Hacker News Reader

Comment by fragsworth | Hacker News Reader

The way credit cards are designed should be illegal. They are basically a piece of plain text that can be used by anyone to purchase things from someone's account.

It's basically the worst security you could possibly have for one of the highest-risk systems (direct access to money) that exist.

People need to be angry at the credit card industry for designing such an insecure system, not Target. There are plenty of online payment systems that work far, far better than credit cards that cannot, by design, ever have user account information stolen from a retailer.

View on HN

How is it bad security? As a consumer, there's practically no issue. Data mining for fraud detection is pushed off onto the card provider - not my problem. There's no "direct access to money". It's a bill from a service provider that I can easily dispute. At worst, it's a slight inconvenience if my CC info is compromised.

Exactly. And fraud is low enough that they're happy to do this.

Well, maybe we should talk about debit cards, which are functionally identical. The Target breach included theft of PINs - a purchase made with your debit card plus PIN is on you, not on a CC company.

Debit cards are terrible for this reason. And as I understand, chip-and-PIN models also start moving the security onto the consumer. Nice for merchants, crappy for consumers.

Get back to us when there's a major practical breach of a chip-and-PIN system and consumers aren't compensated.

"It's okay that the protections we are used to being afforded aren't afforded to us anymore, because this system hasn't been hacked yet."

No. Because when this system is hacked, protections will be afforded to us.

Can you even imagine the media storm in the EU or some other similarly consumer-friendly location if the evil American corporations don't compensate consumers for fraud of no fault of their own like they used to? Millions of people would mail in their cards. This is simply not going to happen.

I'm in Canada and a colleague had her wallet stolen from a locked car, PIN changed over the phone (that's a whole another subject) and purchases made. Faced with a police report confirming the story and possibility of bad press, you think the processor, the issuer, and the merchant won't budge? They budged.

Then, if they are going to afford the protections anyway -- they should afford them in writing and contractually.

This way, they could only partially refund and say that we're lucky to get anything at all.

>They budged

See, with the current system, there's no need for "budging". Several times I've had unauthorized charges show up (both Visa and Amex). A quick call, and it's sorted out.

If you've got to invoke the possibility of bad press, that sounds absolutely worse for the consumer.

I was giving an example of a more difficult situation to dispute, with card present and the person's personal information available for PIN reset. Electronic charges with card not present are easy to dispute anytime.

You have as many protections as your issuer decides is good business to give you. You can dispute a transaction but they can rule against your claim.

Try disputing a card present transaction in a Rite-Aid on a card with a $1000 limit and get back to us about consumer protections.

I've disputed a $6000 "card present" transaction at a physical store about 20 miles away from me. AmEx determined the card must have been cloned and sent a new one out immediately. There was no hassle involved: "Nope I haven't been to that town." And done.

You have no idea why I gave the example I did, do you?

There have probably been small-scale compromised of chip-and-PIN in the UK already due to a design flaw allowing purchases to be made without knowing the PIN. (We don't know for sure since the banks involved erased the logs that would confirm it.) The customers wound up liable for the transactions.

Interesting; I've tried searching but all I'm finding are technological faults, not articles about consumers liable. Can you link or give names to search? Closest I've found is http://www.theguardian.com/money/2012/may/04/banks-pin-card-... and it looks like the card-resend story that would only have been worse with a swipe-and-sign.

And that's why I only ever have used debit cards for banking, and never for purchases.

What you say is true.

However, it doesn't really matter. Despite all the hue and cry, credit card fraud losses run in the single-digit basis point range as a fraction of transaction volume and around 1.2% as a fraction of issuer expenses.† Losses due to uncollectible debt (the "charge-off rate") are much higher, at around three or four percent in 2013 (but 10.9% in the second quarter of 2010).††

The pain point isn't financial. It's the bad publicity when breaches occur and the nagging fear is that losses could suddenly get out of hand due to some unanticipated vulnerability.

†http://web.archive.org/web/20091229101826/http://www.sas.com...

††http://www.federalreserve.gov/releases/chargeoff/chgallsa.ht...

So this means we're effectively all paying 1.2% extra (indirectly through retailer's credit card fees) to accept these fraud losses. But you have to add to that some amount for overhead of dealing with fraud reports, and the expense of required security practices in order to be PCI compliant, which is entirely a result of the plain-text nature of credit cards. It probably results in 1.5-2% extra to all purchases, entirely hidden to consumers.

