Maybe the next iteration of it will use SSL certificate hijacking, who knows?
I mean, this feature can be argued with from both sides: protection against scam and "UX MITM".
What I don't understand is why a web browser doesn't already include scam websites into their malware/badware reporting feature. It could have been so much easier.
In Germany we have a very restrictive law when it comes to imprints on websites, which makes it easy to spot scamming websites if you care to look for the legibility of the imprint (and required tax law identification numbers). Of course that doesn't apply for international law, but initially I didn't understand the importance of it...meanwhile I do.
If someone is scamming people, it wouldn't be too surprising if they do include the imprint or include incorrect data there, wouldn't it?
In imprints there's an address that you can lookup on the Handelsregister. If the HRB matches, and the Handelsregister's Domain for the company matches, too... it's usually an indicator that the website is trustworthy (at least from a legal sue-able-in-case-of-fraud standpoint).
Example (never used the website before):
- https://www.deerberg.de/service/impressum
- Northdata.de entry checks out (public webservice of Handelsregister entries), with same domain(s)
- unternehmen24.info checks out (another public webservice of Handelsregister entries), with same domain(s)
- HRB checks out, it's in Lueneburg
- DNS records and whois point out it's locally hosted in Lueneburg, too.
- Googled Umsatzsteuer-ID, no other (unrelated, scammy looking domain) results
- Googled HRB, checks out as well
- Google Business Page on Google Maps checks out as well (which might be hijacked, so not trustworthy as indicator alone)
- Geschaeftsfuehrer check out as well
So yeah, I guess this page/company is legit. You could do this further with LinkedIn and other things like looking up phone numbers in Breaches/Leaks and match the records with the Handelsregister.
From an automation perspective this is still a lot of manual research that's necessary; and I guess that this is kind of the real issue at hand - that most people are too lazy to do this sort of background check before they buy something online.
But I guess depending on the financial value you're willing to spend some background check beforehand makes more sense if a fraud would financially burden your means of survival afterwards.
To be honest that does seem like an awful lot of detective work especially if this would be for a simple online purchase, particularly if the transaction value isn't that high.
In many countries you would typically pay online using a credit card or Paypal in which case the card issuer/bank/Paypal provides you with a degree of protection if a product doesn't turn up or isn't what you ordered.
In Germany I believe people still are used to there being the option to pay using "Vorkasse" (paying in advance, by bank transfer).
I've simply never understood why any buyer would want to assume all the risk by doing that.
As for the question why people would choose to pay in advance? From my experience it was because they didn't have a credit card and didn't trust/didn't want to have a business relationship with PayPal, leaving Vorkasse as the only available payment option.
Another point that has been brought up was the perception that the bank transfer would be more secure, as in "if they have my credit card info/PayPal account, they can just charge me at any time". The fact that bank account information also enables you to debit the account is curiously often forgotten.
Is this a particular sensible position to take? Maybe not, but not everyone acts sensibly all the time.
Paying by bank account doesn't mean handing over bank account info. But the merchant just redirects to your bank as part of the payment flow. The bank knows how much money the merchant wants and you authorize it for that one transaction. Bank redirects back to the merchant who confirms the payment was successful.
They can't make any further charges at a later date.
Tell that to the people behind the "Sofortüberweisung" [ roughly: "Immediate bank transfer"] scheme - run by Sofort GmbH, now part of Klarna.
I've seen this offered several times but never (dared to) try it personally, but by all accounts* it works something like this:
At the merchant's checkout page you are offered choice of payment methods, Sofortüberweisung is on the list, you select it, then you end up on a third-party site(!) where you provide the login details to your bank account(!!) including PIN and/or one-time TAN(!!!). The third party site checks your balance, then executes a transfer to the merchant for the total of your cart, then confirms the transaction to the merchant.
When I first read about how this works, I assumed I'd understood it wrong. From a security PoV, doesn't this make one's skin crawl?
* sorry, pun intended ;)
With bank payments I just have to be careful to check I am actually at the bank website when entering the login info. Makes me feel more in control.
I guess people in the west were already used to giving out their card info over the phone to make purchases so wasn't a big deal when online sites started doing it. In India credit cards were still not wide spread (still aren't) in the early 2000s.
Even if you know that your card provider will refund you if the card leaks?
In the last decade I've twice had a credit card cloned, and twice I've been pleasantly surprised how quickly the card provider a) detected the issue, b) blocked the old card and re-issued a new card, and c) refunded the fraudent transactions.
Based on that, I'd trust my credit card provider far more than my bank(s).
Don't chargebanks typically involve a dispute between buyer and merchant? In neither of the instances where I personally experienced card fraud was the typical chargeback process involked, both times I had to confirm which recent transasctions were and weren't "mine", and after that the card provider did all the running. The second time I had many thousands of euros of fraudulent transactions refunded onto my account within 48h of the fraud being detected by the card issuer.
