Illegal Life Pro Tip: Want to ruin your competitor's business?
oppositeinvictus.com
oppositeinvictus.com
7 days ago, boom. Your account has been suspended for not following the business guidelines. The only thing I've updated recently was our hours. It's been listed without problems for about two years.
Of course they don't tell you what the issue is. They just tell you to fix it and then beg them to reinstate you. It takes up to two weeks apparently (7 days so far). And if they decide not to, the only thing you can do is delete the listing, and two years worth of hard earned reviews go up in smoke.
A few days ago one of our staff told me a Korean tourist came in the day before we were suspended and accused us of being fake. I don't know exactly what happened but due to the tourist's limited English nobody could persuade them we were the real location. Or maybe they were looking for somewhere else entirely? Who knows. Apparently they left a negative review, which I can't see while the account is suspended. Probably they reported the location as fake.
So that's it. Two years, over 100 positive reviews sitting at 4.9 stars. Gone because of one confused tourist. Or maybe because I updated the hours. Or maybe an automatic spam check didn't like us.
I sincerely hope that the next round of EU laws tackles this instead of privacy. It's just as big an issue, especially if you're running a small business.
There's no way of getting this ban reversed, there's no way of invoking any human to perform a manual review on the ban. It is a permanent restriction that impacts her ability to communicate with her customer base.
You know you're doing it wrong when the the Ministry of Information in the movie Brazil has better customer service than you do.
Edit: add "the movie" to remove ambiguity.
How isnt that also true here? They're a private business, they have a right to kick you off by automated systems if they think it's cheaper to have a couple of errors in the automatic system than to pay for manual reviewers. Hey, they're a private business and don't have to justify themselves, right?
Care to explain?
But tivert didn't say that! tivert instead said "...the Ministry of Information in the movie Brazil ..."
chinathrow should read more carefully.
giardini said "> chinathrow should read more carefully."
tivert said "I will direct you to other thing I added when I edited what I said: tivert said 'Edit: add "the movie" to remove ambiguity.'"
If your country has a working small-cases court system, there are good odds you can achieve the same result without any lawyer involvement at all. But if you are discovering this from a random internet comment, you are almost certainly better talking with a lawyer about it anyway.
Call your US Senators and Representative. Explain the problem.
Call your State Senators and Representative. Explain the problem.
Contact the FTC and file a complaint.
Be sure to CC privacy@facebook.com and legal@facebook.com
Only issue: not sure that the GDPR applies to companies. And it's a 'pro' account I guess?
Recital 14 - The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.
This! Couldn't agree more. I believe this is a much more bigger, huge problem compared to privacy, which is preventable (users can choose not to use a service) but this can take down entire businesses because of data giants' crappy/false alerting systems.
It should be illegal for Google, say, to remove listing without proving, or if that's not possible, if they remove they should legally be forced to compensate for the damage done. (Of course Google is just an example here, applies to any large enough platform)
Maybe then they will take this serious.
By that logic you can just not use Google. But that's ridiculous, as ridiculous as the statement that users can choose not to use a service. I believe it's impossible to live in modern society without having an account in FAANG, even harder than a business not having a google maps listing.
For example, I went to visit the beach, which is on a national park. Parking required an app. There were park rangers there, the location was staffed, but they did not accept cash or credit card. Just an app. And there are two phone operating systems now, Apple and Android. So no. Can’t live without FAANG. I ended up downloading the app on the spot and purchasing a pass.
I’m sure the park service does this for their convenience. And it’s so populated near the coasts that if anyone doesn’t comply, they still have plenty of people who would gladly use the app. They can get away with demanding smartphone use. You can certainly get away with not having a smartphone further inland, and not needing to depend on FAANG explicitly. But I know this expectation is going to creep into the continent over time. In 5 years, if you say “I don’t have a smart phone” you’ll just be denied service. Period. No questions asked. And you will be considered the unreasonable party by most.
> In 5 years, if you say “I don’t have a smart phone” you’ll just be denied service. Period. No questions asked.
IANAL, but I feel like that should be illegal.
Sure, they can set up an app and those who want to use it may do so, but for things things like parking there ought to be an alternate. Beach, national park etc is a predominantly offline service for which it's absurd to insist on using an app.
Especially for something that's on a "national park" — I don't really know what the "national" part indicates (not from USA) but I'm assuming that the govt is involved.
Somebody should go to court.
The noose is tightening around the necks of those few of us who do not use smartphones. I hope a future wave of 'tech minimalism' gains enough traction to ensure that there are alternatives, but for now, as we ride the wave of tech-optimism and the mass adoption of intrusive technologies in the name of convenience or cost cutting, most people seem to see asking for alternatives as unreasonable.
There is an element of innate freedom in anonymous, analogue processes, even if they are not entirely 'anonymous' - such as writing a car license plate number on an envelope of cash for a drop box - it might as well be if the information is never entered into a searchable digital database where it will presumably be stored for eternity.
I few years ago I went camping at a state park in a system that had recently introduced usage fees (having always been free in the past). The state apparently partnered with some obscure parking app company to collect the fees. The use of the state park required submitting a considerable amount of information to a third party, with little or no information on how that data might be used, stored, or sold - in essence you had no choice but to submit to a third party's TOS in order to use public facilities at all. I did not like this at all, and having no smartphone, I paid cash at the manned office - only to have them collect my information and enter it into the parking app database.
A few months ago someone here made a comment in another discussion about having a pervasive sense that things are not quite as they should be. That stuck with me.
In the US, there are still large groups of Mennonites whose choices to avoid most post-19th century technology are generally well-accepted by the rest of the population, the best known of which are the Amish. They do travel around to varying extents, because not every Mennonite community agrees to what degree to avoid technology and under what circumstances - some have a community cellphone, some even have family cars (with a preference for less showy models); many are fine with taking public transit or hiring an "English" (non-Amish) driver. Individual smartphone ownership and use would conflict very strongly with what I understand of even the most "liberal" Amish communities, though.
There's got to be some sort of alliance that privacy-conscious techies can form with technology-skeptical religious communities, despite radically different worldviews.