And, from your own citation, on average, 10% of Americans are victims of credit card fraud and 7% of debit card fraud - this probably results in about 16% of Americans total if you assume both groups are random samples of the population.

If you've ever dealt with credit card fraud, you'd know that it's an ordeal that can be a huge pain in the ass. It can take many hours of your own time, and time from your card issuer. The cost isn't just directly financial, it's the overhead that comes as a result of the fraud.

I am certain that if given the choice, nearly everyone would take a 1.5% discount on all of their purchases if they had to do two-factor authentication on all of them in exchange.

My point is that the fraud losses are so far not heavy enough to move the payment processing industry off the dime towards a really secure solution.

A secure system might use your phone as its platform. E.g., the merchant's POS presents the bill to your phone via Bluetooth. If you approve, your phone prepares a payment request, encrypts it with the bank's public key, and sends it back to the POS. The POS then forwards it to the payment processor and receives back a message accepting or declining the charge. Elapsed time: one or two seconds.

The obvious hurdle is winning acceptance for the new protocol and outfitting a zillion POS terminals all over the country and world to run it.

I am certain that if given the choice, nearly everyone would take a 1.5% discount on all of their purchases if they had to do two-factor authentication on all of them in exchange.

Do you have a trusted friend or family member who is not a technologist? Ask if you can watch them a) sign up for 2FA for their bank and b) complete one end-to-end transaction using 2FA.

You may, in response to this short anthropological study, revise your estimate that nearly everyone would gladly use 2FA for every purchase.

(Additionally, merchants wouldn't be thrilled about any system which makes it difficult for their customers to spend money. If the Stripe API had a field for require_two_factor_authentication I'd set it to "false" or "are you freaking kidding me? no!" simply because I know that will cost me more in lost transactions than I lose to CC fraud.)

Transaction volume is a poor way to measure the problem. I might use my card 1,000 times before getting hacked and having to replace my card. It's not a .01% loss it 100% as far as the consumer is concerned.

The consumer is almost always made whole in fraud incidents. For the consumer, it's mainly the pain in the ass factor. Which is not insignificant!

> The consumer is almost always made whole in fraud incidents.

By the collective money of other consumers...

Who ultimately bears the loss is a complicated microeconomic question, which depends on price elasticities and the like.

At one extreme, the payment industry and the merchants could end up eating the entire loss in the form of lower profits. At the other extreme, the entire loss might fall on consumers in the form of higher prices for goods and services. In reality, some of the loss will be born by producers (i.e., stock holders) and some by consumers.

The only thing that is clear is that a 7 bp fraud rate means the economy as a whole loses $7 for every $10,000 transacted.

Well the pain point is financial, it just lies with the merchant which gets a chargeback, I believe, when a fraudulent cc is used.

There are plenty of online payment systems that work far, far better than credit cards that cannot, by design, ever have user account information stolen from a retailer.

Why doesn't Target use those payment systems? Wait, I think I know... because their customers don't use those payment systems. Are you saying that customers should "be angry at" themselves?

It has been years since I've used a credit card at a big-box store. They all still take cash.

> People need to be angry at the credit card industry for designing such an insecure system, not Target.

He explicitly said the blame doesn't lie on Target.

Payments systems are a chicken and egg problem, however you would think the entity that feels the most pain from credit card fraud would try harder to replace the broken system.

Exactly! Except the entity that feels the most pain isn't the credit card companies or the banks. It's typically the retailer or the payment portal.

That was actually my point. I am surprised retailers aren't making more of a stink about how insecure payment processing is given they are on the line for fraud 9 times out of 10.

Ever heard of worse is better?

This simple method works fine. The amount of fraud is not enough to make switching worth it. (And don't forget credit cards need to work even without persistent data connection.)

Why should I be angry? My credit card has been comprimised twice in my life and both times my credit card company contacted me immediately (before I even noticed) and refunded all fraudelent transactions immediately. I didn't have to do anything.

Credit card companies should be pissed at themselves for making it this easy.

It's a design that's iterated over many decades, and it hasn't always been easy for them; the payment network is huge.

Plus, if you think security is bad now, remember that before this we were writing checks for most transactions. At least with credit cards I can discover fraud usually the same day it occurs, and they are far more convenient that checks ever were -- as someone who has used both, I'm not all that bothered by the current state of the system.

Yeah but the cool thing about credit cards is : consumer protection laws.

Your checking account is just as insecure. All that's needed to debit your checking account is your bank's routing number (which is public) and your account number. No PIN, nothing else.

What system, exactly?

Reply on news.ycombinator.com