I'm not sure how much extra I pay but the hassle free peace of mind I have seems worth it.

The last link the in the chain of payment processors pay for it.

"Hassle free peace of mind" meaning you do not need to remember a 4 digit code (or clicking "yes" in a phone app), while you need to check your credit card transaction list regularly to reject fraudulent transactions?

I find the effort of remembering the 4 digit code/having the phone much smaller than the alternative ...

I think OP is talking about never being liable for fraud

I’ve never had a card stolen where either of those would have helped - they’re stopgaps trying to avoid upgrading the banking system to use public-key encryption with reuse protection.

A couple of times, merchants with my card on file were compromised. The thief could make charges because the merchant had to be able to as well. What would have stopped that would have been having a way to restrict a charge to a particular merchant so the attacker couldn’t have been able to get the money out.

Once, my supermarket had skimmers. A code wouldn’t have been effective unless you were very good at spotting where the thieves planted cameras, too. An active MFA prompt would help against attacks at a substantially later time but it’d have to include the merchant name in an unspoofable form to prevent real-time attacks so I wouldn’t be asked to approve charges from SAFEWAY_, and that old-fashioned style of MFA is painful: it’d always make checkout slower and you’d have some fraction of people who don’t have phones with them or just ran out of battery.

What completely solved this problem for me was the modern tap systems (ApplePay). It requires more smarts on the client but means that I have to approve each transaction and the value the card reader gets can’t be used anywhere else.

>What would have stopped that would have been having a way to restrict a charge to a particular merchant so the attacker couldn’t have been able to get the money out.

This is one of the primary use cases for privacy.com (if you are in the US). The virtual cards are either single-use only or they are merchant locked, plus you can set spending limits on the card. I use these for 100% of my online and recurring payment transactions now. The only downside is that it's linked to your bank account so it's debt transactions only, but that's not necessarily a downside to me.

Yes - it’s a neat hack to get some of the benefits without breaking compatibility with legacy terminals.

> upgrading the banking system to use public-key encryption with reuse protection.

This is exactly what chip and PIN does. The chip is a smart card holding keys; the PIN authorizes its use. Online, there is 3DS which can be used similarly.

We’ve had both of these tools for over 20 years now. It’s just a question of how much the industry is choosing to cater to convenience and backwards compatibility, i.e. a security/availability trade off.

In Europe, the regulator has made the choice for the industry instead.

> We’ve had both of these tools for over 20 years now. It’s just a question of how much the industry is choosing to cater to convenience and backwards compatibility, i.e. a security/availability trade off.

Exactly: it’s not like this was a technological breakthrough but that companies were trying to avoid breaking backwards compatibility - not just things like the readers but backend payment systems using something like fixed length records, but also restaurants needing to stop having a single terminal used for every table (this is why they went chip and no PIN).

Going back to the original comment, that’s the peace of mind benefit I see: those businesses can slack on security without me getting stuck with a potentially massive bill.

> that’s the peace of mind benefit I see: those businesses can slack on security without me getting stuck with a potentially massive bill.

That's a false dichotomy, though: Regulators can mandate merchants and issuers to make fraud less likely without allowing the liability for any remaining fraud to be pushed onto cardholders.

That doesn’t make it a false dichotomy. We have an existing regulatory model which absolves consumers of most fraud risk, and many people like that.

Sure, and maybe I'm misunderstanding you, but your point is that changing that model might make things worse for consumers by pushing more liability onto them, right?

I'm just saying that this isn't necessarily a consequence of improving fraud rates, although it's definitely important to keep an eye on issuers – I've heard about attempts to use it as an opportunity to limit liability in the past.

I think you misunderstood me. Peace of mind is in not having to worry about fraud being my responsibility to fight or dispute. I can call CC company or through mobile app, flag transaction, get my money back and never spend another minute on the issue.

Ok, but you have to worry about detecting fraud. Without a PIN/MFA attackers have it much easier time doing fraudulent transactions from the start => more time spent by everybody checking transactions.

And even if you have peace of mind, I wonder who pays for the cost of the fraud. I would imagine the bank will just pass it over to the consumer in some fees. So a system that reduce fraud (even if can't eliminate it completely) is still better in my opinion.

No I don't.

And that is in addition to the outrageous fees CC companies charge merchants. In the US it's typically around 2% of the transaction! The EU caps it at 0.3% maximum, which still seems like a lot when you consider how much money they move. That's another cost that gets socialized and passed on to the consumer of course, even shoppers who pay cash have to pay for this through higher prices.