Nooooo...this is dark UX to artificially increase the number of violators and collect more revenue.
I expected better from the park service but around here they've started making people enter their license plate number on parking lot passes too to prevent the time-honored tradition of sharing day passes. They're in revenue-generating mode these days.
Case in point:
I had to drop off a cashier's check at a landlord's office. Same deal-- paid streetside parking, but didn't realize it was app-only. I struggled with downloading the app on a crappy connection and couldn't successfully pay for parking after 45 minutes of fucking with it.
What am I going to do, leave? I drove an hour to get there and had 3 minutes' worth of business there. In the end I just ended up parking illegally.
To be any scummier, they'd have to implement paid parking at rest stops and ticket anybody who dashes past the meter trying to get to the bathroom before they piss themselves.
No you can't just use a web app.
Oh, this is completely possible -- I do it.
But it won't stop them from getting your personal data.
At that point, you literally cannot live as an adult in the society without FAANG dependence, even if it's a third party Android phone, at least not legally.
I've been using GrapheneOS with F-droid and Aurora Store without logging into a Google account for years.
I've yet to run into a single thing I either couldn't use or couldn't work around.
A lot of people talk about 'needing' a smartphone for services/stuff I have never used, and probably would never use. I suppose I just kept living my life as I did before the 2010s, while everyone else changed. I was already in my 30s at that time, so not subject to the same social pressures a younger person would have felt, so perhaps it was easier.
We can chew gum and walk at the same time, no need to throw privacy under the bus.
Giving your personal data to private companies, however, is a choice. You can simply not use their services.
I love this liberal argument. It's the sister argument of "Well, if you don't like YouTube censorship, then you can start your own YouTube!" It is truly out of touch with how societies actually function.
This argument only works when you have lots of market competition full of small players where it doesn't make any difference which service you use. But large corporations can effectively become something like public utilities that function like economic gatekeepers in a way that even governments are incapable of.
It is also hostile and encourages/enables the hostility of big players. My presumption is characterized by liberality, but it's a presumption, which means I default to liberality, unless there is a good reason to restrain it. Saying "just don't use it" can either be unrealistic, or something like a move of last resort. We regulate business and have always regulated business for a reason, pace free market extremism.
The common good is the concern of the law, and protecting the individual is for the sake of the common good. Start there, and you might take a different view of the function of economies in societies and how they may or may not be constrained.
If you don't want to be homeless, you're either renting or buying, and in either case people are going to be processing your personal data. You're also probably going to need a bank account, which you also can't open without handing over personal data.
If you want electricity, you're then dealing with another company that is processing your data. Same for water and gas and internet.
Sure, some things are optional, some things can be worked around by buying in person and using cash instead of buying online. But a lot of things are just not practically optional.
Good luck with that. I get that you can refuse to email anybody with a gmail.com address, but lots of people use Google to host email. You may not be willing to upload your address book to Facebook, but the people who also have you in their phone book have likely shared that with FB through Instagram.
These companies get to know you pretty well even if you never directly use their services.
There is no real choice in our modern society to "not give your personal data" to these megacorps.
I did not gave my data to TeleSign but apparently they have it. And my operator did not tell me.
This is what I do, but it certainly doesn't stop private companies from getting my private data anyway.
There is no way to opt out of this.
It’s not as simple as “don’t use them”
There's not need to pit fairness in business dealings against privacy. Both are wins for the average person.
At least in Germany, you can file for a court order ("Einstweilige Verfügung") against Google - that usually works out and is relatively cheap, a couple hundred euros. Consult a lawyer, I think most EU countries have a similar instrument. Do note, you might have to file for an order both against the Google Europe HQ in Dublin/Ireland and against your country's Google office.
And the privacy argument is often effectively countered with security concerns, even more so if that is expressly stated so in the ToS.
Just to be clear: I'm 100% on the GP's side, I'm just curious what the Verfügung could do here. In order for the court issue such an order, it needs at least a reasonable legal basis.
Once you have monopoly or near-monopoly, you become more like infrastructure, whether you provide electricity or access to customers.
At that point, you either have to expect to be willing to host anyone who stays within the law, or have the monopoly broken up.
Only the most hardcore market fundamentalists/objectivits tend to disagree about this principle, in my experience. (Which means practically nobody outside the US). Though some seem to be quite willing to accept abuse of market power if it primarily hurts their political enemies.
> Only the most hardcore market fundamentalists/objectivits tend to disagree about this principle, in my experience.
Even if the court agrees in principle, it still needs a adequate legal basis to issue an order. Violation of a law, or a contract, or whatever. I asked the GP, who seems to have experience with such cases, what this legal basis this could be.
The legal basis to intervene is there, but may be vague and open to interpretation.
For instance, a near-monopoly position might cause other regulations, like laws against unfair business practices to be interpreted more strictly than for other intermediaries:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02...
As long as the population within a jurisdiciton univerally supports the principles behind a ruling, finding some regulation to support it usually can be done.
In the US, there seems to be two factors that make it a lot harder to enforce such regulation (to the extent that they even exist there) - The fact that these companies are American and able to buy influence through lobbying and contributions - The current division in American politics, where virtually any position supported by one side automatically will be opposed by the other, causing paralysis
The question of course is if the jurisdiction of the person I replied to has the same idea about contract law but IIRC (and IANAL...) it should be harmonized across the EU - but heh, if the removal of the maps marker has led to a drastic decrease in traffic, a couple hundred euros for an actual lawyer should be more than worth it!
The key thing is, going via the court system or even "just" the legal department without involving the courts short-circuits the relatively powerless first-level support.
If you're interested in the finer details and a bit of ranting, read e.g. this post from lawyer Christian Saefken [1] - it's geared towards Twitter (and Facebook, which a friend of mine had success with just the same).
Contracts work both ways: now imagine Google, or Facebook, or Twitter stating that you can't close your account without a good reason because you have a contract.
The point is that you don't need a good reason, you just need a previously agreed upon reason.
A cursory examination of the ToS [2] is shows numerous cases in which Google (or the user) can terminate the contract. Whatever happened here, it's all but certain that Google claims that one of these cases is fulfilled, hence they have the right to terminate the contract.
