Who Pays For Credit Card Breaches?

PetManimal writes "A scheme to steal customers' credit and debit card information at a New England supermarket chain highlights a little-understood fact about credit card security: Customers still think that the credit-card companies have to eat fraudulent charges, but since the PCI DSS standards were adopted, it's actually the merchant banks and merchants who have to pay up. And, according to the blogger writing in the latter article, it's a good thing." "The main reason PCI exists is that there are tens of thousands of merchants who don't understand the basics of information security and weren't even taking the very minimum steps to secure their networks and the credit card information they stored... PCI pushes that burden downstream and forces merchants to... put in a properly configured firewall, encrypt sensitive information and maintain a minimum security stance or be fined by their merchant banks... [T]he credit card companies have taken the bulk of the financial burden off of themselves and placed it on the merchants, which is where much of it belongs...'"

Comments

The customer pays. Always.

[Anonymous Coward]

The merchant has to make a living, the credit card company too. The money for fraud can only come from the end of the chain: the customer. The only notable thing here is that all customers pay, not just the ones who use a credit card.

Re:The customer pays. Always.

[HomelessInLaJolla]

The only notable thing here is that all customers pay, not just the ones who use a credit card Some pay more equally than others, though. It works like a pyramid scheme. The government uses the same principle: it is the reason why we have hundreds of different hidden taxes in thousands of different places.

"We screw the other guy to pass the savings on to you."

Re:The customer pays. Always.

[hf256]

Err, no the customer rarely "pays". The merchant has always had to pay for any fradulent charges, in some cases the charges aren't fradulent but the customer can still dispute them and the merchant gets the shaft. The worst that can happen to the customer is that their card will be cancelled.

Re:The customer pays. Always.

[Anonymous Coward]

Directly the customer might not have to "pay". Indirectly though, the customer has to take the time to clear things up, which in some cases, can be hours or days worth of their time.

Re:The customer pays. Always.

[sqlrob]

The merchant gives the credit card company money.

To offset that, the prices are raised. So yes, the customer pays.

Re:The customer pays. Always.

[ResidntGeek]

Where do you think the merchant gets his money? That's right, from the customers. So, if the merchant loses a lot of money to credit card fraud, how do you think he recovers the money? By selling his penis on ebay?

Re:The customer pays. Always.

[redelm]

Yes of course some customers pay more. It's called "market segmentation". Different people pay different amounts in an attempt to capture the range of consumer utility while maintaining volume.

Re:The customer pays. Always.

[Anonymous Coward]

So, if the merchant loses a lot of money to credit card fraud, how do you think he recovers the money? By selling his penis on ebay?

Wait ... you mean, there's another way?

STOP THAT AUCTION!

Re:The customer pays. Always.

[Bastard of Subhumani]

To offset that, the prices are raised.

If the market would stand that higher price, why wasn't it being charged to start with? Conversely, if the market won't stand it, then lower volume (yada elasticity yada) could mean the merchant makes even less money.

Re:The customer pays. Always.

[Anonymous Coward]

But raising prices usually won't earn him back everything he loses (since people will buy less once the price goes up) so both the customer and the merchant pay.

Re:The customer pays. Always.

[gfxguy]

The prices are raised, and the consumers shop elsewhere.

Fact is, it's usually the merchants fault. Or, at least in my case, where every single fraudulent purchase I've had made with my cards (and there's been a lot, sadly) have come, 100% of the time, from merchants who didn't verify the card owner when the shipping address was different than the billing address.

Keep in mind, credit card fraud is different from identity theft. I've had my identity stolen, too. You may now be thinking I'm an idiot that doesn't protect his info, but it was a family member who had access to certain information, like my SS number.

I also always use a credit card (as opposed to a debit/credit card) because I'm protected, and I check my statements regularly. I haven't lost one penny.

So shoppers, especially online, flock to the cheapest merchants. If a merchant gets hit with a lot of losses, they raise their prices. The only way to stay comptetitive is to get a handle on these things before it costs them money and customers.

Re:The customer pays. Always.

[Anonymous Coward]

If a merchant must keep raising prices due to his negligence of the security of his store network he will reach a point where another merchant in town (with a secure network) offers lower prices. Hence the failure to secure his own system will be his downfall in business as the consumer always has a choice to take business else where and not fund stupidity.

Re:The customer pays. Always.

[Anonymous Coward]

The market accepts the higher price because the customer gets additional value: protection from fraud. It's like an insurance. You pay a small surcharge every time, but in return you get a convenient payment method that allows chargebacks in the few cases where the merchant tries to screw you. The customer however is still the one who pays for it, one way or another.

Re:The customer pays. Always.

[fangorious]

If the market would stand that higher price, why wasn't it being charged to start with?

The merchant fees have been part of the retail price for a while. Have you never noticed sellers offering a discount if you pay with cash or check? What you're actually seeing in those cases is every other retailer keeps the merchant fees as extra profit, and a select few really do pass the savings on to you.

Re:The customer pays. Always.

[Anonymous Coward]

That argument only works if one merchant has a higher rate of fraud then the rest. In that case, yes they would have a smaller profit margin than their competitors, all other things being equal. However, there is bound to be a certian amount of credit card fraud that is outside of the control of the merchants and thus applicable to all of them. In that case, the cost does get passed onto the consumers though higher prices, and in fact to society as a whole, as total efficiency is decreased and thus so is the material standard of living compared to if there was no fraud (like in candy land).

Re:The customer pays. Always.

[ShieldW0lf]

Of course the customers just pay more. If they're dealing with a huge corporation that can absorb all these losses, raise their rates and have customers with no option but to return.

Of course, if you run your own business making and selling high ticket items, and you need the money from your sales to buy supplies and cover your cost, it's not the same.

You can't double the cost of what you sell next to recoup the loss when someone rips you off on one of those high ticket items, no one would buy it.

This treatment of fraud helps big existing players because when big players get stung by this injustice, they roll it off to the trapped customers, but when small players get stung, they fold or suck it up out of their personal funds.

Re:The customer pays. Always.

[jrp2]

"The merchant has to make a living, the credit card company too. The money for fraud can only come from the end of the chain: the customer. The only notable thing here is that all customers pay, not just the ones who use a credit card."

All good points, but you are missing one major issue. The customers of the companies that put proper safeguards in place (check ID/shipping Address, firewalls, etc.) do not have to pay, or pay as much at least.

Therefore, those companies are able to charge less for the same goods, and thrive. Those companies that are sloppy will be hurt, possibly to the point of going out of business.

Darwinism in a business sense.

Re:The customer pays. Always.

[redelm]

There are differences between big & small businesses, particularly their ability to spread extra-ordinary losses over more/fewer customers.

However, the customer still pays in the long run even with small biz: if an industry is prone to large risks of loss, it will attract far fewer entrepreneurs, and those it does attract will demand margins to cover the losses.

Re:The customer pays. Always.

[nolife]

I don't know about the bank(s) you use but my debit/credit or "check card" has the same exact fraud protection policy as my credit card from the same bank. Both have the Visa logo as well.

I guess the difference is you would be able to dispute fraud from the actual credit card before paying the bill at the end of the month and not experience an actual loss of funds. A fraudulent check card purchase amount would be taken right from your checking account automatically, forcing you to dispute it to get it back and may cause a ripple effect as other checks and maybe some scheduled online bill payments drawn from that same checking account now have insufficient funds to clear.

I had a some fraudulent charges on my check card in the past. It only one phone call and 5 minutes to get my money back but that call did not happen until AFTER I noticed it on my monthly statement and the money was already gone. I did not hit the point where I experienced the ripple effect though.

Okay, I started off this reply with thinking there was no real difference between the two forms of payment because of the similar fraud protections but now I'm thinking I should be using my credit card more then my check card.

Either way, ATM/debit, check/debit, and credit card all from the same actual checking account are still much better solutions then carrying cash for me.

Re:The customer pays. Always.

[Dachannien]

That's the macroeconomic view, that in the long run, prices are determined by seller supply and consumer demand. The microeconomic view is that optimum profit doesn't necessarily mean maximum unit sales, so an individual retailer may be better off raising their prices and selling less product.

Re:The customer pays. Always.

[DogDude]

Therefore, those companies are able to charge less for the same goods, and thrive. Those companies that are sloppy will be hurt, possibly to the point of going out of business.

Not at all true. As has been mentioned many times in this thread, the merchant can do everything *perfectly* and still get fucked. My sis runs a mail order business. The cards go through her merchant gateway (which she pays through the nose for), the security checks go through, and she's STILL stiffed for payments on a regular basis. There's really nothing that merchants can do.

Re:The customer pays. Always.

[jrp2]

"Not at all true. As has been mentioned many times in this thread, the merchant can do everything *perfectly* and still get fucked. My sis runs a mail order business. The cards go through her merchant gateway (which she pays through the nose for), the security checks go through, and she's STILL stiffed for payments on a regular basis. There's really nothing that merchants can do."

They can REDUCE the fraud, probably not eliminate it. But they still have an advantage if they use due diligence and reduce the fraud.

I agree though, if they did do it right, they should not be charged.

I imagine there will be a shaking out. If things get out of hand (as in your example) the market should adjust.

Re:The customer pays. Always.

[DogDude]

If you're selling online, and you're using the merchant bank's gateway software, then in all reality, there's nothing else the merchant can do, other than refuse to ship to countries in Africa and Asia (which I now do). The merchant doesn't get any credit card info, except for the last 4 digits (if that) for tracking down problems later in the payment process. At least online, most merchants only get information from the merchant bank saying, "Yes, we've accepted payment for this order, and we'll pay you". That's supposed to be the job of the merchant bank, anyway.

Re:The customer pays. Always.

[StikyPad]

Because it's like inflation. If everyone has an added expense, then all prices go up. Since people still need [things], they keep buying them. They might be put off buying some [things] for a quarter or two, but eventually they'll realize that the prices aren't going to get any lower and they'll start buying again.

Re:The customer pays. Always.

[SlashdotCrackPot]

For the record, I work in the POS industry and have been delving into the PCI/CISP compliances for awhile making sure that we have taken all necessary steps to comply. The big factor that seemed to not be mentioned in the parent posting is the fact that the merchant is ONLY at fault and liable IF their processor/pos/and bank are not ALL PCI/CISP compliant. If you bend over and comply (this meant ALOT of money for some people) within the overall guidelines you are covered like normal unless you are deemed uncompliant.

Re:The customer pays. Always.

[Purdah]

For me at least, this seems to put another nail in the coffin of the smaller stores.
For the Supermarkets and large companies PCI DSS will be easily factored into their current IT budget and they will not have to change (raise) their prices or conversly they will use their buying power to pass the costs onto the producers.
For a smaller store there is little they can do other than raise prices. Realistically this is only going to benefit the biggest companies at the detriment to the smaller ones out there.

Re:The customer pays. Always.

[maxume]

Retail stores are not particularly good examples of efficient markets. Amazon manages to make quite a bit of money even though they end up paying shipping charges out of their margins a good deal of the time(Amazon is also a good example of 'the market' operating at a higher efficiency).

They pay a lot of things that are costs of doing business, and they manage to pay those costs because it can be difficult to open up an equivalent store close enough to matter.

Re:The customer pays. Always.

[CantGetAUserName]

I work in a bit bigger business than that so we run the cards ourselves - have you looked into that, it's not a complex as it seems and if you're going to get the shaft anyway you might as well see how...