People should know btw that with 3D secure the card owner can be held liable for fraudulent charges, because some banks have that in their terms for 3D secure. With phone 2FA all that needs to happen is you have your phone and wallet stolen. I've seen cases in the news where people lost thousands.

> With phone 2FA all that needs to happen is you have your phone and wallet stolen.

Are device passcode and app biometrics insufficient security measures in the event of device theft?

If you have your phone set to wake-up/show notifications on new messages, and your bank simply sends an SMS code as verification, then the thief can just read the message(s) when they come in and input them.

You have the option to hide the actual message, at least on Android.

Last I checked this was opt-in on Android; it's been default on iOS since I think 2017ish?

If they have your device pin code and your device, they have control of your entire digital life.

We’ve never been more vulnerable to petty crime.

Wild idea: What if secure digital payment was a public service.

FedNow:

https://www.federalreserve.gov/newsevents/pressreleases/othe...

Unfortunately not many banks support it yet.

I think "secure" is the key part that's missing here. There's no incentive for a consumer to use a payment method such as this when paying with a bank. The reason is that credit cards come with consumer protection that this just doesn't offer.

I don't think customer protection is necessary unless you are dealing with unusually small or shady companies. I live in Germany and do not own a credit card, they are uncommon here. Mostly we pay per bank transfer or debit card. Even with the possibility of fraud, this is probably significantly cheaper in expectation than paying a 2% credit card fee each time just to have the possibility of chargeback.

Have you ever considered that what’s keeping most companies proactively honest and consumer-friendly are consumer protection laws and regulations?

Have you ever considered that those don't require credit card chargebacks?

Of course not, but you made a different point in the comment I was replying to:

> I don't think customer protection is necessary [...]

Chargebacks are only one possible consumer recourse mechanism specific to payment cards. There's other means to keep merchants honest.

No thank you. This is how you get something like UPI in India.

https://news.ycombinator.com/item?id=36980279

> The EU caps it at 0.3% maximum

That's completely untrue. Most European businesses pay much more than that.

You're mixing up total cost of processing the card (which is what Stripe and other gateways charge) with the Visa/MC rent.

https://ec.europa.eu/commission/presscorner/detail/fr/MEMO_1...

"Therefore, the Regulation caps interchange fees for consumer debit cards to 0.2 % and consumer credit cards to 0.3 % of the value of the transaction."

The (now called) interchange fees go to the card issuing banks, not the card networks. Both network/scheme fees and processor fees come on top of that.

Hah, I found the focus on American banks funny because, the one telegram photo said to use the address of Paris France.

Let me tell you, on two different organizations I am part of, I have ran in the last 2 years, both got hit by automated credit card checking bots using French banks and alot of those cards succeeded.

(Of course there's a whole story about how both these orgs have resisted my previous warnings about hardening the payment sites...one of them even was still using Magento 1)

Was it at least one of the hardened forks of Magento 1?!

Your causality chain doesn't track for me. Here in Denmark we have the same consumer protections, the ability to do chargebacks and the (government funded) guarantee that the consumer does not lose any money if their bank account is drained. Yet we still have very strong protections at the time of purchase with mandatory chip-and-pin as well as 3D secure (which replaced Verified by Visa).

I don't really think there's a rational reason for why you don't have better card security in the US. You just seemingly don't want it.

My guess is the difference lies in the fact that the EU limits credit card fees to something around 0.5% That means the CC companies can't offload the financial burden of this onto the vendors (and they in turn onto their customers), which leads to them having an actual incentive to improve security.

> That means the CC companies can't offload the financial burden of this

Most CC company (CCC) revenue comes from charging the poor people who can't pay their bills ("interest"). Merchant fees are only a small portion of revenue for most cards [1]. In the case of Discover for example it's less than 10% of their revenue, and in the case of Amex it's less than 33%. Other cards fall in-between.

[1] https://www.valuepenguin.com/how-do-credit-card-companies-ma...

There's a recurring myth, very prevalent in the US, that credit card companies would prefer people who pay off their bills every month as cheap margin versus being predatory. It's bizarre, and as you've pointed out, completely unsupported by how they actually make their money.