> If you're interested in the finer details and a bit of ranting, read e.g. this post from lawyer Christian Saefken [1] - it's geared towards Twitter (and Facebook, which a friend of mine had success with just the same).
> [1] https://christian-saefken.de/abmahnen-aber-richtig/
That lawyer is claiming a Right to Free Speech. I don't how this strategy can be successful, as Twitter will counter-claim that they it's a private platform they are free to regulate. Sexualized content can be free speech but surely one wouldn't claim that Twitter has the obligation to host it if they don't want to.
If Twitter indeed caved, then they caved simply because they assessed that said Tweet wasn't worth the trouble, not because they were legally obliged to.
On a side note: GDPR demands that companies provide a way to get a manual review for decisions made by machines.
Rather than "Evan at" I'd say "especially at". It costs big companies way more money to deal with legal issues than it costs you to raise them.
Google only has so many staff lawyers and it doesn't take a lot to get them bogged down. The bigger you are, the now likely you are too have a bunch of legal work.
It's simply in their best interest to make your legal case go away as quickly as possible in most cases.
Correct. Unfortunately, from what I've heard so far, all that this entails is that some drone looks over the case, and checks a "reviewed" box or so. It's a right to manual review, not to manual rectification.
Courts (at least in Germany) cannot just arbitrarily decide on what is just or not; they must follow the rule of law. Without some adequate legal basis, a court won't order a thing.
> It is not for others to convince you that you should consider human rights more important than corporate rights.
Human rights are by definition more important than corporate rights. I take offense at your suggestion that I'd consider the latter more important, given that I explicitly stated that I'm 100% on the GP's side.
It seems so bizzare google will publish such information without ever validating it with the business. It must cause a lot of damage and support quite the environment of scammers though.
Why should they? Validation would be expensive, and the false information doesn't hurt Google. Where else are you gonna list?
It really pissed me off because I wrote a long thoughtful review and mentioned the good aspects of the restaurant too as well as some recommendations, and it’s just completely gone
The worst part is the restaurant is sitting at 4.5 stars despite being quite bad, and the recent low star reviews are all questioning the rating, which is obviously artificial
I used to be that naive, then I tried to correct a Places issue on Facebook. I stumbled into this netherworld of similar people being abused with horrible tools continually banging their heads against a wall "to help people," with little or no support from Facebook.
After months of trying, I totally failed at my task, and I vowed never again. These company just abusively exploit people's need to help others for their own profit. If Google/Facebook/etc. wants me to work for them, they can pay me and give me reasonable tools.
And then of course there is it a single living human at google you can contact to even find out which review was flagged, why, and what to do about it.
I don’t even read reviews anywhere anymore, they’re all faked or AstroTurfed anyway that they give no indication of anything. What a brave new world.
The solution that ended up working for me was to start paying a few dollars a day for Adwords. For some reason that cleared the issue up the next day. Then, I turned AdWords down to a few bucks a week and then later off entirely.
Yes, for some reason it cleared up after spending money. I really hope it’s not the norm. Sounds like extortion to me.
I don't hate it, I appreciate it. Better than having no easy recourse. Because I bet if everyone were treated equally, it'd be shitty service for all. Better to toss in a few bucks if it's valuable and get the support (and some ads run).
Since that amounts to a kind of extortion, I can't see how it would do anything but make me furious.
Intentionally or accidentally, it's a great problem for big tech to have. You scramble with everybody else to be on the service and the DDOS crowd, confused tourists and local ruffians take your account offline. Better grovel up to reinstate your honour and pay for protection/added services/more identity validation that doesn't stop the problem from happening. Same thing every big country does, we are all under a "security umbrella".
Honestly, real life advertising needs to make a come back. And localized knowledge of the businesses worth keeping alive, when Google's security algorithm dumps them without administration even knowing it. Eggs all in one basket, was never a good idea.. right?
I use that for good purpose - I fix a lot of invalid information on Google Maps around my home town, and they apply the changes without batting an eye. This is good for society. But I can clearly see how that could be used for abusive purposes.
First saving on having to hire an appropriate level of customer service staff. Second that percentage of people who give up.
It's a feature, not a bug.
I think one of the pixel phone had an option to detect when there was a human on the other end of the line. Definitely made me consider getting it back when I was looking for a new phone.
Though from what I've seen, most places have callback options.
why instead?
I meant the need to start a new front.
Meanwhile these companies who have essentially became a public utility don’t provide customer support or explanations.
>If the EU would actually enforce GDPR it would be amazing
>The EU should not focus on privacy laws any further
and not to be advdersarial, but they do enforce GDPR. have a look at the enforcement tracker and sort by Fine:
https://www.enforcementtracker.com/
TLDR: less than 2 months ago, Meta - one of those de facto public utilities you're describing - was fined 1.2 Billion Euros for GDPR breaches. they and Amazon have previously been fined hundreds of millions
Non EU companies are the worst offenders at not understanding their privacy obligations (particularly ones that provide tags)
If its not you're part of the problem.
Your comment feels very passive aggressive, FYI. There's no need to make accusations like that.
My mind just boggles at the implicit additional bureaucracy, expenses, and slowdowns being cheered for. The kind of mess which results in a system so complex that it has its own "degrees which shouldn't exist" spawned from it like medical billing.
Every time I do a CC transaction I’m giving a stranger exactly the information they need to do an entirely different, arbitrarily large CC transaction in my name with any merchant. That’s bonkers.
I’ve recently seen more use of Apple Pay via websites. Assuming it works as Apple Pay usually does, this at least is technically more secure (though I don’t like giving Apple more power) since it’s basically an exchange of cryptographically secure/verifiable one time tokens.
PayPal is no one’s favorite but at least if you use that you’re not handing over your CC number. (And yet they seem to lock out tons of merchants, hmm)
Why are we still using credit cards? It’s not great as a consumer either - I have had my card locked for traveling within the same city and spending maybe $20 at a merchant I don’t usually visit. I had it locked because of a $5 web service monthly charge - and I had verified the same charge the two prior months.