(Used to be The Fraud Guy for a £5mil part of the business)

Re:The customer pays. Always.

[DogDude]

I work in a bit bigger business than that so we run the cards ourselves

I started doing that, but then security on our end became too hard to deal with (I'm the IT guy, the owner, the accountant, etc.). It made more business sense to offload all of our hosting and our handling of credit cards to the professionals.

Re:The customer pays. Always.

[CantGetAUserName]

Fair point. That department's up to two people now, soon to be three. On the plus side, it's for £10 mil now, not £5.

Re:The customer pays. Always.

[rollingcalf]

"If the market would stand that higher price, why wasn't it being charged to start with?"

Competition. If one seller raises prices, the seller gets outsold by others who don't raise their prices. But if something happens to all the sellers, like taxes or fraud, they can all raise their prices without worrying much about being undercut by others. However, even though all sellers raise their prices when hit by a common expense, they still lose out somewhat because of decreased volume.

Re:The customer pays. Always.

[DogDude]

Even then... security these days is so much more complicated than it was even 5 years ago... I'd be hesitant to bring all of that in house unless I had a hefty IT staff, with one or two people JUST handling the constant security issues as they arrive.

Besides, even if we brought it back in-house, we still don't get much more assurance that the credit cards we take are valid. What do you gain by bringing it in house, anyway?

Re:The customer pays. Always.

[edb]

Or, at least in my case, where every single fraudulent purchase I've had made with my cards (and there's been a lot, sadly) have come, 100% of the time, from merchants who didn't verify the card owner when the shipping address was different than the billing address.

How often do you make fraudulent purchases? And do you think it's a good idea to admit to doing so online?

[Have you stopped beating your wife/dog/wang?]

Sorry, couldn't resist.

Re:The customer pays. Always.

[edb]

The credit card companies pay nothing for credit card fraud. Their excuse for the usurious interest rates (24% and up in many cases) is to cover their losses. But in reality, the banks have zero losses due to credit card fraud. All losses are paid by the merchant victims, who accepted the card in good faith. The total cost to the credit card issuers is the overhead for paperwork. Cost to the consumer is time. Cost to the merchant is real $$.

And the credit card issuers advertise that they "protect" the cardholder from credit card fraud. That's fraud right there. The issuers simply charge it back to the merchant who did everything right -- ID check, address verification, signature, everything that could possibly be verified. If the cardholder disputes a charge simply because they don't remember it, the merchant is automatically charged a fine, and the transaction amount reversed. Then, after "investigation", the cardholder admits that the charge was correct, the merchant is still in the hole for the fine and the "research fee", which total at least $50 and can exceed $100 for a single $10 transaction which was correct and is eventually confirmed by the cardholder.

Eventually this cost must be passed through to the customer. Not all at once, and not across the board at all merchants: just like increases in postage, gas, utilities, etc., some merchants will absorb the added cost for a time. Some will raise prices sooner, some will raise them later. But eventually, equilibrium again will be reached, and prices at all merchants will reflect the increase, one way or another, and the differences in price between merchants will again be due to all the other usual factors.

Same old story, same old Slashdot. See the similar thread from Feb 2003: http://it.slashdot.org/comments.pl?sid=54226&cid=5 323876/

Same season, 4 years ago. Same story.

Re:The customer pays. Always.

[Anonymous Coward]

If the market would stand that higher price, why wasn't it being charged to start with?

Because in the absence of fraud, that price would result in an oversupply. Fraud raises the cost of doing business to the point where supply is reduced to the exact level of demand at that price.

Re:The customer pays. Always.

[Anonymous Coward]

that price would result in an oversupply

That sounds like the market *not* standing it.

Re:The customer pays. Always.

[CantGetAUserName]

Sorry for delay responding - hella busy at work. The gain we experience is an average of £1000/month fraud on £10m business. Compared to what the automatics seem to manage, it's work the couple of employees.

We do! We do!

[Anonymous Coward]

Wait, what?

Misses the point

[currivan]

The merchant who accepts the fraudulent charge eats the chargeback, not the one whose site is hacked. How does this encourage information security?

Re:Misses the point

[Scott Lockwood]

It doesn't. It makes Visa and Mastercard more profitable, however, which is what they care about.

Re:Misses the point

[Tillmann]

Hi,

true, but there may have been cases where merchants are entirely aware that they're accepting stolen credit cards (and didn't care). Maybe not your average online retailer. But quite possibly the gold shop somewhere in South East Asia, who in the past happily served the suspicious-looking stranger who buys as much gold as "his" credit card limit allows.

bye,
Till

Re:Misses the point

[letxa2000]

As a merchant, this is very annoying. If I submit a charge to Visa/Mastercard and it's authorized, I should be able to count on that unless the valid cardmember has a legitimate complaint that I did not resolve and charges it back. If the use was fraudulent, as the merchant I have absolutely no way to know that--that's why I'm asking Visa/Mastercard for authorization. If they authorize the charge then they think it's legitimate, too, so why should the merchant somehow be expected to think otherwise or be held responsible for 100% of the chargeback?

To pay extortionate discount charges on every transaction and not even be able to trust that the charge is legitimate is abusive on the part of Visa/Mastercard. What's worse, a chargeback comes with a chargeback fee. So not only does Visa/Mastercard not get harmed by fraud, it profits from it. As long as that is the case, Visa/Mastercard has no motivation whatsoever to increase security and decrease fraud.

Re:Misses the point

[ShibaInu]

Technically neither Visa nor MasterCard is a for profit business. It looks like that is changing, but for most of their history both companies were just a service provider to the various banks that issued credit cards. So it wasn't Visa chasing down the money, it was the bank that issued the card that was.

Re:Misses the point

[Anonymous Coward]

Because the merchant who is blindly accepting fraudulent cards ISN'T being secure.

As an employee at a company that relies on heavily on online credit card sales, we are extremely careful with card security, taking nearly every order with a grain of salt, verifying that the information we are given is valid and making sure the orders are not fraudulent.

Re:Misses the point

[Erwos]

Clearly, they should have done a better job actually authenticating that the person who did the charge actually is the card owner. Good security doesn't involve just protecting credit card numbers from being stolen - it's trying to prevent those credit cards from being used fraudulently, too.

Re:Misses the point

[truthsearch]

Both Visa and MasterCard have been operating for-profit for over 10 years. Visa started first, then MasterCard decided they needed to fill their coffers to keep up. I was working at MasterCard when they started to focus more on profits. The change really became a focus at the company after MasterCard lost their application with the US government to be considered a non-profit organization to avoid paying taxes.

Re:Misses the point

[mike2R]

If the use was fraudulent, as the merchant I have absolutely no way to know that--that's why I'm asking Visa/Mastercard for authorization. If they authorize the charge then they think it's legitimate, too, so why should the merchant somehow be expected to think otherwise or be held responsible for 100% of the chargeback?

You have to look at it from the other perspective though - like any merchant I'm sure you receive your share of obvious frauds (the ones you delete without even turning on your brain - 400 units of $expensive_product to Lagos etc). Maybe you're honest enough to still decline them if you knew you'd get the money, but lets face it many aren't.

At the end of the day, the merchant knows their business, and is by far the best situation to spot fraud attempts, and I don't have any problem with the majority of the risk being taken by us.

What gets to me is the total lack of interest from merchant service providers. I do think it would be better if they bore a small percentage of the risk; 10% at most, maybe 5%. Then they might actually start to care, and if they care then maybe the police would.

Some friends of mine still tell a story from pre-internet days: an obviously fraudulent order was reported to the police, who actually took action(!) Two police officers dressed as couriers delivered a fake parcel and nicked the thief when he signed for it.

This is what really gets me about internet/mail-order fraud. The risks would be huge if the police gave a shit, since frequently it is blatantly obvious, and the thief has given the place and time he's going to receive the goods, and all that has to be done is turn up and put cuffs on him. No-one cares though.

Re:Misses the point

[Bryansix]

If you use a virtual terminal on your merchant account and sell stuff over the phone or online then you can only check the fields the merchant bank allows you to check. Even checking name, address, card number, security code etcetera will not prevent fraud in the case of a stolen customer database that would store all of that information.

The retailer is not supposed to store all of that info but many do and many store it insecurely.

Re:Misses the point

[josquint]

When I worked retail it was company policy to ALWAYS ask for ID and compare signatures on a card to the ID. Due to our credit card processing company making it known that it was OUR reponsibility to verify this, as the end user is the only one that can.

On the flip side of this, I walked into Home Depot and purchased $49 worth of merchandise with a credit card in the SELF CHECKOUT and was NOT REQUIRE TO EVEN SIGN. Anything under $50 does not require a signature. Now how is it even remotely possible for them to know who is charging on the card?

As a former retailer, I very well know the frustrations of a chargeback that comes out of no-were. As a consumer, I've found that it's quite easy to deny a charge for very little reason.

Re:Misses the point

[Jonny do good]

If I submit a charge to Visa/Mastercard and it's authorized, I should be able to count on that unless the valid cardmember has a legitimate complaint that I did not resolve and charges it back. If the use was fraudulent, as the merchant I have absolutely no way to know that--that's why I'm asking Visa/Mastercard for authorization.

To me it is annoying that 90%+ of the time the merchant never checks my signature line which says "See ID" and actually ask for an ID. I understand your complaint, but when merchants blindly accept a card they should have to pay for it. I know it always ends up being the end consumer that pays, but still why should Visa/Mastercard lose their profits when merchants usually never check the card in the first place?

Re:Misses the point

[multimed]

Not to mention whoever got hacked - be it the merchant, MC/Visa or the issuing bank - usually manages to keep the whole thing secret. Even when it's your account info that has been stolen, they won't even admit to you that it has. Of course they justify this because you don't have to pay for fraudulent charges that result. If you catch them in time. And of course it assumes that they can't do anything else with the info. I can accept the fact that they won't ever really pay the cost when they can pass them along to us as an expense of doing business - same for fines. But there needs to be a law requiring disclosure and criminal charges for failure to disclose breaches. The bad PR and loss of public trust is the only way to punish bad security and allow consumers to be informed, not to mention actually providing them real encouragement to work harder at protecting private information.

Re:Misses the point

[letxa2000]

You have to look at it from the other perspective though - like any merchant I'm sure you receive your share of obvious frauds (the ones you delete without even turning on your brain - 400 units of $expensive_product to Lagos etc). Maybe you're honest enough to still decline them if you knew you'd get the money, but lets face it many aren't.

I have looked at it from their perspective and it still doesn't make sense. If someone has a history of lots of chargebacks, that merchant gets canned anyway. If I'm entering ship-to and bill-to addresses into the system and if there's something that makes them (or their computers) uncomfortable, have the merchant call in for verbal authorization where the risks are explained to the merchant and/or Visa/Mastercard can say that they won't take responsibility for the charge.

I'm not opposed to a merchant being expected to be honest enough to do due diligence. If I ship something to Nigeria and expect Visa/Mastercard to pay me, and it turns out to be fraudulent, they have a right to ask me what documentation or evidence I have that I made an honest effort to be reasonably sure the transaction was valid. If I failed to do that, they can expect me to pay for it. But if there's nothing Nigeria-like about the transaction, nothing raises my suspicion, I submit the card to Visa/Mastercard and they authorize it and confirm the zip code and CSV matches, I've done all I can. To then turn around and say, "Yeah, we know we told you the charge was authorized, we know you have the right address, zip code and CSV, but what do you know... our system sucks and even though you obviously have all the right data you could possibly provide, we're still holding you responsible."

