Of course, this approach only works if you're happy to have your service cut off more or less abruptly if your card bounces, something the author of the article explicitly mentions isn't an option.

The problem (in the article at least) isn't being surreptitiously billed a large amount, it is cost of a critical service changing dramatically without warning.

They won't cut you off immediately and the gain you get is some breathing space/wriggle room to decide what your next step is going to be once you've been landed with a huge, unexpected bill.

Also, nothing gets them talking to you faster than a bounced invoice :)

Perhaps. Or perhaps they block or throttle your account. Stopping payment is the nuclear option, you can't expect any cooperation with outstanding payments on your account (not that you necessarily can with a fully paid up account), and your position, if you should choose to pursue legal action, just got a lot more complicated.

To be clear, the only time any of this matters is when a huge, unexpected bill arrives. Day to day, you should anticipate any big, legitimate bills and make sure funds are there to settle them (or you scale back usage to avoid getting smacked).

It's when a big bill lands in error or is introduced sneakily that having a separate "cloud only card" can save you. In that case, it's the supplier that's gone nuclear and you're just responding in kind.

Sure, but that's just not what we're discussing here. The author of the original article clearly authorised the increased spend (but obviously not the sudden change causing it), and could have declined (presumably at the cost of having his app throttled or shut down). Nothing about a "cloud only card" would have changed his situation the least.

Totally agree. If he/she authorised it after being given an opportunity to decline then, yes, it's absolutely on them. /me clearly didn't read the article ;)

I've had an invoiced account with AWS since 2007. We have been 9 months behind on payments at times and they have never suspended the account. Keep a line open with then and they will be reasonable. We are currently current with then but have been behind for more that 2/3 the history of the account.

> The problem [...] isn't being surreptitiously billed a large amount, it is cost of a critical service changing dramatically without warning.

Sorry, but this is the risk of using somebody else's service -- especially Google's -- as a critical component of a business. It may be marvellous for developers not to bother with infrastructure for their own service, but this strategy likes to come back and bite in the ass.

You always have to use someone else's service - even if it's just the electricty supply. But different services come with different risks, and you have to try to gauge them.

No, this is the risk of using somebody else's service without getting your rates locked in with a contract. You know, a Service Level Agreement? Those things companies used to sign with their hosting providers, before all this IaaS stuff made developers feel like they could "start using now, talk to legal later"?

In Sweden we have at least one bank that has e-cards where you can set up a new card for each transaction. You decide how long it is valid in months and for how much total and recieve a unique card number and ccv. I have been using this at least 15 years for payments online. You set it up, make the payment and then immediately close the card again if you want to be extra safe.

Unfortunately my bank (Nordea) removed this excellent feature and instead refer to having Visa 3D Secure verification, which basically only works in Sweden and is voluntary for the entity charging the credit card. Now I have to pay for two cards just to be able to do this.

Final is doing a take on this as well for the US: https://getfinal.com/

There's also Privacy:

https://privacy.com

I like the look of Final, but $50/year seem pretty pricey for a credit card. Why's it worth it?

Bank of America has this in the US.

Or at least they used to. I used to use it all the time on my Bank of America credit card but haven't used it in a few years. I just tried to use it last week and it seems like the option has disappeared. Maybe it's just bad web design, but I can't find it anywhere now.

Go to your credit card summary page and scroll down. There's a box on the bottom right titled ShopSafe.

For those interested in this concept in other countries, check out the SudoPay app which lets you spin up and spin down virtual cards just like this.

And before you get your hopes up, it's IOS only =(

Citibank does this as well, at least with my credit card.

Does anyone offer this service in Canada?

what is the bank name if i may ask?

Swedbank has provided this service for many years (https://www.swedbank.se/privat/kort-och-betalningar/kort/log...). You could also use one of the many independent sparbanker affiliated with Swedbank (they use Swedbank's platform).

I agree, let the providers take the risk. Typically, the providers will let it bounce a few times before cutting things off as well. This might just give you another week or two to sort things out, without having to lay out possibly significant funds that you may or may not be able to reclaim.

I only wish setting up virtual cards were as easy as setting up a new mail box. I know there are services out there that lets you do this, but I've yet to find one that works globally and is easy to work with.

To be honest, the best way is setting up a completely isolated account with card. If you're extra paranoid, use a different bank for this account.

To be honest, this all sounds like it should be a primary bank feature. I should be able to cap a recurring payment at $X for a specific vendor otherwise have it go through automatically.

My personal bank sort of gives me that with their fraud protection. If a one off huge charge appears from a company that regularly bills me (but at much smaller amounts), their fraud system sends a text asking if I want to authorise or block the charge.

The second bank account is really more for protecting you against black swan events. If all your accounts are under the same bank and have the same owner, there's nothing stopping the bank taking funds from one of your accounts to make up for shortfalls in another.

CaptialOne does this pretty well. So far it is the only bank I have come across would alert me they are blocking the transaction for a few days so I have a chance to review and if I don't they will release the block. Every 6 months or so they have someone called me up to verify recent transactions.

