Slashdot Mirror

Of course a signature isn't a fraud *prevention* mechanism...it never was, unless the early days of credit cards saw vendors having databases of customer signatures against which to compare. The signature is there for fraud *investigation*. If you argue that your identity's been stolen, the firm investigates, pulls up the purchase slip with a signature that doesn't match yours, BINGO...they know you're not bullshitting.

Why so many people persist in claiming that the signature isn't used for fraud prevention is odd.

It's simple enough to pull up the Mastercard/Visa merchant rules and see that they explicitly use signatures as a means of verifying the person making the charge is the authorized cardholder and it has nothing to do with a future "fraud investigation".

That a signature can also be a piece of evidence in determining, after the fact, that the purchase was made fraudulently doesn't mean the signature isn't/wasn't a fraud prevention mechanism.

From Mastercard https://www.mastercard.us/cont...

"Performing a Signature Comparison
When a signature is obtained as the CVM for a Mastercard POS Transaction completed with a
Card (but not when an Access Device is presented), the Merchant must compare the signature
on the Transaction receipt with the signature on the Card to determine whether they appear
to be the same.
If the Merchant believes that the signature on the Card does not match the signature on the
Transaction receipt, the Merchant must contact the Acquirer for instructions. "

Why is that there? Fraud prevention

Apple Pay is much worse than the NFC payments the rest of the world uses.

The US has had NFC payments for years. However, it never caught on here... I think people are paranoid about RFID. But Visa, MasterCard, and Discover all had contactless cards for a while, but it seems that the experiment was deemed a failure and they're phasing them out now.

The problem is knowing exactly when the 10% is, or having it when a merchant wants to verify identity on his Visa or Mastercard branded debit card -- despite the fact that it's expressly not required. I've got better things to do than earning a lifetime ban from Fry's Electronics after successfully completing a no-ID Visa purchase there...

http://www.mastercard.us/suppo...

A merchant must not refuse to complete a transaction solely because a cardholder refuses to provide additional identification information. However, there are certain situations where a merchant may require some personal information, such as a shipping address for online purchases. Additionally, if your MasterCard card is unsigned, a merchant should request personal identification to confirm your identify and ask the cardholder to sign the card before completing the transaction.

http://usa.visa.com/download/m...

Although Visa rules do not preclude merchants from asking for cardholder ID except in the
specific circumstances discussed in this guide, merchants cannot make an ID
a condition of acceptance. Therefore, merchants cannot as part of their regular
card acceptance procedures refuse to complete a purchase transaction because
a cardholder refuses to provide ID. It is important that merchants understand
that the requesting of a cardholder ID does not change the merchant’s liability
for chargebacks. However, it can slow down a sale and annoy the customer. In
some cases, it may even deter the use of the Visa card and result in the loss of
a potential sale. Visa believes merchants should not ask for ID as part of their
regular card acceptance procedures. Laws in several countries also make it
illegal for merchants to write a cardholder’s personal information, such as an
address or phone number, on a sales receipt.

Define 'protected'.

Well, according to the Visa and MasterCard contracts you sign, you, the consumer, are not liable for fraudulent or unauthorized usage of your credit card credentials. Here's Visa's statement and here's MasterCard's. Just for fun, here's Discover and American Express's, both of which promise zero liability if you act like a rational human being. And since 1998 the FDIC covers about $250,000 in losses relating to your bank account, including unauthorized use of your ATM card. So looking at all of those liability statements, since the data breach was not the result of gross negligence on the part of the cardholder, the cardholder is not liable for any fraudulent charges made in their name.

Furthermore if anyone steals my credit card, bank card, ATM card or card information, or if something happens to the bank, like a robbery or the bank folds (provided my bank is FDIC insured, of which nearly 7,000 banks are): I, the consumer, am not liable. Either my credit card company knocks it off my bill (in the case of credit card fraud) or the Federal Government covers the losses up to $250,000 per bank (in the case of ATM card fraud or bank losses).

