A simple solution to credit card fraud, and why you won't see it any time soon • Hacker News Board

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#121

Post by rogerbinns » Sat, Feb 23, 2013, 1:35 AM UTC

qeorge wrote: post #25

Some banks will let you generate single-use credit card numbers (e.g., Chase). So you have one CC # for the power company, a different one for Netflix, and so forth. Then if e.g., Netflix gets hacked you can just cancel that one card number. You can also generate cards with hard spending limits, cards that only work for a specific merchant, etc. And of course you can delete them anytime. Its a pretty good system. Tha…

There are issues with chip and pin, one of the major ones being it puts the onus of proof of fraud on the consumer. Hey, your card couldn't possibly have been used if you didn't type in the PIN or give it to someone else so you are liable.

This sort of thing reared its ugly head last decade in the UK with phantom ATM withdrawals. The banks claimed the consumers must have made the transactions as PINs are required and banks are perfectly secure. It turned out that the banks weren't as secure as claimed. (Search for [ross anderson phantom withdrawals] for more details as well as attacks on chip and pin systems.)

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#122

Post by com2kid » Sat, Feb 23, 2013, 2:08 AM UTC

snowwrestler wrote: post #44

The "solution" to credit card fraud is monitoring and insurance. I don't worry about credit card fraud because my credit card company does not hold me responsible for fraud as long as I bring it to their attention in a timely manner (30 to 60 days). So I just make sure to review my statements every month. Yes, in a general sense I pay the cost of this insurance because all businesses are imaginary pass-through entiti…

But, complex technical solutions ALSO have a cost

The solution is hardly "complex".

Your CC number never leaves your card unencrypted. Your card details are encrypted on a server somewhere. A transaction consists of a record of sale that is signed by the merchant's private key, sent to your card, which then signs it with your private key.

Said package of data is delivered up to Visa's servers. Your digital signature is validated with your public key, merchant's key is validated, the order goes through. Yes this requires an internet connection, yes it breaks offline processing. It also cuts fraud to 0.

Online purchases get more complicated, sure. Lazy way is to have something running on client machine that can sign data downloaded from merchant, make it a browser plugin or even better a standard all browsers implement, so long as the private key is stored somewhere and can be applied to a message. This is not exactly a hard problem. Doing it right is tricky, thankfully a good number of correct implementations already exist. Use one of those.

A more secure solution, especially for PCs, is to have a dongle, everything is processed on card. Then even if the PC is rooted 50 ways to Sunday all orders are still secure.

This is no more convoluted (and many would argue less) than the current way by which credit card orders are processed.

Credit Card companies currently place the entire burden of fraud onto merchants. They don't really have a reason to care about fraud, other than that it is bad customer service to have your customer's identity stolen.

The real problem here is how to deal with crap like reoccurring payments. Too many organizations are used to a workflow where in they store your credit card number. That is obviously insecure (see: news stories that come out all the time). I am not sure how to solve that particular problem though. Obviously it is a big blocker to getting a more secure system implemented!

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#123

Post by freshhawk » Sat, Feb 23, 2013, 2:37 AM UTC

tlb wrote: post #31

There's a simpler explanation to why merchants don't charge extra for credit card purchases: The cost of accepting cash is not zero. The logistics of drop safes and daily deposits plus losses due to counterfeiting, robberies and pilfering can cost a similar amount to the 3-4% credit card fees. That's why merchants aren't grumbling too much.

That's a valid point surely but it's not a simpler explanation. The simple explanation is that you will have your ability to accept credit cards pulled if they find out you are charging more for CC purchases, although you are allowed to have a "cash discount" just as was stated. It's in every agreement. I'm a bit shocked that people are arguing about this actually, but I guess accepting credit cards and setting up card present accounts isn't exactly a universal experience.

I'm not sure how/if this was recently changed in the US, my knowledge is 5+ years out of date now and I'm not in the US either.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#124

Post by parauchf » Sat, Feb 23, 2013, 3:47 AM UTC

I worked in fraud prevention for several of the big banks. They definitely care about it and it is not passed on directly to customers.

There's a strong relationship between card fraud and DDA fraud which very directly hits the bottom line. Typically credit card fraud is monetized by making a balance transfer to a DDA.

Chip and pin is on the way. A lot of new cards have it. See below...

http://www.federalreserve.gov/newsevents/bank_of_america_201...

Never explain with conspiracy what can be explained by incompetence.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#125

Post by pbreit » Sat, Feb 23, 2013, 4:10 AM UTC

davidu wrote: post #86

dangrossman wrote: post #41

Earlier quoted context omitted.

He was very explicit in saying, multiple times, that his assertion was true for any definition of victim. It's easy to show that the victim of credit card fraud is typically the merchant, not the consumer.

