> But without a credit card, they wouldn't even have been able to get your money without authorisation. I don't see how something like this would have been possible with a system that requires explicit authorisation per payment.

I don't understands your point. Are you saying the ideal scenario would be to fill the cards information each time? The fact that it's a credit card doesn't change that it was prefilled, a debit card or wire transfer is the same. Credit or not, if it's already there, the one that access your account can use it.

With a credit card though, you can do a chargeback, which not only give you your money back, also add a direct cost (and a steep one from what I understood) to the merchant that made the transaction. As far as I know you couldn't do the same with a debit card.

What I mean is: with a credit card, you submit the information necessary to make the payment, to the merchant you're buying from. They could store that information and use it to make payments I never authorised, which is bad. On the Web, some sites have fortunately delegated that responsibility to a payment provider, but the payment provider is still not my own bank.

When I pay with my bank card with an internet payment through my bank, the authorisation is handled by me and my own bank, and nobody else. Nobody else can ever make that kind of payment without access to my password and my 2FA system. That's how it should work.

A few years ago, I made the mistake of buying some furniture using my debit card instead of credit card (about £1k).

Between the payment and the delivery the company went bust.

I though I was out of the money, but after a brief search I found out that, although there is no legal requirement to do so, VISA in the UK offers (or at least used to) the same chargeback facility to debit cards as for CCs. I visited my bank branch which gave me a phone number to contact, sent in a bunch of paperwork and after about 2 weeks I got my money back. I was very pleased as you can expect.

They could require the CVV when delivering to a new address - it's only three digits. But we're talking about a company that doesn't even refund obviously fraudulent transactions, so never mind.

With a credit card, (at least in the UK) you can cancel a transaction post final authorization.

In this scenario, the bank is jointly responsible for the transaction, and should refund you if the transaction isn't completed satisfactorily

Little confused as to why you chose their comment as the place to mention this downside.

Their story is about a situation where they gave explicit authorisation. They intentionally paid.

That's true. Being able to undo an authorised payment if the other party doesn't fulfil their end of the bargain is absolutely an advantage over other forms of payment.

In the Deliveroo case, however, it's the inherent insecurity of credit cards that made that problem possible in the first place. In light of that, the ubiquity of credit cards for online payments where data is so easily copied and leaked, never ceases to puzzle me.