Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A simple solution to credit card fraud, and why you won't see it any time soon

blog.rongarret.info

Post reply on HN
Print view View original

61–70 of 130 posts

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#61

Post by mieses »

drucken wrote: post #48

Overreacting, shallow, misleading and bait-link article. Overreacting: - the most up-to-date technologies for anti-credit card fraud, namely variants of smart card/EMV, are already available and widely used by all the large credit card providers and banks in the EU and Asia (excluding domestic transactions in China and Japan). There are even US providers who use it in some situations. - in addition, most merchants in…

"he made no case for how HSBC money laundering.."

Banks make money on transactions regardless of whether they are fraudulent, criminal, or not. I think the argument is that as long as banks profit from illegal activity (identity theft) they have no incentive to take steps to reduce that profit. They lose money if the security is too strong or too weak. Apparently the security we get is just right (for the banks).

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#62

Post by lisper »

drucken wrote: post #48

Overreacting, shallow, misleading and bait-link article. Overreacting: - the most up-to-date technologies for anti-credit card fraud, namely variants of smart card/EMV, are already available and widely used by all the large credit card providers and banks in the EU and Asia (excluding domestic transactions in China and Japan). There are even US providers who use it in some situations. - in addition, most merchants in…

Cut me a little slack, OK? This is just the beginning of a long story.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#63

Post by jeremyjh »

EMV is happening in the United States; the industry does recognize the problem though I agree there are poor incentives to make progress in solving it. It is late in starting and going to be slow and that is for some of the reasons OP states.

One thing that is now changing is that responsibility for charge-backs is going to be moving from the merchants and card issuers (who do bear risk in ATM transactions, for example) to the acquiring point of sale network, operator or ATM. In order to prevent that from happening, the operators are being required to support EMV in X% of devices by Y date. MasterCard has a write-up of this here: http://www.mastercardadvisors.com/_assets/pdf/emv_us_aquirer...

You can Google "EMV acquirer risk" to find more on this issue.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#64

Post by sjmulder »

conorgdaly wrote: post #46
jarrett wrote: post #14

To expand upon the author's idea, the problem is not just that credit card data is reusable, but that possession of credit card data amounts to permission to charge any arbitrary amount to it . Not legal permission, mind you, but permission in the sense that the infrastructure lets you do it, and you have to sort out the consequences through social/legal channels after the fact. Not only should future payment systems…

I agree with your solution of an affirmative step. I can see internet credit/debit card transactions moving towards a "request for funds" model where the consumer(via smartphone) has to explicitly ok the transfer of funds: Merchant - (RFF) -> Bank - (prompts for auth) -> Consumer - (grants auth) -> Bank - (RFF granted) -> Merchant Of course, smartphones are still potentially insecure, another more cumbersome model co…

The system that I think you are describing is already out there. I can’t speak for other countries but here in the Netherlands, the banks have standardised on “iDEAL”.

When you’re on a website and want to make a payment, the site makes a request to the bank, which then presents you with whatever method of authentication your bank uses. Generally this is some two-factor system. After giving the OK, you’re redirect back to the merchant.

Actually, it would seem to me that PayPal is very similar.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#65

Post by Domenic_S »

nitrogen wrote: post #51
bradleyland wrote: post #49

Earlier quoted context omitted.

> possession of credit card data amounts to permission to charge any arbitrary amount to it The word you're looking for is "capability", not permission. Permission requires consent, which is something you give separately from the actual card number. A minor point, but I think it changes the tone of that statement. > possession of credit card data amounts to the capability to charge any arbitrary amount to it I'm not…

Ugh, no thanks. The system you describe is more like cash. I have to actively dole out the necessary amount, and then receive change that is counted at each transition. I abhor these types of transactions. Not in this case. There's no reason the merchant can't send a request for a specific amount, encrypted using your credit account's public key and signed by their private key. Your credit authorizing device (smartph…

Aren't you basically describing the "Request Money" feature of PayPal?