If a merchant is fraudulently processing charges or is accepting credit cards that are obviously stolen, that's a crime that should be prosecuted in a court of law. Simply assuming all merchants are crooks and arbitrarily taking back money you already gave them is simply not acceptable.

A customer is in the "business" of buying. A merchant is in the "business" of selling. Visa/Mastercard is in the business of facilitating the transaction. That's their business and they need to make sure it works so the buyer and seller can do their business. It is not acceptable to hold either the customer or the merchant responsible for shortcomings in Visa/Mastercard's system. If a merchant gets an authorization number from Visa/Mastercard, that should be a done deal. If it's fraud, Visa/Mastercard needs to eat that charge. If that means raising the discount rate, fine, do it--and let merchants decide whether they're willing to accept credit cards given the real cost of accepting them; or the customers and/or merchants will demand real security.

Re:Misses the point

[hackstraw]

It makes Visa and Mastercard more profitable, however, which is what they care about.

OK. A merchant does not have to accept credit card payments at all. Its a choice up to the merchant, and part of that choice involves the complexity of implementing a CC payment system, the cost of a percentage of profits on each transaction to the CC people, but I was under the assumption that the benefits to the merchant were:

1) more customers can buy things

and

2) they are guaranteed payment

Checks can bounce, cash can be stolen, or fake. I thought the lure of #2 was that the extra cost that they paid on each transaction was insurance that they would get paid.

I'm just a computer guy, but this is my understanding of the system. If there is no #2 benefit provided from the CC people, I don't see too much of a benefit to accepting CC payments.

Re:Misses the point

[Anonymous Coward]

On the flip side of this, I walked into Home Depot and purchased $49 worth of merchandise with a credit card in the SELF CHECKOUT and was NOT REQUIRE TO EVEN SIGN.


Oh yeah. That illegible squiggle on the the PIN pad device is a GREAT security check.

I don't understand why _anyone_ asks for signatures any more. No one looks at them, and if you do look, then what can you compare it with? (the illegible squiggle on the tiny stripe on the back of the card?) Different input area results in different squiggle, so... what was the point?

Re:Misses the point

[Anonymous Coward]

On the flip side of this, I walked into Home Depot and purchased $49 worth of merchandise with a credit card in the SELF CHECKOUT and was NOT REQUIRE TO EVEN SIGN. Anything under $50 does not require a signature. Now how is it even remotely possible for them to know who is charging on the card?

Would you feel better with an illegible squiggle? Requiring a signature at a self-checkout isn't very useful, since there is no person who compares it to anything.

Re:Misses the point

[letxa2000]

To me it is annoying that 90%+ of the time the merchant never checks my signature line which says "See ID" and actually ask for an ID.

I'm actually talking more about card-not-present transactions which is where the real risk is. While I guess someone could steal your physical credit card and try to use it, that'd be pretty bold these days. Cards are canceled so fast that it might not even work and they'd get caught with a stolen card on their person. It'd make more sense to just silently collect credit card numbers and use them online where at least you're not right there to get caught. So I really don't think you increase your own security by asking someone to look at your ID; and if someone steals your card and some merchant accepts it, you get to charge back the whole thing anyway. So why are you concerned?

I understand your complaint, but when merchants blindly accept a card they should have to pay for it.

I somewhat agree on card-present transactions. If they don't ask for an ID, they haven't done due diligence. It's not unreasonable to ask for ID on card-present transactions. But I'm more concerned about card-not-present transactions. Visa/Mastercard has decided to allow these transactions for decades, whether it be by phone or Internet. They're more than happy to allow that even though the cards aren't present. If they're willing to accept the transaction and profit from it, they should be willing to vouch for the transaction. If I've provide Visa/Mastercard with every detail they ask for (credit card #, expiration, CSV, billing name/address and shipping name/address) and they authorize it, that's my due diligence. If they want more evidence to vouch for the transaction, they should ask for it. But for me to give them everything they ask for and then have them turn around and say it's my fault the transaction was fraudulent is bogus.

It really comes down to an antiquated system. Every bank should allow users to be able to login to their account and have master control over their card. We should be able to tell our bank that for any given card, only accept "card present" transactions. Or to "open" our card for non-present transactions for a specific period of time. Ideally, every merchant would have a public merchant ID that would be posted to websites and users would get that number and authorize a specific merchant for a specific period of time. Any transaction that didn't meet the customer's authorization specifications would be rejected. If that was done, credit card fraud would drop to almost zero and NO-ONE would lose. Except the crooks.

Re:Misses the point

[Dan Ost]

What about on-line merchants? How are they supposed to compare your signature or view you ID?

Seriously, what protections do they have?

Re:Misses the point

[Anonymous Coward]

You're missing the point of an authorization. When you ask for an authorization, you're not asking if the card legitimately belongs to the card presenter. How would they know? The point of the authorization is to validate that (a) the account is in acceptable standing (not already reported as lost/stolen/past due/etc), and (b) the account has enough available credit for the charge. If (a) and (b) are satisfied, the auth is approved--even if Frank is using Jim's card. Sorry, but it's the merchant's responsibility to validate if it's Frank or Jim trying to use Jim's card. If they don't, and it's Frank, they'll eat the chargeback.

Re:Misses the point

[planetmn]

If you don't like the system, don't accept the credit cards. Nobody is requiring you to. If you get chargebacks, that's part of the cost of doing business and you have to determine whether or not that is acceptable.

-dave

Re:Misses the point

[dbaker]

False. Have you ever signed a merchant contract? I have.

The merchant whose billing data was compromised is liable as well -- both for the charges, the cost of replacing cards, and fines by the issuer and/or credit card network.

It's easy to take a bunch of fraudulent charges and see which merchant they have in common to determine the source of the data. Merchants are fined more if they don't disclose a breach of data before the credit card companies discover it.

Re:Misses the point

[planetmn]

It's a cost of doing business and a problem that they have to consider. Just like a retail business has to determine if the cost of a storefront and physical presence is worth the cost. If they don't like the risk, don't accept credit cards or don't set up shop.

-dave

Re:Misses the point

[jfengel]

Yeah, that would sure be nice. I'd really like to see one of the many digital-signature checking systems catch on with merchants. The kind that involve a private key. That would put a lot more on the consumer to protect his keys, but it would take a lot of pressure off the merchant.

Theoretically paypal is such a system. I'm not sure what happens with paypal disputes, but at least it's difficult for somebody to claim that somebody stole their paypal account the way somebody can steal a credit card number, since the truly unique information rests solely with PayPal. But I'm told that PayPal is rather onerous in its other dealings with merchants.

I really think that the next move is up to the merchants to pick a system and stop accepting no-card-present transactions entirely. Those are so fraught with peril that I'm stunned that people accept them at all any more.

The credit card companies could create such a system very easily and wipe out Paypal right quick, but as others have pointed out their risk exposure is so minimal that they're perfectly content with the system as it is (and in fact even profit from it.) I know both Mastercard and Visa were working on such systems, and I really don't know what happened to them.

Re:Misses the point

[planetmn]

As a former retailer, I very well know the frustrations of a chargeback that comes out of no-were. As a consumer, I've found that it's quite easy to deny a charge for very little reason.

It's also quite easy to shoplift from a lot of stores, to back into somebody's car and just drive off, etc. Just because something is easy, doesn't mean that people take advantage of it.

Every chargeback I have made has been completely legitimate. One of the reasons I pay for everything on a credit card is that security it provides me. Once a merchant didn't want to obey their return policy, so I left the store and disputed the charge, got my money back. Another time, a service provider decided he deserved more of a tip than I gave them (he even called me after the chargeback and tried to argue that he deserved the additional money), again, I got my money back. I don't bother arguing with customer service anymore. If they don't follow their own return policy, I'll say thank you, walk out, and dispute the charge.

Sure, if the system is being abused, then I feel bad for the merchant. I don't personally know the percentage of instances where a chargeback is not warranted, but given to the consumer, but if as a merchant it costs you too much, don't accept credit cards.

-dave

Re:Misses the point

[planetmn]

Convenience for the customer (could) mean more customers.

I don't carry cash. I charge everything. It keeps my purchases easy to categorize in Quicken, and if there is a problem, I have the security of being able to do a chargeback (retailer won't follow their return policy, etc.). If a store doesn't accept credit cards, I don't shop there. Period.

But like you said, the merchant has a choice whether or not to accept credit cards. If the costs are too high, then they shouldn't accept them.

-dave

Re:Misses the point

[Imagix]

What I find more interesting about the "See ID" idea, on most of the credit cards I've seen, they all have a clause that says "Not valid unless signed".

Re:Misses the point

[Anonymous Coward]

To me it is annoying that 90%+ of the time the merchant never checks my signature line which says "See ID" and actually ask for an ID.

To me it is annoying that people keep writing "See ID". It's a myth that writing "See ID" on the back requires the merchant to ask for ID. Read Visa's opinion.

If you read your cardholder agreement, a card that is not signed isn't valid. If you write "See ID" instead, the merchant is supposed to make you sign the card before they can accept it.

In fact, if you read the merchant agreements for Visa & Mastercard, merchants are not allowed to refuse a card because the cardholder does not have ID.

But if it makes you feel warm & fuzzy, write "See ID" on the back of your cards. That is the only benefit.

Re:Misses the point

[Jonny do good]

What I find more interesting about the "See ID" idea, on most of the credit cards I've seen, they all have a clause that says "Not valid unless signed".

I have always found that interesting as well. I guess that my credit cards aren't valid.

Re:Misses the point

[GooberToo]

Because most merchants are given a discount rate based on the agreement that identity will be verified at the time of purchase. Most merchants refuse to do this or ask for information they should NOT to ask for (e.g. phone number or address, both unconfirmed). Please, give a fake address and phone number everyone a clerk asks you for this information. In turn, the merchant expects the issuing bank to eat it because the merchant basically helped steal the product to begin with.

As a result, issuing banks are getting tired of idiot merchants. Now they are keeping their discount rates the same (or nearly so) and forcing more of a burden to the idiot merchant. Suddenly, merchants are starting to check for ID and actually attempt to validate ID matches the name on the card and the signature matches that of the ID and card. Having said all that, most merchants still do not match signatures, which means even crappy fake IDs go unnoticed when stolen or fraudulently obtained credit cards are used for purchases.

In a nut shell, merchants are paying because most are absoluete morons and actively encourage ID theft, stolen cards, and fraudulently obtain cards and IDs!

You reap what you sow.

Re:Misses the point

[skoaldipper]

> If they authorize the charge then they think it's legitimate, too, so why should the merchant somehow be expected to think otherwise or be held responsible for 100% of the chargeback?

The detective in this Stop & Shop store said the theft "involved card readers being removed, tampered with, and reinstalled". This is negligence on that merchants part. Here's a real life scenario of another form of negligence and why merchants should be held liable:

My Mother, who is retired, had her billfold stolen from her purse at a Whole Foods Store recently. One thief distracted her by pretending she was blind and asked her to assist in reading a food label, while the other thief meticulously rummaged through her purse. Before my mother had the chance to even leave the Whole Foods Store or checkout, several fraudulent charges were already placed at a nearby Walmart. The speed at which they made these fraudulent charges is important here, because many creditors recognize criminal case studies and factor those into their guidelines and procedures in a merchant agreement.