You may be surprised to know that, when doing a "conventional" CC transaction, you are most certainly not giving any stranger information that would allow them to perform a transaction in your name on another merchant. What you are doing is providing your card information to a PSP (payment service provider) that has been contracted by the merchant and will provide the merchant with a token with which the merchant can trigger a charge request to your card but only to their own pre-approved acquirer account. The merchant can do nothing else with these tokens.
A breach of the merchant's token database would be embarrassing but harmless. A breach of the PSP's database of card numbers would be bad and inconvenient for the cardholders, sure, but it would be a business-terminating event for the PSP as its PCI DSS [0] compliance would be shattered and it would be unable to operate again.
In summary, ordinary card payments are essentially as secure as Apple Pay. The only difference is that in one case you are trusting a gigatech brand which is very saliently involved in the process but whose side-business in payments has only operated since 2014, while in the other case you are trusting businesses that you may or may not have ever heard of —Adyen? Braintree? WePay? Worldline?— but that have probably been dealing with secure payment processing as their primary or only business for much longer.
[0] https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec...
My source is that I work in a payments backend software engineering team at a large company (FTSE 100) that provides an ecommerce platform for multiple medium-to-huge retailers worldwide. And yet, even at such a massive scale, neither our software nor let alone our partnered retailers ever even see the customer credit card number. It's not that we pass it directly to the many PSPs that we integrate with. Rather, only the PSPs' own systems actually see it. And yet, if you were to shop online on any of our retailer partners, as a customer you would still have the illusion that you are giving the actual merchant your number.
Could a non-PCI-compliant merchant ask you for your credit card number and store it themselves? Well, technically yes. But then they would not be able to do any legitimate transaction using it, as they have no way to use card numbers to get money into their bank account without a PCI-compliant PSP performing the transaction.
Could a non-PCI-compliant merchant integrate with a PSP in such a way that they send the inputted card number to the PSP [0] rather than the PSP receiving it directly? No, the PSP would laugh in their faces at the suggestion.
Could a non-PCI-compliant merchant ask you for your credit card number and details and then use them to buy stuff in your name for themselves? Yes, but "non-PCI-compliant merchant" is a very bad euphemism for "online scammer".
[0] One exception being MOTO (Mail Order/Telephone Order) transactions, but they are a specifically regulated case which, by its very name, is by definition not applicable to online card input.> Tokenization is the process Stripe uses to collect sensitive card or bank account details, or personally identifiable information (PII), directly from your customers in a secure manner. A token representing this information is returned to your server to use. You should use our recommended payments integrations to perform this process client-side. This ensures that no sensitive card data touches your server, and allows your integration to operate in a PCI-compliant way.
> If you cannot use client-side tokenization, you can also create tokens using the API with either your publishable or secret API key. Keep in mind that if your integration uses this method, you are responsible for any PCI compliance that may be required, and you must keep your secret API key safe. Unlike with client-side tokenization, your customer's information is not sent directly to Stripe, so we cannot determine how it is handled or stored.
So in summary, yes, you can integrate with Stripe in such a way that you send them the card details... but then your business will need to be PCI compliant to the level of a PSP which, believe me, is damn hard. If you suspect that a merchant may go through the trouble of becoming PCI compliant only for the sake of being able to get customers card numbers for possible future malicious use, or do it in such a shoddy way that a malicious employee will be able to steal card numbers, you might as well just stop trusting online card payments in absolutely all cases, including Apple Pay.
I really hope that your job at that security provider is on marketing, because this is a hell of a bad mindset to work with security.
Are you talking about trivial e-commerce transactions that you could make with Shopify? Yes, you could embed a payment gateway here. However, this is hardly universal or the norm.
In an actual application, you're going to have some API layer over the processor you use. You don't store these credentials, but you do pass them over your API layer and could easily intercept them.
Merchant doesn't pass your information to the PSP, you are actually talking to the PSP directly.
This usually works by the PSP embedding iframes for the CC fields on the merchants site (so you're inputting directly to e.g. stripe.com)
Some large merchants do take the details directly, but they typically have to go through all the PCI compliance hoops and maintain that.
There are exceptions, but most of the time the merchant does not see your credit card details.
(IMO) what GP was arguing for is that we should have a fundamentally asymmetrical form of payment, viz. the information I give for one purchase should not be able to be reused for another purchase, like a one-time token. Imagine if you had to send your private key every time you wanted to purchase something in crypto, for example.
However the big issue is most normal users would not have the ability to see if they're using an embedded iframe or cross origin JS from Stripe, Braintree, etc.
the same way that when you get a refund, you dont see the money back immediately. What the user doesn't know is that when you pay a business, the same thing happens, and the business don't get the money immediately.
And to pay by credit card feels much more insecure than using paypal or amazon pay, even if it isn't.
No. In best case, you’re giving your payment details to a PSP. A couple years ago NewEgg had a javascript skimmer on their checkout page that harvested all their customers payment details for months. Obviously anyone with access and intent could do the same for any payment page.
Always made me nervous... are they writing it down? Typing it into their home-made software?
This happens to me almost every time Skype bills me, and I've been a customer for probably 10+ years with both my bank and Skype, and the billing is regular as clockwork. For at least of half of that time, I've complained about it vocally and customer service can't do anything. Now I think about this every single time I hear "AI-assisted fraud detection", and by extension, "AI-assisted security" and really "AI-assisted XYZ". Without another credit card, I guess I'd simply live in constant fear of being embarrassingly declined totally at random on any/every transaction. It's not like I* know the billing cadence, even though my bank has a decade of history.
Clearly they are simply selling my history to the highest bidder, because they certainly aren't using it to help me. On a related note, ever notice that vanilla "exact substring match" search even in gmail is just as bad as google web search? All these corporations that are allegedly indexing us to "value-add" with some perfect high-resolution consumer model can't even do basic shit despite all the spying. I almost expect* my privacy to be fucked, like I guess hey that's modernity. What never ceases to surprise me lately is how the pretense has kind of dropped and we get nothing in exchange, even petty conveniences.