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#66

Post by jpalomaki »

I think it is incorrect to say fraud is not costing credit card companies money, because they can transfer the cost to customers. If there was less fraud they could easily keep the transaction costs on same level and pocket the difference.

Some finnish banks introduced a "verified by Visa" scheme where you need to verify online transactions with one time password (those are normally used to log into online bank account). At least for me the result was that now I choose PayPal whenever possible, since PayPal allows me to pay with just username and normal password.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#67

Post by rm999 »

jarrett wrote: post #14

To expand upon the author's idea, the problem is not just that credit card data is reusable, but that possession of credit card data amounts to permission to charge any arbitrary amount to it . Not legal permission, mind you, but permission in the sense that the infrastructure lets you do it, and you have to sort out the consequences through social/legal channels after the fact. Not only should future payment systems…

I used to work in the credit card space, and what I witnessed is that the industry is adamantly opposed to anything they perceive as inconveniencing customers, at least at point of sale where they are competing with cash. In fact, Visa and Mastercard explicitly don't allow stores to ask for an ID with card purchases. This is why anything that requires effort from the cardholder won't happen soon.

Fortunately the anti-fraud solutions out there are pretty effective, which helps control the damage a stolen card can do.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#68

Post by danpat »

signed0 wrote: post #57
drucken wrote: post #48

Overreacting, shallow, misleading and bait-link article. Overreacting: - the most up-to-date technologies for anti-credit card fraud, namely variants of smart card/EMV, are already available and widely used by all the large credit card providers and banks in the EU and Asia (excluding domestic transactions in China and Japan). There are even US providers who use it in some situations. - in addition, most merchants in…

EMV only seems to secure offline transactions at merchants and ATMs. How does it protect information for online and phone payments?

As part of EMV, the liability is typically shifted to the merchant for non-EMV authenticated transactions. This provides strong motivation for merchants to do a better job of filtering out fishy transactions.

The only solutions I've seen to using EMV itself for online/phone transactions involve having a more advanced card (i.e. with LCD token readout) or a standalone card reader to interact with the chip.

E.g.: ftp://ftp10.us.freebsd.org/users/azhang/disc/springer/0558/papers/2455/24550388.pdf

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#69

Post by nitrogen »

Domenic_S wrote: post #65
nitrogen wrote: post #51

Earlier quoted context omitted.

Ugh, no thanks. The system you describe is more like cash. I have to actively dole out the necessary amount, and then receive change that is counted at each transition. I abhor these types of transactions. Not in this case. There's no reason the merchant can't send a request for a specific amount, encrypted using your credit account's public key and signed by their private key. Your credit authorizing device (smartph…

Aren't you basically describing the "Request Money" feature of PayPal?

No, because that only works through PayPal. This is more about a system that can be automated independently of the bank or service provider and provides independent cryptographic verification of transactions.

Re: A simple solution to credit card fraud, and why you won't see it any time soon

#70

Post by Domenic_S »

tlb wrote: post #31

There's a simpler explanation to why merchants don't charge extra for credit card purchases: The cost of accepting cash is not zero. The logistics of drop safes and daily deposits plus losses due to counterfeiting, robberies and pilfering can cost a similar amount to the 3-4% credit card fees. That's why merchants aren't grumbling too much.

Even simpler explanation: the cost of interchange fees are already priced in to the retail cost of goods.

In other words, cash buyers are subsidizing the interchange fees, your Rewards Points, Cash Back deals, etc.

This is evident especially at gas stations. Many have "cash only" prices that are lower than credit prices; Arco generally has the lowest gas prices but accepts only cash or ATM (with an additional ATM fee).

It's been policy for a while now that you simply can't charge more for (just) credit card transactions (you could however discount cash purchases). That landscape is changing recently [1][2], but we haven't seen its full effects yet.

[1] http://www.dailyfinance.com/2012/07/19/3-reasons-why-credit-... [2] http://www.dailyfinance.com/2013/01/24/new-credit-card-check...

Post reply on HN