Your link explains that the issuing banks charge interest, not the credit card companies - which are merely the payment processors. I don't know all of the companies listed, it's possible that some are two in one and have their own bank as well. Some payment processors are partly owned by major banks too. But take the largest CC company, Visa: They don't extend credit at all, they don't even issue their own cards iirc. All their profit comes from fees, because the fees are too damn high™.

They've successfully convinced the public of the opposite though. It's a very common misconception that only "suckers" who buy on credit pay for it and that everyone else is getting a free service as long as they pay off their cards in time. In reality everyone pays because the merchants have to pay those fees and they pass the cost on to the consumer.

I used CC companies loosely as in {issuing banks + credit card companies} and their collective profit model.

> In reality everyone pays

Not really, credit card companies give you cash back if you pay on time, which is percentage-wise similar to merchant fees.

This seems to ignore losses and credit risk entirely. Someone who pays off their bill every month has no credit risk and the fees earned are unimputed revenues. I’m not saying their analysis is entirely wrong, but I would expect unsecured credit losses to be fairly high in the consumer credit market.

The incentive for payment providers to improve their security is a regulation called PSD2 which directly requires strong customer authentication.

Did you ever try a chargeback? With EU banks, it’s a bureaucratic process in my experience, filling forms, dealing with humans, waiting for merchant response, proving contact with them etc. US banks seem to operate on a magic word “chargeback”: you utter it, the charge is reversed, done.

As is often the case, the answer to the European asked question of "Why don't you just _____" is not "We seemingly don't want it", it's "America has a population 66 times that of Denmark."

Systematic change is slow and difficult. FedNow (secure, instant payments directly between accounts) was released 12 days ago, after nearly a decade in preparation.

Pretending that Americans just "don't want" more secure payments is just ignorant, in my opinion, and really screams that the author should spend more time with folks of other cultures.

That argument goes both ways: each country in Europe might be smaller individually, but at the same time I can pay with my debit/credit card all across Europe, and the same is true for each other EU country. And I still enjoy all of the aforementioned protections and services.

So despite the EU consisting of 27 separate member states, with their own banking systems, we still managed to standardize those banking systems enough to offer all of these services across the continent.

Americans (yes both Canadians and people from the states) are shielded from the chaos that happens to process a single transaction. They only see the paltry rewards in the form of 1-2 (maybe 5) cents per dollar charged, which is translated into "points" (1 cent == 100 points is what I have seen with some "premium" cards) and makes it seem worthwhile.

What they don't see is: the 3-5% or more markup of goods across the board (doesn't matter if you pay cash or card, especially for big box stores), the number of charge backs and the costs of dealing with it, fraudulent charges, poor security (places still accept mag stripe in the states), innumerable numbers of middleman to process transactions (bank fees, issuing card fees, network fees, premium card fees, ...)

It's fucking chaos. I hate it.

With FedNow, I am hoping that will change. Eliminate all of these middleman that are siphoning funds from people across the board. Eliminate the parasites. Eliminate the waste.

I expect it’s path-dependent legacy practices more than anything else. Credit cards were invented in the US, so the tech is old and upgrades take a long time.

For manual payments, UPI in India sounds pretty great. Apparently the customer approves each payment on their phone before it goes through?

UPI is a terrible thing.

0) makes every transaction a trivial SQL query away for the government.

1) everything needs an SMS code. Just as we are trying to get everyone off SMS 2FA

2) doesn’t work for non-Indian numbers or roaming devices

3) can’t get an Indian SIM without proof of address etc. No burners in India

4) regulation expressly forbids devic-local biometrics. This is why there is no Apple Pay in India.

5) Biometrics must be stored with the government. “Unique Identification Authority (UIDAI)” - https://studentbriefs.law.gwu.edu/ilpb/2022/03/22/regulating...

Credit card networks are already quasi-governmental agencies who block payments the government doesn't like (see e.g. operation choke point) - but without any of the accountability of an actual government agency. Having the processor be the actual government subject to FOIA, equal protection clause etc. would be a step up.

It may be a terrible thing but it has brought such a big change to the Indian economy. Imagine doing that in US which is a much smaller population and all you get is "choice" aka "freedom" to pay 3-5% credit card fee per transaction.

I'll take 3% over having a single payment processor I can't swap out.

The change to the Indian economy was going to come through private investment anyway but the government blocked that. So saying the change came because of UPI is disingenuous at best because it never had to compete with any other offerings. No other entity was even allowed to compete.