Hell, their mobile app alerts me the moment a recurring charge posts for a different amount than normal, if I put my NYT delivery on hold for travel or something I can guarantee the next two months I'll get an alert to review the transaction (though they don't outright block it)

I know that bank of america offers this feature on all its personal credit cards. You can create a temporary card number (and related info) as well as how much can be charged in a given month and how many months the card number should be active for.

The only reason I don't use them for everything is because I get better cashback/points with other cards.

This works well in India, with 2-factor auth — Indian companies can't charge my debit or credit card just because they have the card number, expiry and CVV. I have to approve each transaction with my bank.

I'm wary of giving my card information to companies outside India because I don't have this protection.

>Indian companies can't charge my debit or credit card just because they have the card number, expiry and CVV. I have to approve each transaction with my bank.

True for Indian companies but what if you get charged via Forex abroad? For me - Google or Steam - don't required 2FA. All I have to do is to enter my number, confirm CVV then zap. It gets debited. I do get a call from my bank (HDFC) asking if this transaction has been initiated by me, if I say yes, they let go.

Yes, foreign transactions are exempt, which is why I said I was wary giving my card to companies outside India.

My bad.

Isn't that effectively the same?

My bank (in Sweden) lets me generate virtual debit card numbers with a specified cost cap and expiration date. It's some ancient-looking Flash widget though so I suspect it's a legacy feature...

I'm in Sweden – which bank is this?

Swedbank. The feature is called "e-kort" and is found in the internet banking under "Kortöversikt".

The Flash UI looks like this http://mayoyo.tokyo/jJ7.png

They used to have a mobile app but it was discontinued since it didn't support 2FA.

I'm not in Sweden, but my Swedish bank SEB offers this. It's part of the "order a card" UI, not flash as the parent is talking about though.

That South African hackable (in the good sense of the word) bank that's been making the rounds on HN might be able to do this. (I forget the name of the bank.)

That's the one, thanks!

I applied for a new credit card with a low credit limit and I am using this card for all my SAAS payments

Well, that's pretty much what a virtual card is – you transfer funds to it like you would with any other bank account, and it's not in your bank. It'll be a debit card with no overdraft, so any charges over what is in the account will be denied. This won't fly with places that require a credit card, like car rental agencies for instance, but that's a non issue in this case obviously.

Definitely use a different bank. A friend had a separate checking account for their PayPal purchases. And when PayPal clawed back some money (as they are wont to do), the bank manager helpfully transferred money into the account to avoid an overdraft charge.

privacy.com?

Alas it's US-only[1], like so many other services:

> What countries are you available in?

> We're only available in the United States at the moment.

[1]: https://privacy.com/faq

emburse.com

Looks great, but like many other services like it, it's US only[1]:

> Is Emburse available outside of the U.S.?

> Only companies incorporated within the U.S. may register for an Emburse account. In addition, the primary account owner must be a resident of the United States with a Social Security number and a verifiable physical U.S. street address (no P.O. Boxes). We do not offer Emburse accounts to residents of Puerto Rico, Guam, the U.S. Virgin Islands, American Samoa, and other U.S. territories.

[1]: https://www.emburse.com/faq

This is excellent advice. In general, I've personally imported lessons about accounting controls I learned running a company to personal finance. Yes, it is a pain.

But Paypal, for instance, can only empty a bank account that is used for nothing else, any service like this (open-ended liabilities with shitty/no support) is isolated to debit cards, etc. Nobody gets permission to charge open-ended amounts to credit cards, and nobody gets automation rights to the "real" bank accounts, period.

There's a business model here somewhere for someone to automate all of this. It involves substantially more time to keep organized than my prior two-banks/two-credit cards model. Personal finance apps just aren't designed to treat, for instance, debit cards as transient.

As others note, sure, services that do something like this can still come after you. But who has the money in their pocket right now matters a lot when resolving disputes like this.

Or the bank can just automatically give you an overdraft for that amount, add some fees because you accessed that facility, and require you to pay the full amount.

After all, they're just being helpful in managing your money and paying your suppliers.

Can you not ask the bank not to do this, though?

Now in the USA as of 2012, banks cannot turn on overdraft protection on a debit card unless the customer requests. Prior to this they were taking your day's debits and applying the largest one first. So suppose you bought lunch for $10 and a coffee for $3 then your cable company later in the day billed you for an amount in excess of your account. They would then apply the cable company bill first, then the 2 smaller charges to maximize overdraft fees and hit you with 3 $30 charges.

The order wouldn't matter in that case, would it? Either way it's still deducting the sum of those three transactions at the end of the day.

I thought what they were doing is applying all your debits, charging you if that puts you into overdraft, and then applying any credits. If they applied the credits first, you wouldn't go below zero.

The order still matters. If you have $20 in your account and get hit with three debits for $6, $10, and then $30, processing them in order means the $6 and $10 debits go through, leaving you with $4 in the bank, then the $30 debit causes an overdraft and a single fee. Comparatively, processing the $30 debit first immediately causes an overdraft, and the $10 and $6 debits cause two more overdrafts for three total fees.

Either way, you're trying to charge $46 against an account with $20, but one method results in 1 fee and one method results in 3 fees. The issue of credits vs debits you mentioned can compound this issue.