Why are you still with that bank? Even if you like everything else about them, couldn't you just open an account with another bank for Skype billing? Having more than one account is helpful anyway for avoiding having a single point of failure where you can't buy anything.
each merchant -- even a roadside vendor or a mobile hawker of wares -- displays a QR code that has their payment account details / UPI handle.
Customer uses their own phone and UPI payment app to scan that QR code, look at the merchant details displayed, punch in the amount to pay and authorize the payment using their PIN.
(a variation on this is: hand-held POS terminals display a QR code that also encodes the amount to be paid so that the customer doesn't have to punch in the exact amount).
and since this is a unified protocol the users are not stuck with a single payment app or a single payments processor or a single bank network to transact with each other. QR codes are universal - can be scanned by any UPI app.
I have other reservations about the digital trail this leaves for every petty transaction of your life -- and the small risk of a petty vendor being able to harass you later based on the information you leave in their records.
If we don't trust the government -- this makes us jittery about how much they can track you or even cripple your life by disabling a few key things that you need this all to work smoothly.
Those risks aside,this UPI system has been a boon to ease of transactions (without worrying about handling cash and change) across the country. Net positive with some scope for improving privacy protections.
Feels like a lot of work. I prefer just tapping my phone and then getting the amount charged pushed to my phone and watch so I can complain if its wrong whilst I'm at the checkout.
One big advantage of contactless card payments as implemented in most countries is that you can seamlessly introduce it, making it look like a regular chip or even magnetic stripe transaction to the POS and everything behind it.
For example, consider a rental car agency or a hotel reservation. These usually make extensive use of the pre-authorization "feature" [1] of credit cards to reserve a deposit without actually charging it before the final billing amount is known. After a rental car is returned, toll charges are often posted to the card weeks or months after the rental.
QR payment systems often don't support these use cases at all (since they're usually payer-initiated and confirmed); and even if they did, chances are that their API semantics are sufficiently different from credit cards as to require significant reworking of the POS and/or backoffice systems of the merchant.
[1] It's actually more of a historical artifact of how authorization and clearing/settlement used to, and to some extent still do, run over almost completely independent rails, but for some use cases, this can actually simplify things.
Disputes are quite simplified by the fact that this is always a "customer present" transaction; the platforms generally simply do not provide the ability for the payer to dispute and this is understood by the payer.
Refunds are fully supported by every QR system in wide use. Reporting and reconciliation is different but not a problem; the QR service providers all integrate with POS systems and accounting systems.
In many cases in these markets, merchants and consumers both went from dealing mostly with cash to dealing mostly with QR, so there is less of a legacy issue.
> For example, consider a rental car agency or a hotel reservation. These usually make extensive use of the pre-authorization "feature" [1] of credit cards to reserve a deposit without actually charging it before the final billing amount is known. After a rental car is returned, toll charges are often posted to the card weeks or months after the rental.
> QR payment systems often don't support these use cases at all (since they're usually payer-initiated and confirmed); and even if they did, chances are that their API semantics are sufficiently different from credit cards as to require significant reworking of the POS and/or backoffice systems of the merchant.
Bharat QR (India), Alipay & WeChat Pay (China) and QRIS (Indonesia) all support pre-auth and are widely accepted for hotels and car rentals in their respective markets.
Sure, the APIs are different, but that hasn't prevented almost universal adoption in the world's largest and second-largest markets (India & China) and rapid ongoing adoption in the world's fourth-largest (Indonesia).
Interesting, I didn’t know that!
Anyway, all requirements I mentioned definitely all feasible using QR codes (and apparently it’s already been done) – I just don’t think it would be a drop-in replacement at the terminal-to-POS interface if the existing terminal expects a credit/debit card like interface.
And the point you mentioned probably makes this a non-issue in many cases anyway:
> In many cases in these markets, merchants and consumers both went from dealing mostly with cash to dealing mostly with QR, so there is less of a legacy issue.
In the case of Alipay and WeChat Pay (China), the QR codes are proprietary to the mobile wallet app, but both also support connecting the wallet to bank accounts and cards.
When using a card the safety characteristics are quite similar to Apple Pay or PayPal: the card details are neither stored on your phone nor transferred to the merchant. But in these markets few people use cards; they either pay directly from their bank account using these QR systems, or they keep a balance in a mobile wallet and pay from that.
Granted the entire system needs a revamp, but credit cards are one of the best tools we have to pay strangers right now. Credit card money isn’t your money being spent, and comes with a fraud guarantee. I would rather use a credit card than something linked to my money in a checking account for sketchy transactions.
Yes, it’s a hassle when the card number inevitably gets stolen, but NFC payments, etc are starting to tackle this.
One thing I’ve seen a lot is people misunderstanding credit cards. If you pay them off monthly, you usually get some kind of reward and additionally a huge layer of fraud protection from your personal finances. That being said, I also can’t wait until more secure credit card systems become more prevalent.
If this is one of the best tools, then I'm really dismayed at the state of payments around the world. SEPA bank transfers are so much better, even if they have other problems.
Paying with a credit card means your credit card company pays that charge for you. Yes, you are borrowing money from your credit card company.
Once a month (or whatever your billing cycle is), you receive a statement showing all the charges on your credit card. The statement will also show any credits if applicable (eg: refunds). The sum of all charges and credits is called the balance.
At this time, if you spot any suspicious or fraudulent charges on the statement, you call your credit card company as soon as possible to dispute those charges. If they are indeed fraudulent, those charges are reversed/removed.
If the statement looks fine, you pay your credit card company whatever balance is shown on the statement.
Note how your own personal money only comes into contact with the credit card at the time of paying off the charges on the credit card, and only after confirming the charges are legitimate. The credit card company has a vested interest in fighting fraud because it's their money on the line, not yours. This is why credit cards are considered safe and widely popular.
Contrast debit cards and banks, where all charges on your debit card come into contact with your own personal money immediately. Banks don't have a vested interest because it's your money on the line, not their's, so they won't be nearly as enthusiastic about fighting fraud on your behalf.