* The cashier never looked at the back of the card to match signatures. If they had, red flags and rockets would have flown all over that store. It wasn't even close, nor complete. You can read about such requirements here. Basically, and I never fully appreciated the importance of a signature on the back of a card before, 1) it has been shown in case studies that thiefs move swiftly and do not practice signatures before use (nor do they have time in such a scenario presented here), 2) even if they do, they are required to sign a receipt in the presence of a cashier (which greatly assists cashiers in making that determination), 3) if no signature is present, an ID can be requested for verification (but some states do not allow this), 4) they must sign that card by Visa acceptance policy (and imagine a thief attempting that on the fly), and 5) even for the extreme case scenario of 3 (where customer refuses to give ID and cites state law, where only the boldest of thiefs would venture here), that cashier is required to call a code 10. None of these precautions were followed. I fully recognize the time constraints of every cashier requiring every customer to follow along with these guidelines. I also fully recognize many stores have an acceptable loss scenario to facilitate customer expectations instead. Personally, I always thank a cashier for requesting my ID or matching signatures on my card. It is responsible and (as artificial as it might be) instills some level of assurance between me and that merchant.

> If the use was fraudulent, as the merchant I have absolutely no way to know that--that's why I'm asking Visa/Mastercard for authorization.

There is some implied trust here that merchants follow some simple safeguards and procedures. Visa and other credit issuers are protecting us, the careless or oblivious consumer, from the inept merchant; as in this Stop & Shop or in my mother's case.

Walmart was held liable in this case. Visa made them chew on every bit of some $700 for a TV and gift cards. Even the detective investigating this case cited Walmart (not Visa) as responsible, as it should be in my estimation. The Walmart manager even said they were responsible in this case. I sympathize with them, but I agree with their own conclusion as well. This was a more traditional theft case scenario. The PCI DSS guidelines to merchants seems like an acceptable extension for the non traditional approaches as well (like the Stop & Shoplift scenario).

Re:Misses the point

[kakofb]

Well maybe if some merchants actually did follow some steps to reducing fraud, like maybe checking the signature on the card properly and have measures in place for staff to easily deal with a potential fraud (where the signatures don't appear similar enough for their satisfaction), then they might cut down on fraud.
I do think it's up to merchants to bear the cost of fraud, because there are very simple measures they can take into account to reduce fraud significantly. The department stores here in Australia require photo ID for cc purchases over $50, as an example.
Internet commerce has no measures to prevent fraud, it's just the credit card number, and maybe the CVC number. I guess then at least they'd have the customer's address, but that's fairly unstable.

Re:Misses the point

[Catiline]

I signed my credit cards (in blue pen), then went over it in black permanent marker with "ASK FOR ID".

Signed (e.g. valid), but you really have to be utterly blind to overlook the message.

Re:Misses the point

[SlashdotCrackPot]

You my friend miss the point. They mandated a specific set of security policies and procedures, that if you spend the money to comply to, in their book you are as secure as you are REQUIRED to be. In the event of taking a fraudulent credit card, you are not delving outside of the preset security mandates, you were just a sucker that took a stolen card without checking the name on the back of the card to match an ID. Bet you didn't check the receipt to make sure that it matches the name on the card (reprogrammed mag stripe). In the instance of being compromised from a security standpoint, if you meet the all of the requirements set forth, then you were exploited beyond the realm of the compliance standards. The new standards include storage limitations on card data (can't store full swipe anymore), encryption standards (SSL), mandates on what we can do with what little data is actually manipulatable by the pos vendor among many, many others. The kicker is, my software provider doesn't even have the encryption keys to decrypt the .dbf's that we keep the card data in. You know how much of a pain in the @#$#* this has proven to be?? It's a little gestapo-esque, but a darn good implementation of CYA by VISA/MC etc. The thing that everyone is missing is that if you comply, you have just as good if not better coverage than you did before. The people that do not comply, not only do not get any of the safety nets they are used to, VISA and friends can actually charge you more per transaction or completely cut you off. This includes retailers, banks, merchant processors, the whole shebang.

Re:Misses the point

[graphicsguy]

The point of the authorization is to validate that (a) the account is in acceptable standing (not already reported as lost/stolen/past due/etc), and (b) the account has enough available credit for the charge.

Actually, it doesn't seem that the banks bother to check (b) and deny the transaction if it will go over the limit. They would rather allow the customer to overdraw their account so they can charge massive fees.

Re:Misses the point

[CantGetAUserName]

Some of these guys do have huge amounts of info, too. One of the frauds I caught when I was doing this for a job was able to provide me, within a couple of hours, with the actual card owner's full name, work address (company card) work and home phone numbers, email address, everything. I used the work phone number to ring her up and asked if she knew us :)

Re:Misses the point

[letxa2000]

Nice. So why can't you extend that same logic to Visa/Mastercard? There's no reason to pass it off on the merchants instead of Visa/Mastercard. Like I said elsewhere, a business that takes a credit card has enough stuff going on in their own business to have to be held responsible for flaws in Visa/Mastercard's system.

The whole "if you don't like the risk, don't accept credit cards" is no longer valid. It might have been 20 years ago (and many places didn't accept them back then), but now you can't do business if you don't accept them. Visa/Mastercard/AMEX basically holds a monopoly on transaction processing and if you don't accept them, you often can't do business. So while the "if you don't like the risk, don't take the cards" is a nice, convenient cop-out, it really isn't a legitimate answer.

The fact is, Visa/Mastercard is now a scam. There is essentially zero cost to provide the Visa/Mastercard service now that we have Internet and if they aren't even going to guarantee the payment is valid, WTF am I paying 2-4% in discount fees for? Any decent developer could make a competing system in a few months--the problem is that no-one would use it because the market is dominated by the Visa/Mastercard monopoly. And therein lies the problem: Visa/Mastercard is an abusive monopoly and the merchant gets screwed.

Re:Misses the point

[letxa2000]

You're talking about specific cases of negligence. If a merchant is negligent, he is at fault and obviously should be responsible for the chargeback. But, especially in the case of online transactions, if a merchant collects all the information Visa/Mastercard wants, passes that to Visa/Mastercard, and gets an authorization, the merchant has done everything he can. If Visa/Mastercard wants to subsequently steal the money out of the merchant's account, they should be required to go to court and sue the merchant and not just dip their dirty hands in the merchant's account and yank the money back.

Visa/Mastercard is the middle man. He takes money from buyer and gives it to seller. That's his whole reason to exist. If Visa/Mastercard can't do that without being sure he's taking money from the right buyer, maybe he has no place being in the friggin' business of being the middleman. I understand that's a difficult task, but that doesn't mean they shouldn't share some responsibility.

Re:Misses the point

[AusIV]

If the use was fraudulent, as the merchant I have absolutely no way to know that

I beg to differ. On the back of my credit card, the words "Not Valid Unless Signed" are quite clear. Just below that is my signature and the words (See ID). I worked retail all through high school and over extended breaks during college, and I always checked signatures against the back of the card. If someone had written something to the extent of "check ID," I did. But 90% of the places I use my credit card, the clerk doesn't bother to check the signature - some places they never even touch my card. On the rare occasion that someone asks to see my ID, I thank them for asking, and if it is a tipping establishment, they get a little extra. The merchant is the only link in the chain that can check identification, and they almost never do.

As far as online merchants, they also have a line of defense. I recently purchased a laptop and asked that it be shipped to my dorm - the address on the card being my home address. Within minutes I received an e-mail saying that the order could not be processed until I added my dorm as an alternative shipping address with the credit card company. The credit card company then required a piece of personal information that would have been hard for a third party to come by.

In short, merchants who meet the customer in person can check signatures or ID. Merchants who are shipping items have the opportunity to confirm the shipping address, and merchants who are providing online services can generally terminate the service if the credit card comes back as fraudulent. I would agree that a chargeback fee is inappropriate, but I think it's quite reasonable to hold merchants responsible for accepting a card without taking precautions to insure that the person using the card is the person whose name appears on the front of the card.

Re:Misses the point

[Worldwatcher2u]

Ah AusIV only if it was so.. but alas it not that. I can give my CC to my son or daughter and tell them they can use it. The merchant may or may not accept it, its his/her choice. If the card is a fraud the merchant eats it. Signature are not required.. read your contract. The signature is only, repeat only to accept the card. The merchant is not a hand writing expert and cannot say the signature on the card is the same or not. An electronic signature is an example, doesn't even come close to my real signature. Read my post to get the real reason and a solution.

Re:Misses the point

[jenxdigital]

You, as a merchant, are paying for bad habits that every employee of every establishment that accepts visa or mastercard makes. When was the last time you were ASKED for your ID to validate against the signature? (Not the last time you willingly handed them your ID.) And, then, there are the actual theft rings, who gain employment at locations with high turnaround rates (gas stations, restaurants, hotels)...who checks their backgrounds? Who checks backgrounds for a 7-11 employee? So, yes, you pay exorbitant fees. If the police get involved, your taxes pay for the work they put into it. The fee you pay does the same. A Loss Prevention Officer has to do the legwork, you get charged if someone uses a stolen or copied card. But, I think, on both ends....police should be giving some FREE training to employers to teach to their employees regarding nipping fraud in the butt. Because, the more you, a merchant, know about preventing fraud in your store, the less you'll ever have to pay in chargebacks.

Re:Misses the point

[Worldwatcher2u]

Ok folks here is the facts and reasons behind credit card (CC) fraud and why it falls on the merchant. I speak as a fraud investigator of many years. The person who has his or her credit card stolen is a VICTIM of the theft or ROBBERY of the card and other material stolen at the time. Sometimes the CC is stolen from the mail, the thief assumes the name on the credit card. Sometimes the CC is lost and the person doesn't realize it is lost, the finder decides to use the card and assumes the name on the card. Sometimes the card is completely forged and the person has no idea that the card has been duplicated. Sometimes the card is stolen overseas and not reported right away or not at all. Sometimes the owner of the card reports the card stolen when in fact it was not. I have only given you a few scenarios leaving out the more sophisticated schemes for obvious reasons. The point is the CC company has no idea which if any of these things are taking place. The merchant agrees to accept CC for the convenience of their customers and to generate more business; therefore it falls on the merchant to make the call to accept or not. There is the problem of "Who is the victim". The person who had the card stolen is only a victim of a theft. Should the card be fraudulently used, the merchant is the victim of the fraudulent use, not the CC company. The witness of the use is the clerk or merchant, not the CC company. So in the case of CC fraud, its the "seller beware" not buyer beware. In defense of the CC companies, they do employ sophisticated software that tracts unusual purchases and they will attempt to contact the card holder should they become suspicious. When you compare the millions of cards in use with the number of fraudulent use it become minuscule. On the other side of the coin, the credit card companies can put a stop to this. How? Well its simple... almost. They can require a finger print at time of application. FINGERPRINT.... OMG... this is where a lot of Slashdot subscribers and followers are hyperventilating big brother will be tracking me, watching me and what I buy, my porn, or whatever. NO not a fingerprint. But the fact is a fingerprint can be numerically read and that number can be put on the magnetic tape of the card. A PIN number should also be issued by the CC company to the card holder and that PIN has to be entered at the time of purchase. A fingerprint reader at the check out stand could compare the numerical reading of the buyer print and what is on the card no match no sale. Cost? millions, but the fraud would be cut down and the customer would feel safe as well as the merchant. As far as internet sales go .. well thats another story, with a different solution.

