privacy.com allows you to do this, you can generate virtual credit cards that are one use only, one source only, with spending limits, etc. The only gripe I have is that it's linked to your checking account and not your actual credit card.

I've heard a lot about privacy.com for this kind of thing lately (seems similar to bank of america's "shopsafe" feature?), and I have a question: even if your card fails to process, if you've entered a contract to a pay a subscription fee to a service provider, are you not legally bound to pay up? not that most services would bother trying to collect, instead opting to shutter your account -- but, in theory, is the legal liability still there?

Sure, and some companies could send you to collections or something similar, but not many would over a $10/month subscription.

More and more have realised that a $10/month subscription is actually the perfect thing to send to collections.

They sell it off to a collections company, often for $50 or more. That company adds fees, interest, and charges to the bill ($50 for each letter, etc), and finally takes you to court when the amount owed gets to $3000 or so.

The court can't chuck out those extra charges, since they can be seen as a legitimate consequential expense.

Except a $10/month Netflix subscription is not a lease, it's a prepaid service. They all state very clearly that if, and when, someone doesn't pay those services are no longer rendered.

The gym memberships could be different if the contract is setup to give you your first month free when you sign up for six. But even then most give you some guarantee such as "if you're not satisfied". I think your point is that this type of service creates a cat and mouse game with which there is only a temporary winner.

What I do like about this new "trend" is the abstraction of the end user. Netflix doesn't need to know who I am. If I pay I should be able to consume service. I realize this opens the door to more potential fraud for them, but the reality is the people commiting that fraud today are already using fake names, addresses and email. And if services don't have real information and single use card information when they get breached the value of each record is significantly less. So at the end of the day the inconsequential side effect seems to be a win from a breach cost standpoint.

I throw in a fake name and address

Thats the high risk strategy... After sending 50 letters and court summonses to your fake address, they finally get a court to order your ISP to give the real details, and suddenly you have a $10k claim with the added charge of fraud...

well see now thats mail fraud

Privacy only makes money from interchange so it's understandable that they wouldn't forego their revenue model by having to pay the interchange themselves (merchant pays interchange for each transaction). I assume this business model is also why it's not available in the EU, as they regulate Visa/MC by limiting how much interchange they can take.

It's because they're acting as a 'credit card processor'.

If it was card to card, they'd be eating credit card costs... they currently profit from your usage (interchange fees)

I figured that was the case, but I would seriously consider paying a reasonable annual fee to use my actual other credit cards, not every thing I buy online is cheap.

Love privacy.com, but I can't seem to use it outside the US :(

Would you be in a country that Revolut operates in? Not exactly the same, but you can get "Virtual Cards" that is different from the physical card attached to your account. You can change this "Virtual Card" after each purchase so the card number changes. Your name is still attached to the card number but if you dispose after use, attempting any additional transaction on it will fail. This will catch these free trial out and other fraudulent activity caused by sharing card details with shady online businesses.

This is likely due to anti-money-laundering / know-your-client (AML-KYC) US regulations (similar in many other countries).

Can you elaborate? I'm no longer US based, so it's not about me travelling.

It's weird that the app is still under his personal account especially when he just raised like 5MM from institutional investors: https://twitter.com/jbrowder1/status/1146544737622433792

> is involving third parties for app functionality (including the banking info)

like credit card processing the bank connection is something you want to be done via third parties. it would be a much bigger deal if he was intercepting bank logins and scraping.

In a lot of European banks, single issue virtual credit cards through app already exist.

I once worked at a large company, where half of the IP addresses in use were personally owned by one of the infrastructure guys

Why would they need your bank info at all, when the whole point of this is to not pay for something?

I can see putting in a real credit card for a subscription fee of some kind, but there is no way I'd give out bank info when the entire point of the app is to do exactly the opposite.

Because they are giving you a real credit card number with real charge capability. What if you use the CC to make an actual purchase?

So he can see who's charging you

Seems unnecessary. If the point is to not pay after free trials, why not just have a card that declines everything. It is still valid to sign up, but never will actually accept any payment request.

They go through Plaid, no? Isn't that safe?

if you hit a key on my UI I will know regardless of the intended receiver

I don't think that is true with iframes, which is what plaid uses to allow users to enter their banking information. So plaid still can get all your keypresses but an app that uses plaid does not.

To be clear you have to trust plaid, and you have verify that the web app is actually using an iframe and not just faking the plaid interface. But you are not just trusting a random web app with your banking credentials.