> Contrast debit cards and banks, where all charges on your debit card come into contact with your own personal money immediately. Banks don't have a vested interest because it's your money on the line, not their's, so they won't be nearly as enthusiastic about fighting fraud on your behalf.
The credit card issuer may be a bank and for most new credit card holders, there’s a decent chance it is their main bank (e.g. BoA and Chase in the United States have many credit card products).
Also, with debit cards, the federal Electronic Fund Transfer Act does limit liability for the card holder.
Source: https://www.federalreserve.gov/boarddocs/caletters/2008/0807...
What kind of reward? I’ve always paid mine off each month and never gotten a reward on any of my ~15 cards.
> If you pay them off monthly
You get the things you mentioned whether or not you pay them off monthly or just pay the minimum and carry a balance. You just have to remain “in good standing”.
Practically all the credit card haters turn out to not understand credit cards, it's almost hilarious. Are people not taught even the very basic of financial know-how from anyone?
Because the big networks (Mastercard and Visa) as well as the issuer and acquirer banks spend insane amounts of money on advertising and lobbying - even in the EU where payment fees are capped, the cap on CC fees is notably higher than on debit card/SEPA fees, so there is a clear incentive for everyone in the chain to push for credit cards.
Additionally, issuer banks make a ton of money on interest which means they have even more of an incentive to push for CC usage.
> The banks operate under a laundry list of laws outside of a criminal conviction, such as the Terrorist watch list as well as whole countries that are under US sanctions. US sanctions are a particularly large bite because the US will sanction you from the US financial system for working with the above, even if you are not under US jurisdiction.
> This, of course, doesn't mention the all the reporting used for detecting tax evasion or money laundering.
> US banks are absolutely a wing of the court by operating under the given rule of law, and through the US banks' worldwide influence this 'rule of law' gains a global prominence.
I guess problem is that in US you'll lose a lot of customers by declining payments without 2FA. Also likes of AMEX use 2FA via email so I guess there could be fraud too.
How does that work when you buy things in places where you don't have cell service?
Yes, they exist. Even in Europe.
For payments involving the physical card, the chip on the card and your PIN are the two authentication factors required. (Credit and debit cards are PIN-based in the EU; signatures aren't a thing anymore there.)
In the edge case where there is no cell service yet the PoS device has connectivity (e.g. WiFi or other cellular service) they might set up a WiFi access point for users to get push notifications (assuming the 2FA method is not archaic insecure SMS).
If that encryption can be MITMed, then there is a much bigger problem as any traffic can be MITMed at cellular network level anyway, voiding out any WiFi-MITM concerns.
this is not sms 2fa/based but a physical/android based pos to charge the bank lends you
Something to do with having a “next authentication token” on your device already with a 24hr expiry.
SMS fees outside the US are also orders of magnitudes higher – paying a few cents for that can make the entire transaction uneconomical for banks, since interchange rates are also heavily capped in Europe.
I know that SMS is insecure. But I can get it back after a predictable disaster.
sms is trash yeah, 2fa just works if you care enough to know how (in most sites)
You mean you have wi-fi, but don't have cell service?
That is like... super rare.
I mean actually, I frequent a business where you cannot get a cell signal, but they offer free wifi. Metal building blocks the signal. This could happen anywhere.
- Bank sends you a tiny card reader that you enter your PIN and it gives you a one time code. If you want to make payments that require 3DS (online only ofc) you have to have this card reader on you but it doesn't actually require an app or internet connectivity.
- You have an app on your phone, you drag a code from a notification onto another area of the app itself which does something (somehow - no idea the purpose) and verifies the transaction. Certificate is stored on device only.
- You open an app and it'l notify of the purchase amount, location, merchant and you just tap allow
- You receive a code in the mail that is renewed once a year which is then combined with a SMS message (or app notification). The payment flow asks you for some characters from both codes.
You do not require cell service for any that I have used and wifi is enough.
Further Edit: Just to clarify though, all of these are ONLY for online purchases. Purchases in shops you just use your pin if it requires authorisation.
I remember in Berlin going to a bar where there was no cell service (some combination of poorly sited base stations and thick walls made of something dense). They of course offered free WiFi considering this.
Where I am now, there’s a section of beach full of cafes that has no cell service. If you walk 100m north or south it’s fine, but that bit is a dead zone. All the cafes have free WiFi.
However, most banks/issuers have since switched to using their app as the second factor, so all you need is Wi-Fi, practically.
A few even support displaying an offline code in the app that you can enter during checkout, but that's becoming less common since it doesn't support displaying the amount and payee given how it works.
In the EU, card issuers and merchants are required to use 3DS for e-commerce payments and PIN verification for in-person payments in many circumstances; yet chargebacks are still possible.
And of course there are many that use CCs for the purpose of a loan to purchase items they can’t currently afford.
1. you can charge any amount - the amount shown in the Apple Pay UI is arbitrary
2. you can make multiple charges, also of any amount (e.g. for a subscription)
It is tokenized, but practically it's just a card number you can charge like any other card number. It's also typically linked back to the original PAN, so multiple payments can be correlated together with ease
Because they're accepted by pretty much everybody and nobody has come up with a system that is any better.
Blame your government for not caring enough to have it implemented
Then there's a bit of a monopoly with 3d secure implementation by cardinal.js and their solution falls down completely if you have a decent amount of traffic on the site (I have worked on flash sales websites, cardinal js is about as reliable as I can throw my car)
Given the meteoric rise of companies charging for services with no support of any type available for consumers other than hoping for traction on social media, how do we legislate to basically enforce some alternative to ‘computer says no, just make a new account and hope it doesnt happen again’. This seems like something consumer protections agencies should be all over.
Australia’s consumer protection body is actually quite active in enforcing our rights when dealing with these sorts of things. Does America not have a similar agency or has it been captured by the companies it’s supposed to regulate?
These companies are collecting sizeable profits and part of the way they’re achieving this is by simply disregarding all the support and engagement processes ‘normal’ businesses have to have claiming their scale makes them impossible. That should just not be an acceptable answer as far as consumer remedies are concerned.
i also keep hearing that there's a ton of choice but whenever it's brought up, true alternatives to PP/Stripe are rarely actually given
I know you could probably say that its just some other existing legal construct which we should just enforce, but the point is that the media needs some snappy new very specific word to talk about to make politicians pay attention.