Re:Misses the point

[stinkytoe]

while i would in most circumstances never defend visacorp et al over the merchant, in this case i will. All an authorization means is that the cardholder has at least x dollars of available credit, and that you as a valid cc merchant want to reserve x dollars from said credit for a charge to be made at a later date. It in no way means that the charge is legit, only that you (as the merchant) agree to properly bill the customer through your merchant bank at a later time, typically the next business day. The authorization and the actual charge are actually two different processes, even though the auth is needed for the charge to be valid.
The point that i am working towards is that when a merchant aquires a visa/mc/etc merchant account, they bear the responsibility to only charge for what they in good faith believe to be legitimate transactions, and visa/mc/etc only acts as a middle man in such transactions. Neither more or less than they claim to be. In this case if the merchant accepts a fraudulent transaction, the burden is on them to make good, not the cc company who is only acting as a banking agent. Now if the cc company were to charge customers for transactions not made, then this would be completely different, but that is not what TFA is referring to.
And as much as i like to favor the merchant over the banking industry, i honestly think this is the most fair way to handle this situation,.

Re:Misses the point

[edb]

What I find more interesting about the "See ID" idea, on most of the credit cards I've seen, they all have a clause that says "Not valid unless signed".

The blank ones are even better. The thief doesn't even need to try to forge a signature, they just sign the card using their own writing. Then the signature on the transaction slip will match for sure.

Re:Misses the point

[srpatterson]

The banks authorise online without checking much more than whether the amount can be transferred. Yes its crap, but thats just what they do

Re:Misses the point

[Anonymous Coward]

That's because of the merchant agreement. If you read most of them, you will find that requiring ID for a credit card transaction is very often against policy if the card is signed and the signatures "reasonably" match. The catch is that, if the card isn't signed, you can ask for ID, but because it's not valid without a signature, if it gets charged back, you're 100% up shits creek because it wasn't valid.

Re:Misses the point

[MoneyT]

Most merchant agreements that I've seen expressly forbid you from requiring ID if the card is signed. Even worse, many of the merchant agreements require that you accept the picture on the card as valid ID. The problem is, most of those pictures look like old yearbook photos and the person in the pircture looks nothing like the person in front of you.

Re:Misses the point

[MoneyT]

It may be different in Australia, but in the US, it is a violation of the merchant agreements to require ID.

Re:Misses the point

[GooberToo]

Hmmm. You must live in a really screwed up state or something. I used to work in the credit card industry and still know a VP for one of the larger merchant processing facilities. I can assure you, they absolutely do want you checking ID. In fact, that is always explicitly stated in their merchant agreements. Furthermore, it is also included in the merchant training at time of equipment installation. In fact, some merchant banks actually send people into the field to make sure their merchants are checking ID. If they catch them failing to check ID, they quickly raise their discount rate as they are a much higher risk merchant. Of course, the merchants gets pissed, but once again we validate that merchants are idiots.

When I see their merchants process my card and they don't validate my ID, I know it is because the merchant doesn't care. They are afraid it will scare away customers. Yet at the same time, they get VERY upset when they are forced to eat the cost of items that they helped steal.

Lastly, the majority of credit cards do not have owner pictures on them. And even when they do, the picture should still be checked against a second ID, plus the signature. That picture is another mechanism that allows merchants to mitigate some of their risk. It was never intended to be the sole form of identification.

Sounds like you either need to move to another state or you need to find better processors.

Re:Misses the point

[MoneyT]

Seems that you haven't read the agreements too carefully then:

http://usa.visa.com/download/merchants/rules_for_v isa_merchants.pdf

Therefore, merchants cannot refuse to complete a purchase transaction because a cardholder refuses to provide ID . Visa believes merchants should not ask for ID as part of their regular card acceptance procedures .

Master card is even worse, though I don't have their manual handy right now. And while the majority of cards don't have pictures on them, and increasing number do.

Re:Misses the point

[Anonymous Coward]

I used to work in the credit card industry and still know a VP for one of the larger merchant processing facilities. I can assure you, they absolutely do want you checking ID. In fact, that is always explicitly stated in their merchant agreements.

That's interesting. Not that I doubt you, but many people here have linked to actual documents located on the websites of Visa/MC where it says merchants cannot require ID.

Who should I believe? Someone who says they used to work in the credit card industry, or the written documents of Visa/MC?

Re:Misses the point

[GooberToo]

Find something legally binding. Until then, you're wasting disk space. ;)

Re:Misses the point

[Anonymous Coward]

But I'm told that PayPal is rather onerous in its other dealings with merchants.

Yeah. I help run a small side business that uses PayPal to sell an online subscription related to gaming. Our volume doesn't currently justify setting up the necessary accounts for us to accept credit cards directly. And basically, PayPal just passes on the chargeback fees to us. We count on them to collect the necessary information to say that the credit card is valid, but clearly they don't give a shit. It doesn't cost them anything when someone uses a card fraudulently, since they pass the fee onto us.

From what I've read in this discussion, it sounds like our position would be the same even if we accepted cards directly. Bank authorizes the transaction, which signals to us that they think it's ok, but then charges us if the customer disputes it. Bah. If every detail given by the customer is not exactly right, that transaction should not be authorized by the bank, period.

Our situation is particularly frustrating, though, because the majority of our chargebacks could be completely avoided. Our subscription appeals to teens, and it seems that just about every chargeback we've ever gotten was some kid using Mom or Dad's credit card without permission. Instead of contacting us for a full refund (which we're very happy to provide in this case), Mom or Dad simply disputes it with the CC company, and we get fucked.

I really think that the next move is up to the merchants to pick a system and stop accepting no-card-present transactions entirely.

Huh, what?? Doesn't this pretty much get rid of any online transactions? No, thank you!

Re:Misses the point

[GooberToo]

As usual you're an idiot. Learn to read. Once you've done that, reread what he posted. After that, place it in context! I know context is difficult for you so I'll walk you through it.

That is from Visa and is ONLY a recommendation. It is NOT a mandate. Read it! It's obvious. Secondly, I never said Visa wants you to check it! Not once! But since we know you can't read and have the IQ of a nat, I'll excuse you once again.

Visa is the clearing house. They sponcer banks to be a card issuer. They say, please don't check ID because we think this improves the customer experience and we have little liability. Notice this is NOT a requirement!
A bank is the card issuer, having been sponsored by Visa, etc. They are the ones that have the bulk of the liability. They WANT you to check ID and it is in MOST merchant agreements between the ISO (sales, merchant support groups) and the merchant processors (the network which delivers the transactions from the merchant to Visa and then to the issuer for ACH). Here, I say MOST because if you are large enough you will be able to write part of the merchant agreement and then all bets are off for what is actually contained within. Having said that, ultimately, the discount rate is going to reflect the reality on the ground.

Ultimately, this all means, exactly on queue, like all of your posts, you always waste disk space.

Credit cards?

[Anonymous Coward]

How do credit cards work?

Re:Credit cards?

[Brad Eleven]

That is so *cuuuuute*!!!

http://www.howstuffworks.com/framed.htm?parent=cre dit.htm%25sdtaesf%25asd45fghaht%25arhar45gdfhst%25 jsyjshs537hgshtagfases457hadfvdavtahgds754ag8asgea 547gse452agseag534575eagase34534ghtsjyjkuhrad43345 gasathhathsj%25yugkgud%25shgshs%25hbbggfhajjtjytsw g%25fhgsjhgsjyssgfhghtafdgsgfhjsgadgragadgfdgfahgn bvnghdjyafagada%20fwf&url=http://www.anti-slash.or g

The anti-Slashdot Jihad, I mean. What will you twinks think of next??

And I was expecting the goatse "hello" JPeG, or at least the Hands Of God lookalike.

Business partners

[HomelessInLaJolla]

Credit card companies are branches of banks (who else has money to lend?). They are affiliated, strongly, with insurance and investment companies. Just as any other large corporation when one division suffers a loss then, in nothing more than the ledger book, the losses are distributed amongst the other divisions.

Think about that next time the interest rates on home mortgages goes up, or the premium on the insurance plans, or when the quality of service for medical insurance goes down, or when the price of motor fuel goes up...

These things happen because the businesses are recouping losses. Why are credit card rates so high?

Re:Business partners

[Ctrl-Z]

Why are credit card rates so high? Because that's what the market will bear? Credit card companies aren't having any difficulty finding people to lend money to at exorbitant rates.

Re:Business partners

[Rakishi]

Why are credit card rates so high?

Interest rates? Likely there are a lot of cc debts which are simply never paid off. Furthermore its not like anyone has to pay interest rates, its not that hard to realize that CC are not free money and that the balance should be paid off each month. There are some exceptions to that (school, emergencies, etc.) but I doubt most CC interest charges are from them.

Re:Business partners

[Anonymous Coward]

Credit card companies are branches of banks (who else has money to lend?).

Depends what you mean by "credit card company". Mastercard & Visa are not banks, they just rent out their name to banks. It's the bank that issues the cards. Mastercard & Visa set some standards in their contracts with the the banks.

On the other hand, American Express is not a bank. They issue their own cards themselves.

Why are credit card rates so high?

They are high because they can be. Credit card rates are (generally) unregulated and determined by the free market. Many people with high credit card rates don't realize that there are many, many other credit options available to them.

Either get a credit card with a low interest rate, or get a line of credit and pay your credit card in full every month from your line of credit. Generally, lines of credit have lower rates than credit cards.

Re:Business partners

[rainman_bc]

the losses are distributed amongst the other divisions.

Think about that next time the interest rates on home mortgages goes up

That's just ignorant on your part. Interest rates on mortgages are tied to the bond market. Any move in the yield curve will present itself in the mortgage market.

Now mortgage brokers have made lenders so competitive that the spread between bond rates and mortgages should be nominal at best. Mortgage lenders profit by issuing bonds ( borrowing money ) and issuing bonds ( lending boney ). The spread is their profit, and it's pretty slim.

And who holds bonds? You do. In your pension fund, or your 401(k), etc. Anyone can buy them. Heck, you can buy your own mortgage even if you want to, although the rate of return is so nominal that it's not really worth it right now - you can better invest your money elsewhere.

Re:Business partners

[king-manic]

or they are gouging. Ther eis no garentee they are simply charging a fair price. It may nto be collusion but they compete wiht each other and many industries no longer compete on price. They compete only on marketting.

Re:Business partners

[Kalriath]

Credit card companies are branches of banks (who else has money to lend?).

Depends what you mean by "credit card company". Mastercard & Visa are not banks, they just rent out their name to banks. It's the bank that issues the cards. Mastercard & Visa set some standards in their contracts with the the banks.
Not entirely true. Visa is in fact a conglomerate of 11,000ish banks, founded by Bank of America.

Re:Business partners

[HomelessInLaJolla]

> Interest rates on mortgages are tied to the bond market

Would you dare to use the word "only"? Of course not.

> That's just ignorant on your part

Don't be naive.

> who holds bonds...Anyone can buy them

Would you like to point out who holds more bonds?

> you can buy your own mortgage even if you want to

Who still holds the title for the land (in the event of a complete default of will)?

PCI?

[AikonMGB]

And here I thought they implemented PCI to make it easier to attach peripherals to your computer O_o I can't keep up with the world today.

Nothing as secure as nothing at all

[BronsCon]

Face it, you can have your credit/debit card information stolen by direct sight, security camera recording, straight through the network, by some guy getting lucky and guessing, by a social engineering attack and, i'm sure, by means I can't think of at the moment.

