Live data from Hacker News

The underground world of credit card network exploitation

chargebackstop.com

221–230 of 280 posts

Re: The underground world of credit card network exploitation

#221

Off topic: Why don’t more non-European merchants use 3DS? Entirely classes of liability and fraud is shifted to the issuer and no longer on the merchant.

Customer friction at checkout. The more difficult a merchant makes the checkout process the more likely customers are to abandon the checkout. Some of those abandoned checkouts are fraudsters, but other are legitimate customers who don't want to deal with the hassle. It is up to the merchant to decide how to weigh fraud against lost sales.

Re: The underground world of credit card network exploitation

#222
post #166

Earlier quoted context omitted.

Definetly not a better experience for all consumers. Or waiter. I do know that some restaurant owners are removing these things. They do not want to look like Olive Garden :) But it really depends on a restaurant: is it high end, type of food / drinks, it is a date place, etc. Majority of restaurant is all about experience and event payment system should match that experience.

> Majority of restaurant is all about experience and event payment system should match that experience. I'm in the UK. I go to many high-end restaurants, cocktail bars, etc. Portable card terminals are essentially universal in these places. The fact it's the same everywhere is a feature, not a bug. It's quick. Your card never leaves your sight. No pen is required. Payments up to £100 can be done using contactless on…

I’d be annoyed if I ended up in a restaurant that didn’t have a card machine.

They’re almost universal at this point to the extent that not to have one would be unusual.

Re: The underground world of credit card network exploitation

#223

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

None of these comments seem relevant to TFA, which is specifically about card-not-present fraud. Chip and PIN doesn't work for internet payment. Bank transfers don't work well internationally. It is trivial to turn on AVS (address verification) and CVV, but it can result in more declined-yet-legitimate transactions. Sometimes that outweighs the fraud risk that these catch. The responsibility for fraud is pushed to th…

I mean the "real thing" is 3D Secure, which isn't exactly 2FA and card issuer dependent, but makes things a hell of a lot more of a PITA to execute for fraudsters.

Re: The underground world of credit card network exploitation

#224
post #60

Earlier quoted context omitted.

> the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks Feels like a mischaracterization tbh. He had it make a script to go through and accept the chargebacks for these accounts, not handle payment processing or do anything to the chargebacks other than click "accept" essentially. > And based on the context in the article, the author sounds like they lacked th…

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…

read the code before you use it? what are you even typing man

Re: The underground world of credit card network exploitation

#225
post #126

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

> In a culture that accepts widespread card fraud, costs increase to offset it. Maybe, maybe not, but this is a very simplistic way of looking at it. If credit card fraud is responsible for X% of total charges, they can spend effort to deal with it, OR they can simply not deal with it and keeping the transactions going while eating the cost, they may be able to serve Y% more customers where Y > X and thus end up with…

I recognise that for the likes of McDonalds, the friction probably isn’t a benefit.

With that said, I can’t remember the last time I saw a POS terminal that wasn’t contactless.

More often than not I’ll go out with nothing more than my phone knowing that regardless of where I end up, I’ll be able to pay.

Features like SCA protect consumers and businesses alike.

Re: The underground world of credit card network exploitation

#226
post #83

Why does the US seem so far behind when it comes to banking? - Chip and PIN has been in the UK since 2004 and mandatory since 2006. It wasn't until a decade later that the US caught up. - Faster Payments allow for instant bank transfers (usually) between any bank account for free. Receiving transfers from clients in US (even with a US Wise bank account) was always a nightmare. - Since the EU introduced Strong Custome…

In my view, the U.S. is leading the way in this area. Europe seems to be shifting the burden of fraud prevention onto customers with methods like SMS notifications and pins. In contrast, in the U.S., banks and businesses are primarily responsible for dealing with fraud.

The EU have effectively implemented 2FA for credit card payments online.

I pointed out a handful of ways the US are lagging far behind in banking.

How can they possibly be leading the way?

They’re stuck with a horribly outdated system that harms small businesses and exposes users to significantly higher levels of fraud.

It’s bizarre that so many people accept credit card fraud as just the way things are.

Re: The underground world of credit card network exploitation

#227
post #60

Earlier quoted context omitted.

> the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks Feels like a mischaracterization tbh. He had it make a script to go through and accept the chargebacks for these accounts, not handle payment processing or do anything to the chargebacks other than click "accept" essentially. > And based on the context in the article, the author sounds like they lacked th…

ChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient…

That's slow corporate thinking. I'm familiar with it but disagree because the efficiency gains are undeniable and it puts a business on a noncompetitive stance if they fail to change with the times.

ChatGPT and Copilot are like intern software devs who can produce code in seconds. They generate code that's usually close, but not always correct, at the savings of a great deal of your time of typing the whole thing vs. verifying correctness.

For critical and complex algorithms, it's not worth using ML coding assistants right now, but they will be in the future. It's obvious that that's where it's headed: massive efficiency gains for non-technical and barely technical people, and the decline in demand for software engineers, and with it, also a decline in software engineering salaries.

Re: The underground world of credit card network exploitation

#228
post #219

Earlier quoted context omitted.

I expect it’s path-dependent legacy practices more than anything else. Credit cards were invented in the US, so the tech is old and upgrades take a long time. For manual payments, UPI in India sounds pretty great. Apparently the customer approves each payment on their phone before it goes through?

UPI is a terrible thing. 0) makes every transaction a trivial SQL query away for the government. 1) everything needs an SMS code. Just as we are trying to get everyone off SMS 2FA 2) doesn’t work for non-Indian numbers or roaming devices 3) can’t get an Indian SIM without proof of address etc. No burners in India 4) regulation expressly forbids devic-local biometrics. This is why there is no Apple Pay in India. 5) Bi…

Credit card networks are already quasi-governmental agencies who block payments the government doesn't like (see e.g. operation choke point) - but without any of the accountability of an actual government agency. Having the processor be the actual government subject to FOIA, equal protection clause etc. would be a step up.

Re: The underground world of credit card network exploitation

#229
post #83

Earlier quoted context omitted.

In my view, the U.S. is leading the way in this area. Europe seems to be shifting the burden of fraud prevention onto customers with methods like SMS notifications and pins. In contrast, in the U.S., banks and businesses are primarily responsible for dealing with fraud.

It's not leading the way technically but for the end consumer it might be better. If I get charged unfairly my bank will tell me to go to the police. Americans can easily just refuse it.

When you pay with a credit card, your bank is jointly liable for the goods or services delivered.

It’s easy enough to get your money back when something goes wrong while being less open to abuse.

Re: The underground world of credit card network exploitation

#230
post #17
post #8

Earlier quoted context omitted.

It is just lobbying preventing good policy. If we moved to chip + pin, we'd get rid of almost 100% of CC fraud. But retailers don't want the friction so instead the consumer pays for the fraud instead.

Why do you think this requires a government mandate? What evidence do you have of counter-lobbying as opposed to simple consumer and retailer preference?

> Why do you think this requires a government mandate?

It's a classic tragedy of the commons situation (inverted, like the economics textbook example of a lighthouse), to which government intervention is the classic solution. Fraud prevention benefits everyone, but any individual actor is better off skipping the fraud checks.

Post reply on HN