> your card issuer which almost always is your bank
Sorry, I wasn't very clear. I trust how credit-card-issuing-banks (in my case it was Barclaycard ie Barclays PLC) treat their card customers more than I trust current/checking/giro account banks treat _their_ customers.
It makes a lot of sense when you think about the underlying incentives to treat customers well.
Changing your current/checking/giro account can take quite a lot of work and has the potential to cause problems for a long time.
Applying for a new credit card takes a few minutes and the entire process is complete in a few days.
But this is also the case when you allow your bank to aggregate info from other banks. At least you can hope that they protect it somehow (because of bank regulations, but this is a very thin hope)
It's nice that it works that way for you, but it does in Germany. You don't need to hand over your login information or anything, but wiring money in any form means that they have your account number. The account number is sufficient to debit the account at a later point. Obviously they're not allowed to do that without your explicit consent, but a malicious actor could.
If you do not, you reject the payment and it is now the bank problem.
An IBAN is never a secret.
The authorization from the person being debited is required but in practical terms it does not always happen. People request DD and then forget to make the paperwork (today this is better because more and more DD agreements is arranged electronically). The bank will the allow the DD without the paperwork to make it easier for everyone (and ask the case to be fixed). In any case this i stheir risk but in the vast majority of cases it works.
Absolutely, but the same is true for credit card charges as well. Your acquirer will terminate your contract if you make fraudulent charges against credit/debit cards.
I am not arguing that you shouldn't wire money or use direct debit. I am just pointing out that it carries much of the same risks to the consumer as using a credit or debit card. (Which is virtually none since you can have charges revoked.) This observation is, in my opinion, relevant since many people in Germany seem to think that one is much safer than the other.
So if I find your IBAN, the work I would need to put in place to get money from your bank would be enormous (= securing the DD arrangement with the bank).
If I know your CC number, I can easily cash it out (by making a payment out of it, or to register a PCI account (eg. with stripe).
I fail to see the difference here. If I have your IBAN and you haven't universally disabled direct debit on your account I can also use it to pay for something, for example by ordering anything I want from Amazon.
> eg. with stripe
Funny that you should mention Stripe specifically. You can accept SEPA direct debit payments with Stripe: https://stripe.com/docs/sources/sepa-debit
It is possible that the compliance requirements around this are slightly higher than for accepting only Credit Cards, but looking at the documentation I don't see any indication of this. Further, credit/debit card payments are subject to SCA whereas direct debit is exempt from SCA if the mandate is given directly to the payee without involvement of their PSP.
Bank account details aren't typically regarded as (worth keeping) secret, to the extent that many businesses are happy to stick their IBAN on their website.
Credit card details, on the other hand, aren't ever published in this way.
This is precisely my point. People are not terribly worried about others (including merchants) knowing their IBAN. They are worried about their credit card.
However, a malicious actor can cause you much of the same trouble with your IBAN as they can with your credit card number. It is therefore illogical, in my opinion, to be worried about one much more than the other.
> to the extent that many businesses are happy to stick their IBAN on their website.
These accounts almost always block direct debit, therefore they don't run these risks.
I disagree with this.
A malicious actor may be able to cause some trouble if they have your IBAN, but it would appear to be significantly harder to steal money _and get away with the crime_ using an IBAN compared with someone's credit card details.
In the Jeremy Clarkson story from 2008, someone set up a direct debit to a charity using bank account details.
Given the hoops you have to jump through to be able to be able to set up a direct debit - and knowing that KYC would apply to the receiving bank account - it would appear to be significantly harder to profit from money withdrawn in this way.
With a stolen credit card you can purchase something online from a merchant that isn't obliged to do any KYC checks and the fraudster is gone long before the crime is detected.
[It's a while since I lived and worked in Germany] are there many people who have a current/checking/Giro account but where this isn't a standard payment card linked to their account which is also a Visa or Mastercard compatible card?
I'm sure you understand this better than I do (and I don't just mean because the language!) but aren't banks like Sparkasse offering any online payment functionality with Girocard ?
eg:
https://www.sparkasse.de/unsere-loesungen/privatkunden/bezah...
"Mit giropay können Sie sicher online bezahlen" (freely translated): "you can pay safely online with giropay"
I would venture that the intersection between people who prefer to wire the money in advance and people who do not use online banking is quite big.
EDIT: The old iteration of giropay (I'm not yet familiar with the new one) was quite similar to Sofort (previously Sofortüberweisung) except not run by a third party, but by your bank. It executed a normal wire transfer and confirmed to the merchant that the transfer had been ordered. In that sense it has the exact same risks as normal "Vorkasse", but did not incur the day of delay for the transfer to go through.
The only parallel that comes to mind are all the "helpful" clickjacking toolbars in Internet Explorer that tried to push every search and every link to their own results page.
Example: https://i.imgur.com/KludkrC.png
Look... I try not to be too judgemental and keep these types of comments to myself, because generally speaking, breaking new ground is hard.