Hell, you aren't safe with cash, either; you could be mugged, oh and now they have your credit and debit cards, drivers license, and if you're completely stupid (or on your way from somewhere where you need it), your social security card.

Keeping it in the bank isn't safe, either. ATMs are prone to the same network attacks as credit/debit terminals; not to mention, that off-branded ATM may be logging your card number and PIN for the purpose of duplicating your card and using it to drain your account.

The most secure person I know lives behind a dumpster in the alleyway a few blocks down from where I work. He has no money, in any form, to steal. He has no belongings, save the clothes he is wearing. You know what, he's happy.

Re:Nothing as secure as nothing at all

[Skye16]

Until a bunch of middle class suburban teenagers show up with a few baseball bats and beat him to death.

I guess that's a small price to pay for being safe from fraud, though.

Re:Nothing as secure as nothing at all

[BronsCon]

It's just as likely they'll do the same to you the moment oyu set foot outside the confines of your home; then again, they could break in and do it, as well. At any rate, he's always smiling and upbeat.

Yeah this makes a lot of nonsense

[RaigetheFury]

So what about all the stolen credit card information. You actually think people who steal information from a grocery store are going to spend it on groceries! "Yeaaaah boy... them hams weren't on sale..". Please just take a look at the credit card ads that go around with people voice synching the people who stole their information. The merchants have NO IDEA and NO METHOD PROVIDED BY THE CREDIT CARD COMPANIES to identify someone beyond the basics. Sure the above ad talks about people scanning the information passed along a network but still. They are going to take that information and use it with another merchant who had NO PART in the original theft. It's punishing the wrong people. There is no 100% secure method in existence. Fraud should be laid on those who make a profit off using credit cards. That's definitely not the merchants as they are already being robbed by the credit card companies. Up to 8% of a total sale goes to them. Seriously... who's the thief. Merchants don't have the power, money, or infrastructure to track down these thieves. The Credit Card companies do. Oh wait we should leave this up to the police. Yeaaaa... I'm an application developer and I've worked with credit applications. While the merchant obviously needs to bare the responsibility of making their networks as secure as possible the ultimate responsibility should NOT lie with them. It should lie with the credit card companies for making it so easy to steal this information. The new scanable credit cards are the WORST. You just have to walk near someone with one and walla you have all their information you need unless it requires the 3-4 digit number on the back. Even then the method used to steal these credit cards would still work. If you put the burden on those that loan the money it makes it makes them develop more secure practices. The merchant can't tell the credit card company how to make their cards or their security.

Re:Yeah this makes a lot of nonsense

[operagost]

You just have to walk near someone with one and walla

Please... French is only my second language and I'm thoroughly pissed at seeing this garbage. It's "voilà".

Re:Yeah this makes a lot of nonsense

[Billism]

My thoughts EXACTLY.

Re:Yeah this makes a lot of nonsense

[Stanistani]

C'est la vie, c'est la guerre, c'est la pommes de terre -"V'wallah!"

Re:Yeah this makes a lot of nonsense

[Moofie]

Le singe est sur la branch.

Re:Yeah this makes a lot of nonsense

[Stanistani]

Only if you feed them.

Article is Wrong

[scribblej]

Merchants have been responsible, not VISA, all along. It's ALWAYS been that way.

I say that as someone who's been int he industry for ten years, so I'll admit maybe things were vastly different before I got here. But for at LEAST the last decade, merchants have eaten fraudulent charges.

Here's how it works in a nutshell. I'll assume an internet ("e-commerce") transaction since it's what i'm most familiar with.

1) Evil bad guy steals a credit card number.
2) Evil bad guy makes a charge from Bob the Merchant
3) Bob the Merchant ships Evil Bad Guy his product.
4) Joe, the actual owner of the credit card sees the charge on his statement.
5) Joe calls Bob the Merchant and says, "Why did you charge me?"

At this point, the only thing Bob the Merchant can do is issue a refund to Joe. He'll never see his product that Evil Bad Guy took, or the money, ever again. What happens is he refuses to give Joe his money?

6) Joe calls his issuing bank and asks for a chargeback.
7) Bob the Merchant is forced by his merchant account provider to refund the money to Joe. Also, to pay a chargeback fee of somewhere around $50, and if he gets more than 1% of his charges returned as chargebacks, VISA refuses to ever let him do business with a domestic bank again.

So who loses here? Not VISA. Not Joe, the cardholder. Not Joe's issuing bank. The merchant, is out product and money, and there's jack-all he can do about it.

There is only one exception I am aware of: Verified by Visa. If a merchant uses VBV on his website, then VISA will guarantee the charges, and if there is a chargeback, VISA will eat the cost. This is a HUGE change from how things have always worked in the past. However, no one uses VBV because it requires the CARDHOLDER to take extra steps to sign up and become active, but the CARDHOLDER has no reason to care, since he's already protected.

Anyhow. Long before PCI, long before CISP, long before any of the security standards were standards, the merchants were already responsible for all fradulent charges. It's the way things are. PCI makes a much cleaner audit trail when things go south, but it's not really about fraud nearly as much as it's about data security. There's a few tiny parts of PCI that address a few particular cases of fraud, and ALL the rest of it is about data security and handlling policies.

Re:Article is Wrong

[Rakishi]

no one uses VBV

Newegg does and signing up is rather trivial actually, the bitch is remembering the password (assuming I'm thinking of the right system). It takes me a lot longer to add an alternative (shipping) address to the CC and many websites require that (including some whose incompetence at being able to check it leaves me shocked).

Re:Article is Wrong

[scribblej]

Well, of course I was exaggerating when I said "no one." But it's interesting to hear your view. :) I didn't realize newegg provided it.

As for the "address" info - a very well-written system put in front of the credit card processing networks will do a real postal database lookup on an address. That's nice. It's also exceedingly rare. What you normally get for address verification is what the credit card processing networks themselves provide: AVS, the Address Verification Service.

A few interesting notes on AVS:

1) It only validates the digits in the street address and zip code, nothing else. So 123 Fake Street and 123 Oak Street are exactly the same in it's eyes.
2) It never rejects a transaction. Even if the address is wrong, it's approved. It's up to the merchant to check the response from the credit card processing network that says "the address was right" or "the address was wrong" or a dozen values of "the address was kinda' right" and then void the transaction if the response is unacceptable to them.

2 is becoming a little less true recently, though - several issuing banks have taken it on themselves to reject the transaction even if the AVS standard says they aren't supposed to. I think this is a good thing.

Re:Article is Wrong

[spydum]

Right on, I completely agree. PCI may seem like a gigantic pain in the ass, but if you really knew how many of these online e-commerce systems kept track of your personal information and credit card #'s, you'd be shocked. Unfortunately, even though the PCI policies are clear, and requirements are spelled out, not everyone follows them. The audits required are flimsy at best.

Re:Article is Wrong

[HomelessInLaJolla]

if he gets more than 1% of his charges returned as chargebacks, VISA refuses to ever let him do business with a domestic bank again Who offers a form of chargeback insurance to the merchants? The whole system is such a racket that someone must be working that angle.

Re:Article is Wrong

[ps_inkling]

I have seen more web sites that uses VBV. My credit card was "automatically and for my convenience" signed up for VBV by my issuing bank. More than once I've cancelled my order instead of dealing with the additional verification.

When I finally needed to buy from NewEgg, it took 3 or 4 tries to get through the VBV crap page (unblock popups, unblock cookies, allow JavaScript). Surprised it let me try that many times. I was not impressed with the security or functionality, from the consumer standpoint.

Re:Article is Wrong

[Not_Wiggins]

3) Bob the Merchant ships Evil Bad Guy his product.

Does Bob the Merchant have access to Joe's credit-card billing address?

I'm going to plead total ignorance here, but it would make sense that, with that information, Bob could ask Visa/MC if the billing address is the same as what's on file for the card. No, it doesn't eliminate all fraud, but it would certainly reduce it.

I think the point of making merchants liable was because they're the ones accepting the payment. That is the last line of defense against the criminal.

I have written on my credit card "Please ask for ID" instead of a signature. While technically not "allowed," I'm surprised at the number of places I've gone that haven't bothered to notice no signature and never bothered to ask me for my ID. Is that Visa/MC's fault, or lack of care at the merchant?

Last thing I want to say is this: the one common thread throughout these posts puts the real problem into perspective; it isn't about who's responsible, merchants or Visa/MC... we should be focused on STOPPING THE CRIMINALS THAT ABUSE EVERYONE. We all lose when someone steals through higher prices. Maybe instead of focusing on "how to make it easier for someone to spend money," it should be on "ensuring only authorized users are making purchases."

Re:Article is Wrong

[scribblej]

Does Bob the Merchant have access to Joe's credit-card billing address?

No - if he did, we'd have a nice way to verify things. See my other post on AVS: http://slashdot.org/comments.pl?sid=223350&cid=180 85442

The postal database lookup I mentioned would only verify that the input address exists, not that it belongs to Joe.

Bob could ask Visa/MC if the billing address is the same as what's on file for the card. No, it doesn't eliminate all fraud, but it would certainly reduce it.

You're right, and he can - my other post above makes the reasons why it doesn't work so well more clear. Most importantly, nothing but the digits get sent to the credit card processing network in the first place, so they can't verify the difference between 123 fake street and 123 oak street, EVEN IF THEY WANT TO. On top of that, if the address is wrong, VISA still approves the transaction - it's up to the merchant to check the response and void the transaction if it's not a response they are happy with.

Is that Visa/MC's fault, or lack of care at the merchant?

Oh, it's definitely the merchant's fault. I'm not saying that things should be otherwise; I think things work more or less the way they should in this case. I'm not objecting to the merchant being responsible; I'm just pointing out that they are, and always have been, and PCI doesn't change a thing.

Re:Article is Wrong

[Sigma 7]

3) Bob the Merchant ships Evil Bad Guy his product.

Does Bob the Merchant have access to Joe's credit-card billing address?

I've recently observed a new type of CC scam - where the Evil Bad Guy enters the credit-card billing address as the ship-to. After that, Evil Bad Guy calls the Joe on "behalf" of Bob the Merchant saying that he accidently shipped the product to him, and arranges a "return" where UPS comes by and picks up the product from Joe.

The return generally has a temporary address to the Evil Bad Guy - who tries to cut-and-run.

I have seen this tactic used suprisingly often against the company that I work for, almost as if there is or was an inside contact on how the system works. It doesn't always work, but some packages did manage to get stolen by this method.

Re:Article is Wrong

[Jah-Wren Ryel]

Newegg does [verified By Visa] and signing up is rather trivial actually, the bitch is remembering the password (assuming I'm thinking of the right system). It takes me a lot longer to add an alternative (shipping) address to the CC and many websites require that (including some whose incompetence at being able to check it leaves me shocked).

I use disposable/single-use/single-merchant credit card numbers linked to my Visa card. I've found that when I use one of those numbers at a VBV merchant, the system automagically gives it the VBV approval - at least that is what it tells me as I go through the check-out screens - without any special effort on my part beyond the 'normal' number generation process.

Re:Article is Wrong

[bastion_xx]

Well, of course I was exaggerating when I said "no one." But it's interesting to hear your view. :) I didn't realize newegg provided it.