I used the term consequences deliberately. The merchant may have losses, but they have no leverage. The option to not take credit cards is not available to most sellers of goods. On a large scale the cost of fraud simply becomes a cost of business that factors into the price the consumer pays. This is why many merchants offer a cash discount. To argue that the cash discount is just to cover credit card processing fee…

Merchants think little or noting about chargebacks when contemplating a cash discount.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#126

Post by gbhn » Sat, Feb 23, 2013, 4:50 AM UTC

30thElement wrote: post #75

sokoloff wrote: post #26

Earlier quoted context omitted.

If the true costs of fraud are 5-10 basis points, suggesting that we eliminate fraud by replacing that with a 50 basis point drain on the system seems unlikely to succeed.

Most likely that was a mental arithmetic error or he thought that 1 bp = 0.1%, but changing it from 0.5% back to 0.05% back really changes the utility. If your average CC transaction is $100, you're breaking even compared to picking up a nickel. I'd rather get on with my day then stand there waiting for the authorization or picking up a nickel.

http://www.nasdaq.com/article/skimming-threatens-debit-card-... says fraud "in 1% of transactions".

I don't know whether those transactions tend to be larger or smaller than average. I'd assume the detection systems are quite good, and crooks start with small charges (gas stations and shoes are what I hear are test spots they use). So they may be pretty close to average sized transactions.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#127

Post by davidu » Sat, Feb 23, 2013, 8:29 AM UTC

damoncali wrote: post #92

davidu wrote: post #90

Earlier quoted context omitted.

You say it's obviously untrue, so what are the obvious consequences of credit card fraud? I believe that anything you suggest worth addressing costs more than the fraud itself. The only way to eliminate fraud is to show that doing so increases transaction volume. Since there has yet to be a proposed solution that does that, people focus instead on trying to "save money" lost to fraud, which doesn't work because there…

Well, theft is one obvious consequence. If someone steals my stuff with a credit card, I have suffered a loss as a consequence of the offender's fraud. I'm not sure how you can argue around that.

Economic consequences aren't the same as your personal inconvenience.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#128

Post by davidu » Sat, Feb 23, 2013, 8:34 AM UTC

xanados wrote: post #93

davidu wrote: post #22

I've thought about this "problem" and decided there's no problem. You're solving a non-problem if you try to solve credit card fraud. The reason we don't deal with credit card fraud is that there are no consequences for being a victim, for any definition of victim. If the victims had consequences, then there would be demand for action. But there is none. Further, because there are no consequences, the cost to solve c…

If you think there is no victim I think you may not have a very firm grasp of economics. In particular, small negative consequences borne by many economic actors adds up to legitimate negative economic consequences, even if there is a collective action problem in addressing them. In order to make the argument that there is no victim, you will have to describe how this fraud is wealth creating, without appealing to an…

Collective action problems imply a lack of consequences. QED.

To your point that all the effort to combat fraud implies there is a problem, you've created a fallacious point.

To your point on unproductive exercise, I believe it is wasted effort and loss. Perhaps the real victims of fraud are fraud fighters!

To inconvenience as a form of consequence, you clearly already understand the difference there.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#129

Post by ZoFreX » Sat, Feb 23, 2013, 11:55 AM UTC

LarrySDonald wrote: post #115

drucken wrote: post #48

Overreacting, shallow, misleading and bait-link article. Overreacting: - the most up-to-date technologies for anti-credit card fraud, namely variants of smart card/EMV, are already available and widely used by all the large credit card providers and banks in the EU and Asia (excluding domestic transactions in China and Japan). There are even US providers who use it in some situations. - in addition, most merchants in…

> the credit card industry HAS and IS deploying the most up-to-date technology. In some regions, e.g. US, there are legal or infrastructure barriers that take time to overcome. And why is that, you think? People are somewhat surprised that a magstripe is still even considered valid here and have been for years. I've seen zero chip readers in the US. It's been more than five years since I've heard of a merchant using…

> I've seen zero chip readers in the US.

I was in the US last summer for two weeks, and I saw several. Perhaps because I'm used to chip and pin?

> in the EU Square Up is distributing free chip readers for android or iphone

No they aren't, I think they said they were going to but there's no way to get one from them right now.

On the small business angle, chip and pin in the UK has been a nightmare for small retailers. It's been in for several years now and things like Square are much more recent. A chip and pin device is not cheap - far more than many small businesses can afford.

By 2015 (which is the liability date for point of sale terminals and you bet your boots they will change those machines quickly once it's costing them money) Square and things like it will be mature and ready, so hopefully you guys will make the transition much more easily than we are!

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#130

Post by damoncali » Sat, Feb 23, 2013, 1:32 PM UTC

davidu wrote: post #127

damoncali wrote: post #92

Earlier quoted context omitted.

Well, theft is one obvious consequence. If someone steals my stuff with a credit card, I have suffered a loss as a consequence of the offender's fraud. I'm not sure how you can argue around that.

Economic consequences aren't the same as your personal inconvenience.

You keep using that word. I don't think it means what you think it means.