101–110 of 178 posts
I stopped reading after the first sentence "Ninety percent of Americans have used a credit card" which I find to be completely untrue and fabricated.
Earlier quoted context omitted.
Expiry date: It checks that you're not using an old card that someone has just thrown away, often card numbers remain the same if you get a new one. This is effectively just specifying the version of the card, and is something that needs to be on cards anyway (so the user knows when they're no longer valid). Additional benefit is that it means your customer has just checked that their card is still valid. CVV: Not su…
That doesn't seem convincing, for the expiry. The issuer needs to keep track of cancelled cards anyway, and they should be cancelling expired cards anyway - it seems like a huge security hole to keep expired cards in an active state and rely on an expiry date check to reject transactions. I assumed that it's a leftover from early days, before online card checks, so the merchant can check that the card is still valid…
> swipe your card Sadly swiping is being replaced by chipcard.
> Sadly swiping is being replaced by chipcard. I see this being downvoted, and I'm wondering if it's not simply just misinterpreted. Most places in the US I've used chip&pin, the process goes like this: - arrive at merchant, select goods, get total. - look for a sign that says chip is not enabled. - failing that, move assuredly towards the chip reader and keep an eye on the cashier to ensure he or she doesn't move to…
I'm kind of disappointed that you didn't go into the security features present in a typical credit card transaction. For example, you could describe the crypto protocols used to communicate with the gateway and/or card processor, what kind of data the stripe and chip contain and how it is used for authentication, etc. Another thing I find interesting is the anti-tamper features that are present in a standard credit c…
The way I see it, this is describing the system exactly as much as it needs to make its case that 'banking system is bad and expensive, use our stuff'. Covering security, or the lower fees in Europe (thanks mostly to the security features), goes against the narrative. An interesting tidbit: An extra reason US fees are so high are premium credit cards choke full of rewards: Not every card has the same fees, and the hi…
Earlier quoted context omitted.
The way I see it, this is describing the system exactly as much as it needs to make its case that 'banking system is bad and expensive, use our stuff'. Covering security, or the lower fees in Europe (thanks mostly to the security features), goes against the narrative. An interesting tidbit: An extra reason US fees are so high are premium credit cards choke full of rewards: Not every card has the same fees, and the hi…
JP Morgan Chase pays their reward costs out of pocket.
Earlier quoted context omitted.
CVV is not just more entropy, it's handled differently: https://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3... The whole point is that you can't skim the CVV2 from the magnetic data and then use it to make purchase.
In addition to not being on the magnetic stripe, merchants are also not allowed to save it, so if you steal a merchant's database of stored CCs, you don't get the CVVs.
Earlier quoted context omitted.
> if you need more entropy then add another digit. That would break so much as most of the message formats and batch files use fixed width fields. It's probably the same for the databases underneath. Changing to alphanumerics sounds nice but the check digit algorithm would have to change from Luhn to Luhn mod n. More breaking changes. Banking systems are one of the ultimate forms of legacy, which is why most of the s…
> but the check digit algorithm would have to change or just get rid of it. It was a relic from 20+ years ago when networks and computers were 1/100th the speed they are today. Let them enter invalid numbers. Let the server return an error (as it already does)
i've always found it to be profoundly messed up that address validation (AVS) and security code validation (CVV/CSC) happen after the funds are authorized and held by the issuing bank. this means if you choose to decline transactions for cvv or avs reasons in your gateway settings, those funds are still actually held by the customer's bank as pending for ~24h, preventing them from trying the auth again if it puts the…
Who is your payment processor? They should be voiding the auth after the AVS or CVV mismatch.
Does anybody know if using Stripe if we can pass the 2.9% fee onto our customers? We offer customized consulting plans that vary and typically in the thousands, so thinking of just adding a 3% credit card processing fee to the invoice for clients that use card. Researching around the net, it seems for traditional brick and mortar, some issuers don't allow you to charge a percentage based card processing fee. Any idea…
Note - none of them I work with have used Stripe. They are normally using a gateway provider (like NMI) and a payment processor (like PayPro, Auth.net, Vantiv, etc). Stripe combines the merchant, gateway and payment processor into one bundle.
Earlier quoted context omitted.
The way I see it, this is describing the system exactly as much as it needs to make its case that 'banking system is bad and expensive, use our stuff'. Covering security, or the lower fees in Europe (thanks mostly to the security features), goes against the narrative. An interesting tidbit: An extra reason US fees are so high are premium credit cards choke full of rewards: Not every card has the same fees, and the hi…
Well if we really believed in the free market and consumer protection, there'd be a law requiring the total transaction cost be printed on the sales slip. Whether the merchant pays it or passes it onto the consumer would be up to the merchant, but the amount would appear on the slip so the consumer sees these costs and who is paying for it. What we really have is mercantilism, where the issuer by contract disallows f…