As for the "address" info - a very well-written system put in front of the credit card processing networks will do a real postal database lookup on an address. That's nice. It's also exceedingly rare. What you normally get for address verification is what the credit card processing networks themselves provide: AVS, the Address Verification Service.

A few interesting notes on AVS:

1) It only validates the digits in the street address and zip code, nothing else. So 123 Fake Street and 123 Oak Street are exactly the same in it's eyes.
2) It never rejects a transaction. Even if the address is wrong, it's approved. It's up to the merchant to check the response from the credit card processing network that says "the address was right" or "the address was wrong" or a dozen values of "the address was kinda' right" and then void the transaction if the response is unacceptable to them. VbV and MC SecureCode also give additional discount rates. I think upwards of 25-50 basis points.

We setup a special authorization transaction type for AVS, basically AVS+Auth. AVS was tried first, and only if succeeded would we follow up with an authorization request. And since AVS only checks can be completed for a marginal amount (less than 2 cents), was our first line of fraud detection for the merchant. Ugh, I still remember the various ISO 8583 single character return codes for AVS.

I have to get out of financial services.....

Re:Article is Wrong

[Anonymous Coward]

"However, no one uses VBV because it requires the CARDHOLDER to take extra steps to sign up and become active, but the CARDHOLDER has no reason to care, since he's already protected."

So, create an incentive for the consumer. Offer a discount to those who use VBV. As long as this is cheaper than eating the cost of fraud in the long run, you win.

Re:Article is Wrong

[acvh]

Who offers a form of chargeback insurance to the merchants? The whole system is such a racket that someone must be working that angle.

These guys.

Re:Article is Wrong

[francisew]

I noticed that Discover cards seem to have an interesting protection feature as well- disposable electronically generated card numbers for individual transactions. Seems ideal to me.

http://www.discovercard.com/deskshop/

Francis

Re:Article is Wrong

[CthulhuDreamer]

A friend of mine had written "See ID" instead of a signature on the back of her card. At one store, she was required to sign the receipt as "See ID" before the clerk would accept it.

Mine are signed the same way. Most clerks look at it, shrug, and ring it through anyway.

Re:Article is Wrong

[scribblej]

Do you work for Bankcard?

A lot of companies offer chargeback insurance, and I wouldn't necessarily endorse one over another.

Re:Article is Wrong

[swillden]

It only validates the digits in the street address and zip code, nothing else. So 123 Fake Street and 123 Oak Street are exactly the same in it's eyes.

Interesting. So locales that use street numbers rather than street names have slightly more secure addresses from this perspective. For example, in Utah (and surrounding states -- wherever Mormons settled) street addresses are basically a cartesian coordinate plane, each location specified by a pair of numbers (with North/South and East/West used rather than positive/negative and x/y position).

The AVS system would discard the N/S and E/W designators, but even without those there are only four places in the city that a given pair of numbers could designate, and once you get away from the origin (city center) the zip code area would usually include one of the four.

I've always thought the system here was great, because given a starting point and a destination you always know how far you have to go and in which direction, even if you don't know the streets at all. Now there's another (very, very minor) reason to like it.

Re:Article is Wrong

[Not_Wiggins]

Actually, I've had a problem at the Post Office with the "Please Ask for ID" on the signature panel; they absolutely refuse to ring a credit card without a signature on it.

The first time I encountered it, I didn't have enough cash to send the letter (my bad). In order to comply, I took out a pen, signed my name over the "Please ask for ID" RIGHT IN FRONT OF THE POSTAL EMPLOYEE.
That employee had the nerve to then check my signature on the credit receipt against the one on the card, as if it could somehow be different and they'd not accept it (!). Now that is what I call security!

Still, I'm pleased about the number of places that actually do ask for my ID. It is heartening when they look at the card, the id, and me to verify that I'm actually the one authorized to make this purchase.

Re:Article is Wrong

[leenks]

With respect to Verified By Visa - most people haven't got a clue what it is. It isn't well marketed by Visa and banks using Visa cards, and I suspect most users suspect it to be some kind of scam.

But regardless, as you say there is little need for the consumer to bother with it. I've seen things about it from my bank, but I've always ignored it as it doesn't give me anything I don't have already.

Re:Article is Wrong

[SuperMog2002]

I tried Verified by Visa for a couple months. I finally got so sick of my transactions being denied because the stupid pin entry window never appeared that I just had my bank take it off.

Re:Article is Wrong

[Anonymous Coward]

Actually, I've had a problem at the Post Office with the "Please Ask for ID" on the signature panel; they absolutely refuse to ring a credit card without a signature on it.

The employee is doing exactly what Visa/MC and the Post Office tell them to do.

The first time I encountered it, I didn't have enough cash to send the letter (my bad). In order to comply, I took out a pen, signed my name over the "Please ask for ID" RIGHT IN FRONT OF THE POSTAL EMPLOYEE.
That employee had the nerve to then check my signature on the credit receipt against the one on the card, as if it could somehow be different and they'd not accept it (!).

The employee is doing exactly what they have been instructed to do.

Writing "ask for ID" on the back of the credit card does not require the merchant to ask you for ID.

It's a myth.

Re:Article is Wrong

[jrumney]

My understanding is that the merchant has always been responsible for "card not present" transactions, but for card present transactions the bank and/or credit card company took responsibility (and passed it on to the customer if they were slow reporting their card as stolen etc). So the only change is that POS retailers are now being held responsible, which is a good thing, because they never check signatures properly anyway.

Re:Article is Wrong

[Slashdot Parent]

Newegg does and signing up is rather trivial actually

Signup may be trivial, but I haven't bothered. It doesn't offer me, as a consumer, any protection I don't already have. It actually offers me worse protection:

Say somebody installs a keylogger on my computer and they capture my credit card details and verified by visa password. If I dispute a charge as fraudulent, Visa is going to come back to me and say, "Well, you entered your verified by visa password. How could it be fraud?" Seems like a more uphill battle if VBV was used.

That's retarded

[pavera]

One of the largest CC heists of all time happened last year when MASTERCARD lost I forget how many card numbers, it was > 1 million cards though.
The Merchants who processed transactions with those stolen cards have to eat it?! How can that be proper?!

Further, as noted elsewhere, this does not penalize the proper people. If I am a merchant and someone buys something from me with a stolen card (even though I have great security, maybe I don't even store CC information, I just process the card and I'm done with it) I eat the chargeback even though it was www.flybynight.com who's site got hacked to provide the thief with the stolen card. flybynight.com doesn't pay a dime for their lack of security.

Re:That's retarded

[NewWorldDan]

In your scenario it is entirely proper for the merchant to eat the loss. They are at the point of transaction and are the only one with the possibility to identify the consumer and verify that they are authorized for the account. There are otherwise just far too many avenues to obtain credit card information to otherwise be effective. I'll certainly admit that most merchants do not have adequate tools to identify and validate most customers, nor do most customers care to deal with that level of scrutiny, but security at any other level is doomed to fail.

As a merchant, I call shenanigans!

[silentbozo]

Uh bullshit. Let's say I'm merchant A, and I do everything by the book, and have never had a breach.

I can still get screwed if merchant B has a breach, as far back as a year ago, if I'm taking card not present transactions, and get stuck with an order from some punk who uses a stolen number.

Is it right that I get penalized for charges made and authorized by the issuing credit card company, due to no fault of my own?

A lot of people will say that's the cost of doing business. The problem is, that there is no incentive to fix anything broken with the system as far as protecting MERCHANTS from fraudulent transactions. Fact of the matter, there's no incentive to fix all the things broken with the system that make identity theft possible, since the people who would be most motivated to fix those things (credit card bureaus and the issuing companies) have moved all the cost to the merchants and merchant banks, and the have no control over the bureaus!

Should improve Customer service

[Iridium_Hack]

As one who has worked part-time in a retail store for extra cash on top of my day job, I've found most customers now days prefer that you ask for ID. Up until now, store policy has been lax or even negative on the subject. For example, "if it's less than a hundred dollars or so (depends on season), don't bother the customer and ask ID unless it's AE or the card isn't signed."

Maybe some of these retail stores will finally make it policy to ask for ID when making a purchase. Wouldn't you like it that way?

Re:Should improve Customer service

[damiangerous]

Maybe some of these retail stores will finally make it policy to ask for ID when making a purchase. Wouldn't you like it that way?

No, I hate being asked for ID when using my card. In fact, Visa and MC rules prohibit merchants from requiring you to show ID to accept a card. I go They can ask, but can't require it. They also cannot accept a card with "See ID" without making the cardholder sign it. See page 29 of the Visa merchant rules (PDF) and pg 48 of the MasterCard merchant rules (PDF).

I usually file a complaint here and check the "merchant required identification" box.

Re:Should improve Customer service

[Anonymous Coward]

I've found most customers now days prefer that you ask for ID. Up until now, store policy has been lax or even negative on the subject. For example, "if it's less than a hundred dollars or so (depends on season), don't bother the customer and ask ID unless it's AE or the card isn't signed."

Maybe some of these retail stores will finally make it policy to ask for ID when making a purchase. Wouldn't you like it that way?

No, I wouldn't. I don't want to give my ID to a clerk or store - tbey now have my credit card info AND my driver's license info, making it MUCH easier to commit identity theft.

As a consumer, the credit card status quo is good for me - I don't pay for fraudulent transactions, period. Whether the bank pays, the merchant pays, or the payment processor pays doesn't matter to me.

More importantly, in a free country, you don't have to show ID to buy bread.

Re:Should improve Customer service

[ucblockhead]

Great. You hate it when merchants take extra steps to make sure it's actually you using the card. It's people like you that discourage merchants (and visa/mastercard) from adding extra security that would help ensure that thieves can't swipe cards and go to town.

Re:Should improve Customer service

[raoul666]

At the same time, if the cashier doesn't feel your signature matches, he/she can simply reject the sale entirely. My standard procedure was to check if the signature matched, and if it didn't (or if the sale felt fishy), I would simply say, "these signatures don't match. I'm afraid I can't sell this to you." Most people, at this point, will offer photo ID willingly.

Re:Should improve Customer service

[ACMENEWSLLC]

>>No, I hate being asked for ID when using my card. In fact, Visa and MC rules prohibit merchants from requiring you to show ID to accept a card. I go They can ask, but can't require it. They also cannot accept a card with "See ID" without making the cardholder sign it. See page 29 of the Visa merchant rules (PDF) [visa.com] and pg 48 of the MasterCard merchant rules (PDF) [mastercard.com].

>>I usually file a complaint here [mastercard.com] and check the "merchant required identification" box.

All I can say is WOW. I wouldn't have believed you if you didn't supply supporting documentation.

None of my credit cards are signed. A few say See ID. A merchant suggested that to me.

You know, I've only been asked by one business to sign it. That was Spencer's Gifts. No one else ever. Best Buy and Lowes always asks for my ID, 100% of the time. Other than that it's a crap shoot. Some of the people look at the back, don't see signature, and ask to see ID. Many others fake looking at the signature.

That being said, our merchant account had fraud protection up to a certain dollar amount. We pay a little bit more on the front end, so it's like insurance.

We've had shipments redirected back to us in transit several times when fraud was detected. We eat the cost of shipping and handling, but not the merchandise. Typically it's electronics goods such as DVDs and DVD players.

Re:Should improve Customer service

[damiangerous]

Great. You hate it when merchants take extra steps to make sure it's actually you using the card.