Things like swatting, phishing, slamming, gaslighting and boofing we all know about and are easy to write articles on with decent enough SEO.
So what is the snappy new 21st century term for this, so that we can complain about it and write blogs and articles about it and demand politicians do something about it?
Too many people and businesses have been relying on these vending machines, partially because they have no other choice. Everything has been hollowed out, every store runs on a skeleton crew. You know this if you’ve walked around a store wondering if anyone even works there. I never noticed this until I traveled to other countries and found businesses that actually felt like they wanted to please me instead of feeling like I was expected to be grateful that BigBoxStore (tm) exists.
(Although if we don't come up with anything better off the cuff, we could just start calling them "deaf corporations" and then someone moar cleverer might come up with something better later)
===
"Support Void", "Voiding", "Customer Voiding"
Tossing all customer support requests (and sometimes customers themselves!) into the void.
Pros: Sounds snappy and dramatic. Has humorous resonance with voiding your bowels.
Cons: Meaning not immediately clear. Sounds active when the problem is really more passive.
===
"Customer Neglect", "Customer Disservice", "Customer Ghosting"
Opposite of "customer service."
Pros: Meaning is more obvious because of its relation to Customer Service.
Cons: Not quite as snappy.
How about "Support Ghosting"?
It does, but it's still newish, and faces a lot of opposition from both politicians and businesses.
In 20 or 30 years, once the various lawsuits and codes get sorted out, it might work. But it's still in its toddler phase, and everyone is seeing if they can push the baby over.
Anybody thinking of the "Better Business Bureau" should note that the BBB is not a government organisation and behaves more like a Better Extortion Bureau: paying members can keep their good rating by unilaterally declaring a claim has been resolved (often requiring claims to be reasserted multiple times), while non-members or non-paying members cannot even contest claims via the bureau.
The problem is that it's really hard to take action on large corporations. As a consumer, if I wanted to seek remedy for say, false advertising of ingress protection on a phone, it would cost hundreds of thousands of dollars in legal fees. Without a significant war chest it's almost impossible to hold most companies to account as an individual, and the agencies supposed to be enforcing these issues either won't or can't enforce the laws on the books.
Do you think there's any incentive to fix these problems when the constant inconvenience and technical gremlins can be more easily and excitingly solved with biometric IDs and whatever else?
Let's be honest, the Australian government may clamp down on corporations, but it plays the same game and doesn't care for anyone's dissent in the long run.
I would advise targeting people directly, anonymous letters directed to a spouse with accusations of cheating will help prevent executives from travelling and add a lot of personal stress on their lives, all it costs is a stamp. -- this is especially easy if you live in Sweden; since addresses and living arrangements are public info.
Other things you can do is to fabricate something racist and pay for a few hundred bot accounts to follow any mention of the company or product.
I have had both of these happen to me, and my industry is not very competitive nor am I a famous figure.
Maybe these attacks will finally force regulators to do something about the financial parasites we call "payment processors". Any payment processing system that doesn't act like a public utility is broken and needs fixing.
I think the only digital payment system that comes close to acting like a utility right now is cryptocurrecny which is a sad, sad state of affairs.
OP: While not a complete solution, you might be able to partially mitigate this by allowing customers to pay you in other forms (e.g aforementioned cryptocurrency, bank transfers). That's what the porn industry and other legal businesses end up doing when they inevitably find themselves in your position.
If your customers want your product badly enough, a small fraction of them will learn how to use these payment methods. You'll have to learn to survive on those alone.
I feel that Algorand (I'm not a holder anymore) was positioned to work as such but would require all the parts to make it successful. The 0.001 ALGO transaction fee cuts down on silly transactions while making 0.1 ALGO transactions possible. It also allows trading in stablecoins or CBDCs as they are enabled. It can complete transactions in milliseconds and moderately-sized participants can easily help maintain the whole network. It never gained traction, however, probably because it isn't a good HODL.
I truly think it’s one of those cases where the “wrong/dumb” people jumped onto it (alongside scammers) and so it became poisoned to the right/smart ones. But we should be way better than that! Is it really so hard for people to separate good from bad?
It absolutely bowls me over to see this lack of ability to discuss it carefully around here so consistently. So many potential amazing conversations totally shunted by the absolute need to turn it tribal.
If you mean "HN people", then probably no; but if you mean more generalized "people", then definitely yes. Unfortunately, your customers are much more likely from the latter group.
Also, being in a sad state doesn't really mean it "has no use case", right?
Afaik it mostly took them to basically write a few legal letters and telling them "our legal representatives would be glad to meet you at your offices at Google France and discuss such unfortunate issue and so and so" - they basically went "how about no" and restored the account.
Laywer fees weren't particularly cheap (in the range of 2500-5000€) but still well below the money we were losing.
Is this not an option for US-based businesses? I have heard similar horror stories like the one on the OP a few times already but I've rarely seen them pursue a similar path.
It is absolutely an option. Some people simply choose not to pursue it for many reasons ranging from financial, to a matter of principal, effort required, or any other number of reasons.
You'll notice those stories rarely include "and I talked to my lawyer"
Not that the author is implying this, but don’t ever make the mistake of thinking that these numbers ever matter. It’s not 1973 and you don’t shake hands with your banker.
The only number that matters is the number of dollars going through Stripe or PayPal because of your business.
(Pardon me if I am projecting from my past startup experience to yours in all my comments.)
I am not blaming the victim. But the industry is setup so the merchant is most responsible for detecting and dealing with fraud. And that is probably objectively not a bad call. You have all kinds of ways to detect who is doing this and ways to stop this. I hate this crime with a passion and cut it down from 5000/mo to 50/month at my first startup when it blew up on us. But it is true the credit card middlemen, having externalities the risk to you, don’t then innovate incremental tools for merchants that well. I was frustrated when I received fraudulent requests there was no third party I could report my suspicions of fraud to with a confidence rating (or check against other merchants suspicions). I did many years later see a service like that but now can’t find it.