I had this happen to me in real life, back as a broke college student. The difference is the number of transactions you get hit with the overdraft fee for.

Consider a bank account with $20 in it, the day before payday, when you forget your World of Warcraft subscription hits today instead of tomorrow. That's $15. But you buy:

  * Lunch: $5
  * Coffee: $2
  * Dinner: $5
  * A late-night snack: $5

Then, the subscription hits at midnight.

If the transactions happened in-order, the subscription causes the overdraft, and you're charged $25 or whatever (yeah they are very high). But in the way banks used to do it, they'd take your total ledger for the day, and order it by highest $ first. So, subscription first, $5 left. Lunch, $0 left. Coffee, dinner, and snack are three transactions when overdrawn, so that's $25 * 3 = $75 in fees instead.

Banks claimed that this process was because you'd probably want your highest-amounts paid first, as it'd be something like rent money. In the end, it means way more fees for them, though.

$75 in fees is especially brutal when you don't have much money in the first place; it pretty much caused me to not be able to even go to 7-11 for a candy bar for two months.

I have been told that that law only applies to consumer accounts, not business accounts.

Yes, you can. The last few banks accounts I've created have all asked if I wanted overdraft protection. You say "NO! decline ANY transaction that would cause an overdraft"

But they seem to be able to delay debits for several days, perhaps a week? At least on WellsFargo. Isn't this a backdoor/loophole to get around the no overdraft issue?

Not sure who you bank with but our bank will bounce it if honouring it would require going overdrawn beyond €500.

There are limits to overdraw facilities, sure. But they are also included by default in many accounts.

You can usually have them turn off the ability to overdraw.

This is why no reasonable person should use debit cards for recurring payments.

I'd advise not using debit cards for anything, under any circumstances, and relying on the better protections that credit cards provide, but it's a losing battle. My debit card is ATM-only.

You're right and the trick is setting up a separate account for the debit card (ideally with a different bank).

This is generally a good approach for all sorts of reasons, not just protection from over enthusiastic cloud bills.

Keep most of your funds in one bank (and never use the cards). Transfer from this account to one or more other accounts with other banks and use the cards on these secondary accounts to pay for things. This way you're protected from suppliers over billing and banks going crazy with unarranged overdrafts (which aren't secured so absolute worst case you just tell them to fuck off and default on it).

Basically, the trick is holding on to your cash. Much harder to fix things rapidly if you're having to negotiate with a third party between you and the supplier (which is the case with a credit card company).

Google stopped accepting my Debit card a year ago! Even after 14 months of calls / emails the issue is still here. I don't have other options rather than throw Google Cloud to the garbage bin (where actually it live).

Google's ahead of you on that one. They don't accept debit cards. (At least the last time I tried with Google Cloud)

Maybe you can use a credit card that allows you to generate virtual card numbers with dollar limits. I use one all the time.

Interesting! For AWS, DO, Linode etc, I use a debit card with no problem.

Edit: just remembered we're using Google's Cloud Vision API and that's billed to the same debit card. So, for UK accounts at least, they take debit cards.

Maybe it's a regional thing? Most banks here (Ireland) issue debit cards by default and most people don't go out of their way to get a credit card, so they'd be cutting off a large chunk of their customer base by banning debit cards.

Are your debit cards really just debit cards (i.e. bank-specific "ATM" or "client" cards), or do they work using credit-card payments infrastructure? If you plugged your Irish bank debit card number into e.g. Stripe as a credit card number, would it take it?

Most are visa debit. I think one bank issues a bank specific bank, or at least did a few years ago.

That isn't true. I use a debit card for GCP.

Does your debit card have a credit card number?

For Google Cloud can't you set a billing limit for it to not exceed? That's what I have done but I have not come close to exceeeding it yet so IDK if there is something I am missing.

You can. Beware though! It can take 24 hours to increase the limit - horrible if you get a sudden spike in traffic from, say, a techcrunch post or something.

Should be fine I think providing there are no circumstances where Google can decide to ignore the limit (don't have much experience with their cloud stuff).

I think these billing limits only apply to AppEngine services.

Ahh I think you are right. Just checked and you can set limits for App engine, but there are budgets in Google Cloud which is confusing and doesn't seem like it actually limits anything, it just keeps you notified of how much you are spending relative to your budget

Nowadays with some banks having virtual cards that you can create/kill at any moment, this sounds like a great idea.

I just started using privacy.com and so far it has been an excellent experience. They provide everything my previous VAN-providing CC company did, and more. The one and only downside is that at present, the VAN uses ACH debit to draw immediately any funds used; there's no credit as such (although they are looking into that).

EDIT: I have no affiliation with privacy.com; I'm just a satisfied user.

My preferred VPS provider (and DNS provider) both accept wire transfers, no card required.

Won't they legally force you into paying (assuming everything they did was legal)?

Yeah. This is where something like Final[1] would be super helpful.

1. https://getfinal.com

I thought either way you get oversrafted fee or at least in the case of a debit card unless the card comes with a cap limit.

Nope, debit card is not allowed

privacy.com