Those are all legally binding contracts in the United States. The European Union has similar systems in place, and has had deposit insurance since 1994, though that just covers the minimum coverage mandated under EU regulations (current minimums are €50,000, as of 2008, more information here). Most countries cover up to €100,000, including Belgium, Bulgaria, Cyprus, the Czech Republic, Finland, France, Germany, Greece, Hungary, Italy, the Netherlands, Portugal, Spain, Sweden, and Slovakia (among others). The UK covers up to £85,000 in a rather complicated scheme of percentages, and the Irish government will guarantee all the money in your bank accounts.

Certainly seems safer than putting your money in an escrow account controlled by a marketplace known for its illicit drug trade, and whose predecessor was taken down amidst a murder-for-hire scandal.

This shouldn't be a big surprise...the flat rate plan was clearly a loss-leader meant to gain marketshare.

Most of the fee you pay to companies like Square doesn't go to them. It goes towards the "Interchange Fee" charged by Visa, MasterCard, and AMEX. These interchange fees vary based on card type (for example, fees are higher on "reward cards"...that's what funds the "reward"), and transaction type ("card not present", for example, has a higher rate). Check over the interchange fees for Visa and MasterCard, and you'll see that Square doesn't have a lot of room to move below 2.75% and still make money.

The three big players in this "mobile payments" space are Paypal Here (2.7%), Intuit's GoPayment (2.75% flat, or $12.95/M + 1.75%) or, the aforementioned Square (2.75%). At the moment, if you're swiping more than $1295/M, Intuit's $12.95+1.75% would be the best choice...unclear though, how long that plan will be around since it's a loss-leader as well.

The market that's more curious to me is the "card not present" market...payment processors for websites. Stripe seems to be the darling of the Slashdot crowd, but their pricing is horrible. They offer 2.9% + $0.30 per transaction, and won't offer to discount it until you're doing $1M+ per year. Contrast with Paypal's Payment Pro which drops down first to 2.5%+$0.30 once you hit $3k/month, then down to 2.2%+$0.30 once you hit $10k/month. Stripe has a few features that PPP doesn't, but they would need to be real important to you to pay that much more.

^^^^^ This.

I gave both of my kids iTouch devices a few years ago. They still love them and game on them, but it pisses me off how every f'ing game has popups to download and install a new level, unlock, or companion game from the istore (for additional money). I have an android phone an see it slightly less often on my games.

If I could load up a kids store account with tokens or credits like on the Wii store that would be perfect.

Here you go.

See my post just above. No need to give them incidental access to a typical, no holds barred credit card: there are self-limiting options out there. They may have to track their own expenditures in order to know how much is left on the card, but hey, excellent learning opportunity! Balancing books is something most adults can't manage...

Do your kids have credit cards? It requires CC info and an online update before they can even use it. Afterwards they can charge up in-game-transactions at the press of a button. Just FYI, the system might not be what you expect.

So? Register with a $25 Visa or Mastercard gift card: self limiting, and who cares if the black hats scrape the number? When that runs out, update with a new card, if they got one for their birthday or whatever...

I look at this as a good way to teach them to be cautious and discriminating shoppers. They have a fixed amount: if they want to spend it all on Minecraft bling or the equivalent, that's fine, but when it runs out it's gone until their next birthday or Christmas or they spend their own money on a new card.

If you don't want to go through the hassle of re-registering a new card number each time they run out, there is also a reloadable pre-paid option. If the kids receive or earn cash, they can choose whether or not to load it on their card (or you might have to do it for them, depending on the T&C), but it's still self-limiting and much more secure than a 'normal' credit card.

BTW, the same principle applies to any micro-transaction site: Google certainly doesn't have my real CC number, yet I can still buy apps for my phone and tablet to my hearts content, worry free. I don't care if they share the number with app developers or get scraped or whatever: I think my remaining balance right now is about $15. Woo hoo, go to town... ;o)

Master card appears to have an opt out page. Anyone know if there's something similar for Visa?

With MC there's an on-line form: http://www.mastercard.us/support/merchant-violations.html. With Visa one needs to complain to the issuing bank. The first few times it was a pain figuring out how to do it but then it just becomes routine.