm the amount, and that amount is sent back to the merchant. I'm sure there's some way of cryptographically tying the request for funds to the transmission of funds so that it's clear what transaction the funds are for, that the amount sent matches the amount requested, etc.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#52

Post by SlipperySlope »

Wow, what an informative comment!

It's clear to me that the advent of push liability opens the lots wider for no-fraud payment systems, I.e. bitcoins. Evidentially, that situation is only two to five years away. Which is plenty of time for mobile wallet startups to help me get rid of my annoying leather wallet!

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#53

Post by ricardobeat »

GauntletWizard wrote: post #5

If you look at how they were actually deployed in Europe, you'll realize that it's not much different over there. "Chip and Pin" is if anything worse than no encryption, because it gives the illusion of security. I don't know about the situation in Asia.

How so? I'm not fond of the liability shift to the merchant/consumer, but the bar for technical fraud is much, much higher than for stripe cards.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#54

Post by raintrees »

olefoo wrote: post #34

In a rational world where declaring that government should be responsible for the foundational services that enable civil society the universal payment transaction service would be operated by the government as a public utility. In this hypothetical rational world, you would go to the government office when you needed to open a new payment account to make or receive payments. You would show proof of identity, and rec…

I am reminded of a Max Headroom episode that covered the character Edison Carter's loss of one of those devices. It was also his key to personal property (house, car).

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#55

Post by damoncali »

davidu wrote: post #22

I've thought about this "problem" and decided there's no problem. You're solving a non-problem if you try to solve credit card fraud. The reason we don't deal with credit card fraud is that there are no consequences for being a victim, for any definition of victim. If the victims had consequences, then there would be demand for action. But there is none. Further, because there are no consequences, the cost to solve c…

This is so obviously untrue that I'm really curious for further explanation. What are you talking about?

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#56

Post by kjackson2012 »

In Canada they have a system where you input a PIN number every time you use a credit card at a POS.

I've heard from my Canadian friend who owns a Shoppers Drug Mart, that it has cut down chargebacks to almost 0.

Why they haven't implemented this in the US I'm not sure. The only problem is that if they figure out your PIN, it makes it very hard to fight chargebacks from the point of the consumer. But we all know that the CC companies don't care.

The one thing to note is that it's very hard for the CC companies to lose money with fraud. Usually the merchant or the consumer is on the hook. Then the issuing bank, etc. They're last in line, so their incentive to make drastic change is nil.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#57

Post by signed0 »

drucken wrote: post #48

Overreacting, shallow, misleading and bait-link article. Overreacting: - the most up-to-date technologies for anti-credit card fraud, namely variants of smart card/EMV, are already available and widely used by all the large credit card providers and banks in the EU and Asia (excluding domestic transactions in China and Japan). There are even US providers who use it in some situations. - in addition, most merchants in…

EMV only seems to secure offline transactions at merchants and ATMs. How does it protect information for online and phone payments?

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#58

Post by jfim »

conorgdaly wrote: post #46
jarrett wrote: post #14

To expand upon the author's idea, the problem is not just that credit card data is reusable, but that possession of credit card data amounts to permission to charge any arbitrary amount to it . Not legal permission, mind you, but permission in the sense that the infrastructure lets you do it, and you have to sort out the consequences through social/legal channels after the fact. Not only should future payment systems…

I agree with your solution of an affirmative step. I can see internet credit/debit card transactions moving towards a "request for funds" model where the consumer(via smartphone) has to explicitly ok the transfer of funds: Merchant - (RFF) -> Bank - (prompts for auth) -> Consumer - (grants auth) -> Bank - (RFF granted) -> Merchant Of course, smartphones are still potentially insecure, another more cumbersome model co…

You've just described ARQC EMV card payments.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#59

Post by azov »

jarrett wrote: post #14

To expand upon the author's idea, the problem is not just that credit card data is reusable, but that possession of credit card data amounts to permission to charge any arbitrary amount to it . Not legal permission, mind you, but permission in the sense that the infrastructure lets you do it, and you have to sort out the consequences through social/legal channels after the fact. Not only should future payment systems…

There are many use cases when pulling money is more convenient for the consumer. This is how most people pay their bills for example - they let providers deduct a different sum every month based on usage. There's a lot of value in being able to simply "set it and forget it"

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#60

Post by danpat »

jarrett wrote: post #14

To expand upon the author's idea, the problem is not just that credit card data is reusable, but that possession of credit card data amounts to permission to charge any arbitrary amount to it . Not legal permission, mind you, but permission in the sense that the infrastructure lets you do it, and you have to sort out the consequences through social/legal channels after the fact. Not only should future payment systems…

For retail POS transactions, EMV (chip+pin) cards and terminal are an attempt to shift this balance. Unfortunately, the rollout isn't due for another couple of years yet in the USA, and there has been significant resistance to the change already (as demonstrated by the 10 year lag when compared to the EU rollout).
Post reply on HN