I did just now find a pretty good list of merchant anti fraud tactics which had tricks nobody told me at the time but I had to figure out myself and were pretty successful: https://support.authorize.net/knowledgebase/Knowledgearticle...
Good luck. These guys are persistent. In my case most of them were coming from poor countries where a dollar of fraud is worth a lot more of their time than yours. Until you stop them cold, they will keep coming.
It's a pain for the customer so I only do it on newish accounts, repeat customers don't get bothered.
1) The basics: track all information entered in the signup process and display it in a signup email to our customer service/onboarding rep, along with whether and how often each piece of info was used (or was similar) in past locked/disabled-for-fraud accounts and have a human determine via eyeball if the composite picture looked like fraud. You’ll be surprised how often a customer saying his name was Ibrahim with a phone number in Egypt had a IP in Jordan and was using a credit card belonging to Sally Jones with a zip code in Kansas. Don’t automate fraud decision. Have a human in the loop. Know your customers with a human touch up front at signup. (“Do things that don’t scale” is the more recent mantra for this approach.) But never emit info so fraudsters couldn’t game the system beyond the binary of getting enabled/disabled, and even then don’t give them immediate feedback during/post signup to run permutations quickly. Have a human vet asychronously shortly post-signup as part of customer welcome/orientation call.
2) Silently partially disable international customers so they could sign up and give us info and do certain things but not really generate expensive transactions until a customer rep called and welcomed/vetted them and checked a box unrestricting them in our admin panel. (I say silently but if they actually got to the final step of a transaction, we did give them ways to reach out to us to get activated after talking to someone (which was manned 24x7). 99+% of the time, fraudsters never called/reached out.)
3) Most subtly, reps especially offshore ones from white label partners of ours were slow to use our ways to vet their (and thus our) customers even though their management was pushing our development team for more and more technical solutions to cut fraud. It was frustrating because I could see the fraud and it was a massive chunk of our partner’s revenue (1/3rd?) shortly out of the gate with us, but since they were a white label customer of ours I/we couldn’t exactly tell their lower level rep employees to get off their butts and take the fraud seriously (when even their management wasn’t getting through), nor did I want it to continue to harm their business because it would also harm ours.
Remembering the mantra “you can’t manage what you don’t measure”, I built an admin screen that their reps (and thus their bosses) could see that showed when each recent customer signed up and when they were cleared or locked out as fraud, how many minutes were between the two and who (which rep) locked/cleared the customer and how much was spent (lost) before the account was locked. The difference was profound. Fraud from the white label partner’s customers dropped practically overnight, from $5000 a month to under $50 just by adding a report that quietly made the humans in the loop accountable. I didn’t even have to tell the partner’s people what to do. I just made the outcomes measurable and visible and the problem took care of itself. It was a profound lesson for me early in my career. I wish that exact trick had been more useful for me since, but still — very eye opening. Chargebacks were never a problem for us again.
Maybe the hot take here is that the best way to ruin your own business is to automate credit cards?
You can find some of these by searching the shipping address and seeing if it's a freight forwarder or an obviously vacant home (listed on MLS with empty room pictures). Those kinds of shipping addresses have a pretty high fraud rates.
But, if you mean seeing that the shipping address doesn't match the billing address on the card via AVS... That's trickier, especially for B2B spaces where a business owner buys with a credit card tied to their home address, but ships to their business.
Am a legitimate user of a freight forwarder, this attitude makes me sad.
With credit card fraud, the merchant holds 100% of the liability. They lose the item they shipped, the shipping costs, the associated revenue, then some chargeback fees on top too. So, they check on things that could be fraud.
Shouldn’t it be trivial to “triangulate” the origin of a card hack / leak after like, I don’t know, three or four transactions? This whole thing seems rigged to put make small businesses liable for covering the cost of the PII failure of probably a banking institution, or a minimum a completely different small business!
As a merchant, you need to do proper anti-fraud system. Especially considering influx of orders with stolen CC. It's just necessary to avoid huge financial and reputational losses.
Don't rely on Shopify/Stripe "anti-fraud" - it's absolute garbage selling feeling of security. Proper analysis of order flow with spotting irregularities across many datapoints are needed.
Some may whine things are not fair - yes they are not, and never will be. You just need to adapt.
This is happening because you are basically leaving your PoS system open and unattended while a scammer walks by with a wheelbarrow full of freshly stolen credit cards.
Throw a captcha on that checkout page at least for goodness sakes
Also, it's worth having a relationship with a smaller payment gateway, merchant account provider. It insulates you somewhat.
They are the merchant in that scenario and process refunds / chargebacks. Most likely they will punish you in some way though.
Imagine if our phones still worked liked they originally did, where you could only call other people using the carrier you are. Oh you have T-mobile? Sorry. I have AT&T, i will write you a letter.
We didn't put up with it back then, and we shouldn't put up with it now.
Most consumers probably don't like that at all, though.
Have open source self custody merchant tools improves?
Brick and mortar gone online and Web 2.0 services seem pretty left behind for accepting crypto payment. And Web 3’s crypto natives don't care or need purchasing flows.
No support staff is probably how they scaled up to billions in profits in the first place.
There is no inherent security at all. Merchants usually send you 1 cent with a 2fa code, in order to verify that you have access to the account. In my case this was not done apparently, and the scammers got their items. I was able to do something similar to a charge back, but I wonder whether the online store or PayPal will have to eat the loss.
https://oppositeinvictus.com/how-to-mess-with-spammers-for-s...
In those regions, incentivise those means; give 5% discount for paying like that. We accept those in region where they are available, we also have our IBAN for you to pay directly. Some companies prefer that as they pay all their other invoices that way.
Australia has a system called POLi. This injects a popup into the checkout page of a website which allows you to log into your own bank and do a transfer from there. That works well, and seems quick and easy for the customer.
This overlooks the hard work and risk undertook by the virtuous founders of Paypal and Stripe.
*SBOs love to advocate the virtues of "risk-taking" to defend exploiting others, and the opposite when they find themselves at the other end of the exploitation.