But that statement right there is one of the worst solutions looking for a problem I've ever seen, and even a moment spent actually thinking about the URL, what it was originally for, how one explains it to someone not indoctrinated into tech or the Net, and how the URL has been repurposed and overloaded to be a drop in replacement for implementing Remote Method Invocation through SOA should reveal what the real problem is.
Example:
Me: Okay, Unusually Observant Gram. This is a URL. A Uniform Resource Locator. Think of it as an address to a webpage. It specifies a mechanism for retrieving something in a computer network. If you put in the same address, you'll come to the same place.
UOG: I've heard of the www.com thing before, but what's the http:// and the bunch of slashes afterward? And what's with the question mark I sometimes see after the slashes?
Me: The http is the part that specifies the protocol, or how you tell your computer how to get what's at the address. The slashes are the path under the domain, which is the www.com part you're familiar with.
UOG: How, pray tell, am I supposed to know what the right way to tell the computer to get what is at that address is if I haven't even been there to see what is there? And you didn't explain the question mark.
Me: Well... Good question. Good question. You see, it's fairly rare that you just go visiting one of these places without hearing about it first. So the person giving you the URL just tells you that to save you the trouble. The question mark starts what is called a query, which is a list of named data values you're bringing with you for when you arrive to hand to what's there. If the domain is the building, the path is directions through the building, and the query is extra stuff you give to the person serving the page to do something with.
UOG: Wait, I have to give them something? How do I know what I need to give them so I make sure I have it before going through all the work to visit them at their address?
Me: <Awkward pause> Well, normally you don't, actually. You either figure it out by trial and error, you read about it somewhere, or they design their webpage in such a way that it knows all that and does it for you.
UOG: I thought you said it was an address? Like a place? That I visit? Then follow a series of directions within, and sometimes have to bring something with me, that I don't have any way of knowing about until I visit, and end up embarrassed because I have to turn around and go get what I didn't know I had to pack. Now you're telling me not only is it a place, but somehow that place can itself move, to visit another place?
This does not sound like an address to me. This sounds like there is way more to it than that.
Me: You're enjoying this way too much.
UOG: Immensely. Please continue explaining. I still have a ball of yarn that needs to be turned into a sweater.
Me: Okay. So... Yes. All of what you said is correct, but you seem to be conflating the place led to by the address with the thing actually at that place.
UOG: Oh, that makes sense. Alright. Where is www.example.com? What's around it? Who are it's neighbors? How is the neighborhood?
Me: Okay, the address analogy is getting a little thin. It's not like you can see nearby things from any of these, except through links embedded in the thing-that-is-at-the-address. In fact, if you change even one letter of the address, you'll either not get anything, or you'll get something completely different than what you were looking for. Like you could end up on the other side of town, or in a completely different city.
UOG: Oh my! Surely there is a way to tell when this has happened? Like, I should be able to see exactly where one of these lynxes you're talking drags me off to?
Me: I see what you did there, and no, there is no guarantee. In fact, some people intentionally set up malicious things at addresses that are easy or frequent typos of another address, and make the page you see as similar as possible to the untypo'd address in the hopes you might disclose valuable information without noticing the mistake you made in the address.
UOG: Wait... People trade in these addresses? I thought you said if I went to the same address I'd get to the same thing! What if the owner changes of an address I rely on? This seems really confusing, and like even less of an address that can be relied upon for producing consistent results. This seems like it's only a bare thread away from unravelling into a big mess.
Me: Like your sweater?
UOG: Shush.
...I mean, I could go on writing, but I'm willing to bet anyone should be able to recognize the problem was never the protocol, or path, or query part of a URL that caused confusion, it was the domain name itself. It completely clashes with most humans innate understandings and heuristics involved with navigating in the Real World.
So ironically, they took information that could be usefully applied to giving away a fraudulent address...to only display the most readily misread bit of information with the fewest guarantees that where you're visiting is actually the same place you want to be.
It only gets more confusing once you start trying to explain DNS and how they that control the DNS servers determine where requests by everyone else land, because there's actually this other address underneath it called an IP address...
Honestly, I should just write a book at this point.
So it's less a street address and more of a mobile phone number.
Your grand should probably understand that metaphor better since I'm sure she's had multiple experiences with phone numbers changing hands over the years. And called people on their cell phones while that person is in different places. Or had different people answer the same number if the owner of the phone has entrusted the phone to another person or maybe even forwarded their number temporarily.
For me, I see the domain name as the sign above the shop front.
e.g. "https://www.ghacks.net/2020/06/15/google-to-test-simplified-..." -> "ghacks.net"
> The reason for running the experiment, according to a developer, is that the display of the full URL makes it difficult for the average user to distinguish between legitimate and malicious sites.
From https://www.ghacks.net/2020/06/15/google-to-test-simplified-...