As in, weeks or months or years of discussion.

Not talking about credit cards thougn which are kind of a special case, where yes, totally merchant gets screwed.

And that's not a big problem even that it is not nice. The problem is when your company lends money to someone that says it's me. And it becomes my problem. Why?

The company wants a lot of conversions, so it has a low entrance cost. Then that company should pay for that problem, not unrelated third parties.

> Low trust versus high trust society is the thing you need to understand here.

For me, that's just one of the reasons.

Sweden, for example, is a high trust society. But companies are trying to play fair because they are going to be punished otherwise. Isn't that fair?

But, of course, in a society with a lot of corruption, and cheating, and low trust. Companies are going to defend themselves more. As they risk will get more fraudulent transactions that real ones.

All of this costs literal salaries of people who say "no computer says no" at every point. Those people also suffer risk of physical assault.

In the electronic space you need to pay for "social media consultants" and look after twitter and facebook and such. You would be surprised how incredibly expensive the things you seem to take for granted are, to a large organisation which pays proper wages to people.

Practically speaking if your personal details have been disclosed by some douchebag fucking company it is very difficult to distinguish you as a caller from some random internet asshole impersonating you.

Also i don't know have ever been involved in an "it upgrade" project and what it means to have the gas pumps now do different things. I want life to not be like that, but I think you would find its a bit harder than you are imagining.

The way those work in the rest of the world is basically by giro. You control your bank account, and the only possible transaction is you sending out money to other bank accounts. If I provide you a service I need to get paid, I send you a bill, either in paper form (that you can read with your smartphone) or electronically. You look it over and make the decision to pay or not.

The system is not perfect and fraud still exists (mostly in the form of trying to pass a fake bill as a real one), but fraud is much less prevalent than in the US system.

The problem is that that someone else can claim to be me at my address to you (the impersonator), you send the bill to me (the authentic). I look this bill over and decide not to pay because I didn't request these services. Now we have a dispute, all due a third-party who impersonated me.

Unfortunately, this is also exploitable by me to later claim I didn't purchase the service from you, which I might do to avoid paying.

There's currently no easy way for you, as the service provider, to authenticate the request without an out-of-band opt-in (mailing a contract to the same place you'd send the bill to confirm that the services would be paid for), which would delay the delivery of said services. By the time the third-party has received the services and you've sent the bill to the authentic party, the impersonating party is long gone, and the authentic party is left holding the bag as the less powerful party in the exchange/dispute.

I had the reverse situation as an American traveling to Iceland when no chip+pin cards were available to me. I picked up the rental car with an almost empty tank. They point me around the corner--the gas station is automated. I start driving the 50km to reykjavik and cross my fingers.

Later in the trip I get into a similar situation of an automated gas station in a desolate area. I waited until a local came by, offered them cash to use their credit card. They seemed suspicious like it was some sort of scam (I dont blame them), but thankfully that worked out.

I was stuck. I eventually found a shop inside that would sell me a bus ticket if I bought something else.

10101 and 01010 are also valid zip codes.

(00000 usually works too even though it's not a valid zip code)

Here's an arbitrary one I know exists: 85310. Try it next time and see if it works.

The problem with chip-pin, 2FA ...etc is that people would still be vulnerable to fraud. Except in those cases, banks can wash off their hands.

I lost my credit card recently and someone misused it. my bank reverted the transactions immediately. I know they got my back. It's the merchant or the merchant's bank that usually absorbs the cost. It's also a conscious decision the merchant makes to not check an id card for every single purchase. It's a risk they are willing to take and they probably take an insurance to cover for it. They are rewarded with reduced friction in transacting with them and hopefully better revenues as a result. I think it's a system that works good enough. Would I prefer something more secure like Apple Pay - 100%! But I'd take this over being checked for my ID card for any purchase over very trivial amounts.

Now, you may argue that it would never happen with chip-pin...etc. That's not true at all. There are people who can't remember the pin well and would choose to use cash or write the pin in a paper and keep it in their wallet. Exposing themselves to more risk and no protection from the card company either - "hey someone knew your pin so you are responsible for it".

I think with chip+pin it is at least a lot harder to be vulnerable. More and more credit card companies also have an app that you can easily report your card missing/stolen almost instantly. Also, if you have trouble with a 4 digit # of your choosing, then you should stick with cash which is still open to theft but not digital duplication.

[1] https://arstechnica.com/gadgets/2014/10/how-mobile-payments-...

[2] On top of that, Apple has introduced tokenization into its payment system. Like Google Wallet's Virtual Card, this obfuscates the user's actual credit card number, but it does so using a security standard developed by various standards groups and big-name card networks like Visa. It all happens without having to go through another bank as an intermediary supplier of a virtual card.

No? I kind of think of identity theft as any fraud where someone pretends to be someone else to the detriment of the someone else, who needs to deal with the consecquences of whatever the someone did.

There are phone payment methods like Apple Pay and whatever Google uses that protect your identity. The burden should be on the providers of these services to secure themselves.

In a high trust society you are extremely vulnerable to this stuff. Low trust societies do not have this problem in the same way.

The major problem really is that high trust society credit etc are optimising for sign up rate. Any kind of serious personal authentication mechanism will seriously impact conversion rate, which is the giant dashboard they have on the wall. There are whole teams of people whose job it is to make sign ups and conversions better. The fraud team is much smaller and as long as it doesn't impact the top line numbers too much they will be ignored.

It is to be discussed whether the increase in the cost of the service would be worth it though.