Candy Japan hit with credit card fraud • Hacker News Board

Re: Candy Japan hit with credit card fraud

#201

Post by ceejayoz » Sat, Sep 19, 2015, 3:02 PM UTC

Reason077 wrote: post #198

ceejayoz wrote: post #133

Earlier quoted context omitted.

> My bank asks for three random characters from my online banking password... That's terrifying, really. They shouldn't have any way of getting that data out of the hashed password.

Well, it's a bank. If a hacker can penetrate to the point that they can read passwords directly out of the bank's account database, then you have far greater things to worry about than just a compromised password.

Unhashed passwords means a SQL injection hole goes from "I can read some interesting transaction histories and balances" to "I can log in and make bank transfers in everyone's account". There's a reason bcrypt one-way hashing is the recommended standard for any web app.

Re: Candy Japan hit with credit card fraud

#202

Post by toomuchtodo » Sun, Sep 20, 2015, 2:33 AM UTC

pravda wrote: post #186

Maarten88 wrote: post #184

Earlier quoted context omitted.

> None of this is at direct cost to the customer Then who do you think is paying for those rewards/cashbacks? Who is paying for the extra warranty? Who is paying for the costs of the chargebacks and the replacement of cards that get stolen by the millions? The answer could be you, creditcard users who dont pay off in time, or people who use other payment methods. It certainly isn't the banks or the merchant who's pay…

It is the merchants. Credit card fees are paid by merchants. It comes out of profits.

...which leads to higher prices charged to consumers. Credit cards and their benefits exact a roughly 3% surcharge on ecommerce in the aggregate.

Re: Candy Japan hit with credit card fraud

#203

Post by toomuchtodo » Sun, Sep 20, 2015, 2:34 AM UTC

jandrese wrote: post #165

sbov wrote: post #155

Earlier quoted context omitted.

Very different in the US. US consumer protection laws treat credit and debit cards differently. They favor credit cards. The gap between the two is up to the goodwill of your bank. I prefer to rely on law than goodwill. I have never had a problem with getting a refund on a credit card charge I claimed was fraud. I have no idea why people choose to use a debit card over a credit card here.

The thread might be titled "People tend to use the safest (to them) form of payment available". If your credit card laws protect the consumer a lot (like in the US) then you use credit cards. If you have some in-country debit system with better protection you use that instead. One reason it's so hard to unseat credit cards in the US is because most of the advantages of the alternatives are on the sellers side. The co…

Merchants in the US are now legally allowed to charge a surcharge for credit card transactions, regardless of their merchant agreement.

Re: Candy Japan hit with credit card fraud

#204

Post by sjwhitworth » Sun, Sep 20, 2015, 8:20 AM UTC

jbombadil wrote: post #106

sjwhitworth wrote: post #36

We at Ravelin ( https://www.ravelin.com ) are building solutions to stop this. Still surprises me how many people think banks/schemes are responsible for CC fraud, when it's actually the merchant that gets punished. And yeah, fraudsters operate like locusts.

I don't understand why does the merchant have to pay the 15 fee. It sounds to me the entity that should handle the loss of fraud is the bank.

Blame the lack of competition in the international payments system I guess.

Re: Candy Japan hit with credit card fraud

#205

Post by emodendroket » Mon, Sep 21, 2015, 2:40 PM UTC

astrange wrote: post #188

emodendroket wrote: post #129

Earlier quoted context omitted.

Try Japan. Credit cards won't be accepted half the places you go and only a small percentage of ATMs will allow you to withdraw money from a foreign account at all.

Credit should be accepted in stores where you're expected to spend over 10,000JPY/$100, but anywhere small is cash-only. In Tokyo you might be able to NFC pay from your transit card balance, and the taxis take cards. As for ATMs, go find a 7/11 or a Post Office and those will work.

Well, yes. I didn't want to get into all the minutiae to make a point.

Re: Candy Japan hit with credit card fraud

#206

Post by emodendroket » Mon, Sep 21, 2015, 2:42 PM UTC

toomuchtodo wrote: post #203

jandrese wrote: post #165

Earlier quoted context omitted.

The thread might be titled "People tend to use the safest (to them) form of payment available". If your credit card laws protect the consumer a lot (like in the US) then you use credit cards. If you have some in-country debit system with better protection you use that instead. One reason it's so hard to unseat credit cards in the US is because most of the advantages of the alternatives are on the sellers side. The co…

Merchants in the US are now legally allowed to charge a surcharge for credit card transactions, regardless of their merchant agreement.

It doesn't seem like anybody besides gas stations is really doing this, though.

Re: Candy Japan hit with credit card fraud

#207

Post by emodendroket » Mon, Sep 21, 2015, 2:43 PM UTC

Someone1234 wrote: post #140

emodendroket wrote: post #128

Earlier quoted context omitted.

> That's the reason they recommended to use a payment gateway that implements all those local payment solutions. For example, in Germany you loose a lot of customers if you don't offer direct debit (ELV) as many don't own a credit card (and don't want to). I can't imagine wanting to give out my bank details to allow direct debit of my account to every online retailer I do business with. Weird.

It is identical to a credit card and cheque. That's exactly what you're doing in both cases.

Others have pointed out the consumer protection on the German system is pretty good. The distinction here is that, in the US context at least, it's somebody else's money that is temporarily inaccessible -- you can still withdraw your cash while a credit dispute is taking place.

Re: Candy Japan hit with credit card fraud

#208

Post by toomuchtodo » Mon, Sep 21, 2015, 2:56 PM UTC

emodendroket wrote: post #206

toomuchtodo wrote: post #203

Earlier quoted context omitted.

Merchants in the US are now legally allowed to charge a surcharge for credit card transactions, regardless of their merchant agreement.

It doesn't seem like anybody besides gas stations is really doing this, though.

True, I was just pointing out that legally, they can.