Comment by defterGoose | Hacker News Reader

Comment by defterGoose | Hacker News Reader

This very program by visa allowed LA Fitness to steal several hundred dollars from me after I thought I had unsubscribed (they are also known for being unscrupulous about customer subscriptions). I thought I had cancelled my account, and was unworried about them continuing to charge me because I had recently gotten a new card number anyway. Well, unfortunately WF/Visa had given them my updated card info without my knowledge at a time when I didn't check my statements for several months (I audit charges MUCH more regularly now). They had kept my account active because I hadn't realized how convoluted their "unsub" process was and hadn't jumped through all of their over-the-phone hoops. Long story short I was out several hundred dollars over the course of almost a year, and the CC people were unwilling to help because the charges went undisputed for many months. A very angry visit back to the LA Fitness location was the only thing that remedied the continuing subscription, but I never got my money back. Caveat Emptor.

I worked for a small local company that stored credit card details in plain text. Including CVV. I brought it to there attention and the owner just hand waived me off. “The working system was working”.

This is why cards like The Apple Card, which allows you to generate cards on the fly, is better for consumers. Just generate a card for LA Fitness and delete it when you close your account. This would eliminate a big chunk of fraud (including the shady shit LA fitness does) when your card details are sitting in many databases (some of which are not encrypted in anyway).

I’m not saying Apple card is great, just that feature of it.

That's a great feature and one I was looking for two decades ago - glad that somebody is finally using technology to empower users in this way and it should be the norm for all online card usage. I just lament that it has taken a 3rd party card offing to accommodate this and it is not being driven by the main card players (Visa, Mastercard).

Banks have offered virtual credit cards for many years; in Portugal it's been available since at least 2006.

Many banks (Citi, for example, has it at https://www.cardbenefits.citi.com/Products/Virtual-Account-N...) have offered this for almost a decade. Visa and MC both support it at the network level globally, and are in fact the reasons that virtual account numbers work.

Consumers have routinely ignored this feature. Like so many security things, it's just not sexy enough for them to care and take on the hassle of older clunky solutions. The rise of digital payments and the movement away from a plastic card is making this much easier on people, by embedding the virtualization in the flow automatically instead of making users take steps to generate and manage.

But those who cared could always do this. It's just that so few cared.

The last time I tried citi virtual card (1-2 years back), the interface was useless to be helpful. It ate up so much time to setup or verify card details that I did not want to use it. And then once when a merchant was declined, for no reason, citi customer support did not understand virtual cards themselves.

Too few creditors offer the feature even though the networks support it. PNC wouldn't, their customer service lady looked at me like I had three heads when I asked her if they supported it. Amex's blue card used to and may still support one shot numbers that were very easy to generate online. Capital One's "Eno" browser plugin generates merchant-specific card numbers but the plugin makes it difficult to generate numbers to use off-web although the backend validates the merchant name and rejects charges that don't match the expected merchant as I discovered with a Dell-bound number on the Dell factory clearance site.

Capital One once denied me the ability to pay for a hotel room in Canada, after I had explicitly contacted them in advance with my travel plans, had booked the plane tickets on the same card, and paid some small items in the airport back home and upon arrival. Given how many transactions they process it should have been abundantly clear I was using my card in a normal manner.

I would never trust them to handle anything more complex like virtual card numbers.

For me it is the first time I'm aware of it being offered in any form, though I'm in the UK and gave up upon credit cards years ago. But certainly from my perspective and online and tv adverts locally, i've seen nothing and I certainly would of noticed that or of watched the whole youtube advert without skip as something I'd be interested in.

Glad that its a bigger thing than beyond Apple, so I'm wondering if it is a case of it being a customer ignored feature, or case of it and it's virtues being bestowed upon the customer. I can't say how customer relations and usage of such features and how the customer is informed in America. I am aware though that credit card usage in America is more prevalent than the UK. Least that was the case years ago, may of changed. Certainly debit cards are more utilised in the UK and may of become more common in America.

Though it does make a credit card more palatable for me again, so thank you for making me aware of this, shame all those credit card spam and junk mail offerings never mention such a feature, but I'll shall enquire.

Privacy.com does this too with debit cards for free. You link it to a bank account, and it generates disposable card numbers that can be locked to a given merchant and given a maximum amount that can be charged at once before they decline.

+1 to Privacy, it's great. I believe they also give you 1% cashback when you sign up (at least based on the page cashback.privacy.com).

Note that with the Apple Card, while you can regenerate the number, it shouldn't be used in the same way as Privacy/other virtual card services. See this TC article[0]:

> Card numbers are manually regenerated only, and do not automatically rotate. There is, currently, no single-use number support or single-merchant number support.

Also, it is very likely the "regenerate" function will send your new card to Visa/Mastercard's card updater service.

0: https://techcrunch.com/2019/03/28/how-apple-card-works/

How is that even possible? it's direct PCI DSS violation! Is not there any supervising body?

Volume is too low, but if there is a breach the business is done.

Unless you are a big company, PCI-DSS is "verified" by self-assessment. They can say whatever they want.

> This is why cards like The Apple Card, which allows you to generate cards on the fly, is better for consumers.

Capital One has a browser plugin called "Eno" that allows one to do something very similar to what you're saying.

Capital One has a Chrome browser extension that will detect when you're on a payment page and suggest a one time generated card number.

Gyms always run unsubscribe scams like this. It's rife here in the UK. After getting screwed similarly I said fuck it and just run around the local park.

Is there something like a small claims court you could take this to? The case seems decent - they have a convoluted unsubscription process on purpose which misled you into thinking you unsubscribed, and you didn’t use their services after that.

I'd be supprised if this is not in violation of some law or another. Consumer protection isn't that bad in the UK and if I was in this situation then I'd start with the police as this is however you dress it fraud. After all they took money they had no legal claim in taking as the agreement had been canceled.

How much do you want to bet the LA Fitness contract includes binding arbitration?

Apparently gyms are increasingly using formal contracts at signup which stipulate this convoluted process to exit the contract.

Good luck winning that in small claims.

Would it stand in court though? Wouldn't the court see the bad faith behind the terms, given they were designed to mislead the customer as opposed to having a legitimate reason behind them?

Reply on news.ycombinator.com