Hacker News Reader

Comment by pimterry | Hacker News Reader

It's reduced as a problem I think, and in general credit cards are certainly far less popular than in the US.

I suspect fraud is less of an issue because accepting signatures for card purchases hasn't been common for at least a decade (you need the PIN for all spending above the contactless limit - about 30 euros in most countries) and PSD2 (mandatory for transactions since 2020) requires 2FA authentication for most online transactions too. See https://en.wikipedia.org/wiki/Strong_customer_authentication.

That means copying or stealing a debit card, or capturing entered online card details by themselves won't get you very far in the EU, which removes a lot of classic fraud. In the remaining cases though, I have no idea!

View on HN

My impression was that because of the PIN used it was a lot riskier for the consumer with European cards: the credit card companies essentially said "the PIN was correct, so it could not have been fraud" so the default assumption was no fraud.

In the U.S. the system favors the consumer, so the merchant has to actively prove that it was not fraud (by default, this is definitely not blindly applied).

The signature part is one part of this, but the U.S. actually has laws in place to push this, and that largely has driven the non-PIN policy in the U.S. (since most of the anti-fraud pressure is on other parts of the system).

Yeah the PIN merely shifts the responsibility while adding a small additional protection. This model also adds a lot more friction online - you need to enter the pin again and it’s usually different from the offline pin. Overall, my parents’ generation simply can’t deal with all of this.

The customer still pays for fraud, one way or the other. So why not aim to prevent fraud in the first place by using a simple and effective second factor to mere possession of the card?

(1) Most people would rather pay the cost of fraud averaged across all accounts than suffer the risk of unlimited fraud against their own account.

(2) Putting the risk on credit card companies highly incentives them to fight fraud. This is ideal because they make the money and they are best positioned to fight it.

(3) Your premise is false to begin with. Higher fraud, like taxes, is payed for by some combination of the customers, the employees, and the owners (though actually it's more complicated than that due to contractual agreements: I believe merchants bear the penalty so we get recursive).

Even when the customer pays exclusively, there's a propagation delay that hits somebody else's wallet in the interim. (E.g., merchants don't raise prices immediately everytime fraud/taxes/wages increase.) It's a mistake to think of this as a mere transitory effect rather than a structural advantage that favors the consumer.

Are you arguing in favor or against PINs for in-store purchases? I interpret the first point as in-favor, but I suspect you meant it as against...

PINs are safer, and less fraud is better. At the end of the day, shifting blame and liability is not going to change anything.

However, using security factors like secrets or updating the withdrawal limit is possibly inconvenient, that's why some people rather not use them and companies are incentivised to just recover the relatively minor losses to fraud in fees.

I guess it comes down to the fact that in some countries people are used to having about five different cards, and in others it's close to one.

((1) is both disingenuous (ignoring sensible withdrawal limits) and mathematically wrong (unlimited fraud spread evenly over all accounts is still unlimited fraud against every account). I guess people would pay more to avoid surprises, but they'd like it even more if there was less fraud.)

(3) The point was more that someone will have to pay for the fraud that is happening. Deriving a structural advantage from not using secrets is far fetched.

Reply on news.ycombinator.com