Nope. They should feel free to take any steps they like that don't involve harrassing me and violating their agreement with MasterCard that I, as a MasterCard cardholder, should be able to rely on them to follow. If they feel like they can break their agreements at will because they think they know better, how should that make me trust them and provide even more information?

It's people like you that discourage merchants (and visa/mastercard) from adding extra security that would help ensure that thieves can't swipe cards and go to town.

If I'm discouraging merchants from harrassing me for ID to buy some milk and bread, then good. I would suggest purely PIN based transactions and everyone would be happy.

Re:Should improve Customer service

[damiangerous]

At the same time, if the cashier doesn't feel your signature matches, he/she can simply reject the sale entirely.

No, you cannot. If you have suspicions about a transaction you need to make a Code 10 call. Rejecting the card outright is also a violation (and there's a spot on that same complaint for for that as well). If you reject a card without calling, you've done one of two things: you've allowed someone to make a second fraudulent attempt to use that card or you've turned away a paying customer.

Re:Should improve Customer service

[Anonymous Coward]

Man, you're such a dick. Why so anal about presenting ID to confirm identity when purchasing something? You're already carrying around one piece of fucking plastic. Why not carry around another? There's no privacy issue, because your credit card already identifies you quite easily. There's no security issue, because the cashier is only viewing your card briefly and never making a copy of it.

In fact, I can't think of a single legitimate reason to be against it other than being an obnoxious pain in the ass.

Re:Should improve Customer service

[dman123]

If I was a milk and bread merchant and you mentioned to me that I was "harassing" you by asking for ID, I'd just make sure to process that transaction really, really, slow... maybe manually enter the numbers instead of swiping, checking the card with a magnifying glass to check for evidence of tampering, etc. The loss of a sale as you stormed off in a pissy huff would be worth it.

And yes, I would keep helping others in line as I "waited for authorization." Sorry, sir. The computers are a little slow right now. Maybe I'll try calling in for authorization. I'm sure that MasterCard won't put me on hold once they know that we have royalty in line here at the bodega.

Re:Should improve Customer service

[RoTNCoRE]

If you buy milk and bread on credit, you may have bigger issues.

Re:Should improve Customer service

[damiangerous]

If that was your attitude I'd probably have a talk with your manager. If you were the owner, I'd be happy knowing you'd probably not be in business long. it's hard enough for small businesses, arbitrarily pissing off customers about an issue you're in the wrong about pretty much seals your fate.

Either way I wouldn't have to worry about the situation because I wouldn't shop there again unless I felt assured it wouldn't happen again. I know I certainly wouldn't be the loser in that situation.

Re:Should improve Customer service

[Iridium_Hack]

I know what you mean - Visa and Mastercard do have policies in place that discourage merchants from requiring photo ID if the Card is signed. Generally, I phrase it like this, "May I check your ID for you?" I don't make it a requirement. In most cases, the customer has been happy to show it. If they don't, I can always view their signature.

To some degree, one has to consider that there are also customer security policies. When one sees, "See Photo ID" or "Photo ID Required", to me that's a customer policy. And even though they may be ignoring their card agreement, the credit card company will not be dropping them. They still make money off of their purchases! Do I violiate anything by asking them, "May I check your ID for You?"? They can refuse. And some who have had their identity stolen before (and told me their story) have been very happy to have someone finally ask.

But like you suggest in your reply, there is a balance in how you do this thing.

Re:Should improve Customer service

[damiangerous]

Indeed. Good thing I'm talking about a MasterCard branded debit card then.

Re:Should improve Customer service

[damiangerous]

I should probably clarify that I've never actually refused to show ID yet. I'm not the sort of person who makes a scene and inconveniences others. I tell them briefly that it's not allowed by the MasterCard agreement and if they insist or don't care I go ahead and let them know I'm going to file a complaint with MasterCard. I then decide if I want to continue shopping there, based on how they handle the situation.

If the staff are pricks about it, like you seem to be, then I certainly wouldn't. If it's just some kid who doesn't know better and is just doing what they're told by management then I'll try again or afterwards talk to someone in authority.

Re:Should improve Customer service

[ednopantz]

it's hard enough for small businesses, arbitrarily pissing off customers
As a small business owner, let me say,

Get the hell out of my store!

I don't need customers like you.

Things got a lot better around here once we started "firing" customers who were assholes. More trouble than they are worth.

Re:Should improve Customer service

[Anonymous Coward]

I'd just make sure to process that transaction really, really, slow... maybe manually enter the numbers instead of swiping

If you did that, it's called a card-not-present transaction. The merchant often pays more for a CNP transaction, and often pays a bigger penalty for fraudulent CNP transactions.

Swiping a card or taking an imprint of it is the only way the merchant can prove they had the card during the transaction.

Re:Should improve Customer service

[damiangerous]

I love that a customer who simply asks, asks mind you, that you keep your word and stick to a contract you agreed to, is suddenly an "asshole".

Re:Should improve Customer service

[ednopantz]

Waaah! I'm being oppressed! You can't ask for ID! Waah! = PITA/not worth dealing with/some asshole we can do without.

Re:Should improve Customer service

[damiangerous]

My credit card doesn't identify where I live, for one thing. Now that's not the most closely guarded secret in the world, obviously, but I don't care to share it with the kid who's ringing up the laptop I'm buying, for example. It's just personal information I don't care to share at the whim of anyone who might ask and have no reason to.

I'll show ID to anyone who has a reasonably good reason to see it. Store clerks simply do not. That's just one of the reasons I use a debit card instead of writing a check, far less exchange of personal information. Most importantly though, I just shouldn't have to. I like that they can't ask me, it's a selling point of the debit card. Why should a merchant be allowed to remove a feature that I enjoy without the authorization to do so. If someone randomly denied you something you expected and were owed, you'd be irritated too.

Re:Should improve Customer service

[damiangerous]

What's the name of your business, so I know to avoid shopping there and saving us both the hassle?

Re:Should improve Customer service

[qwijibo]

I do it all the time. I get cash kickbacks from the cards I use, so I'd be crazy not to use a credit card instead of cash.

Re:Should improve Customer service

[DogDude]

I usually file a complaint here and check the "merchant required identification" box.

As a merchant, we wouldn't accept your card, and politely suggest that you pay in cash. We do that to protect ourselves (as you can read about in this thread many times over). If you can't show ID when in person, then we don't want to do business with you.

Re:Should improve Customer service

[DogDude]

You're 100% wrong. I AM a small merchant, and I haven't had to deal with asshats like you before (we deal with jerks... just not in this way). I would be happy to ask you not to come back to the store if you threw a tizzy about us asking for your ID. It's not worth the risk to us to keep assholes happy.

Re:Should improve Customer service

[ednopantz]

What, and miss out on the educational aspect of firing a customer?

*******

"Waaah! I want [totally unreasonable thing]."

Sorry.

"Waaah! If you don't give in, I'll take my valuable [read easily replaced] business elsewhere."

Good, go.

"Waaah! I want to speak to the manager."

I'm the owner.

"Waaah! But I'm the customer, and the customer is always right."

No. The customer is often wrong. And you are not our customer anymore. Go away.

"Wah! But...but...but..."

Get out now!

*******

I wouldn't feel right depriving you of the valuable attitude adjustment. Just think of it as my form of public service.

Re:Should improve Customer service

[damiangerous]

So..you're saying that you won't give something as harmless as your business name out whenever anyone asks you? Shocking to learn. Just shocking.

Re:Should improve Customer service

[Anonymous Coward]

Quite simply you're in the wrong here - reread what the person said and then your response:

Maybe some of these retail stores will finally make it policy to ask for ID when making a purchase. Wouldn't you like it that way?

ASK, not demand, ASK. which you say that they can do. And actually, per your document, they MUST do.

From page 68-69 of the mastercard document YOU LINK (and have obviously not even leafed through), under the section on Determining whether a card is valid under acceptance procedures (page 68 says that merchants MUST do these things):

"For unique transactions processed in a face-to-face environment (with the
exception of truck stop transactions and card-read transactions where a
non-signature CVM is used), request personal identification of the
cardholder in the form of an unexpired, official government document.
Compare the signature on the personal identification with the signature on
the card."

So while you can refuse to show this ID and be in the right, the merchant was supposed to ask you for that very identification (which you acknowledge and then report them for "requiring" identification, which they didn't in GP's example.

So do you only file complaints with those merchants that actually refused doing business with you because you didn't want to show ID? I would assume not because in a later post you mention that you always show ID when asked. Based on this, I'll guess that you're trying to burn merchants for some reason who are following the policies that you want them to follow so badly.

Re:Should improve Customer service

[damiangerous]

Both of those things are a violation of your agreement, you can't require ID and you can't arbitrarily refuse my card. Why is it so hard to live up to what you've agreed to? If you thought the risk of not being able to require ID was an unacceptably high one, you shouldn't have agreed to it. That's the big sticking point here. You agreed to not require ID. You agreed to this of your own free will because the benefit of accepting credit cards was worth it to you. If you didn't intend to live up to that, why did you agree to it? I have to assume you're not a habitual liar who regularly breaks contracts. But if I witness you blatantly violating a contract, why would I want to do business with you? Even if I didn't care about this particular issue that much and I were simply reading this thread you're basically declaring to the world that you'll pick and choose the agreements you'll live up to.

I'll never cease to be amazed at the sense of entitlement people have shown here. I'm not the one asking for special treatment. All I'm asking for is that people live up to their agreements and suddenly I'm the bad guy. Amazing.

Re:Should improve Customer service

[The Outbreak Monkey]

Here is what I think you are missing:
If he gets a charge back, HE has to eat the cost. He asks you to show your ID so that he can verifiy that the transaction probably isn't fradulent.

So what if Mastercard stays it isn't OK...give the guy a break and give him a little reassurance. It's no skin off your back, and it helps him out. Is your time really so important that you can't flash your ID for 2 seconds?

(I think) He called you an asshole because you'd rather point out page numbers of credit card contracts and argue with him, instead of cutting him a little slack by taking 2 seconds to prove that you own the card.

I mean really, what is the big deal?

Who cares what Mastercard says about showing your ID...we are talking about customers putting food on the merchant's table, and we are talking about theives trying to take it off the table. Give him a break and help him figure out if you are a customer or a thief.

That's how us non-assholes think.

Peace.

Re:Should improve Customer service

[Anonymous Coward]

You forgot the next line. "If you don't leave now I will have you escorted out of my store for trespassing."

Re:Should improve Customer service

[DogDude]

We can refuse service to ANYBODY for ANY REASON unless it's based on racial/religious stuff. No card member agreement trumps that. I've refused service to people just for being assholes (and I will continue to do so). That's completely and totally in my rights as a merchant. If somebody refuses to show ID with their credit card, I will ask them to pay cash or personally escort them out of my store and call the police because I will suspect that they are using a stolen card. I've never had that happen, but that is what I will do if it ever does happen.

And no, I haven't read the 150 page, single spaced 8 point font agreement that my merchant banks have sent me. And no, I haven't paid an attorney many thousands of dollars to do so for me. There's law, and then there's reality. The reality is that Visa/MC isn't going to cut off a merchant for asking to see ID. The reality is that eventually, you won't be able to buy anything in your area with your credit card because you're being a jerk and you're abusing the store and the employees.

Re:Should improve Customer service

[damiangerous]

They can ask for ID, but they cannot require it. Your excerpt from pg 68 is under the following text: "The following sections contain acceptance procedures excerpted in previous editions from the Bylaws and Rules manual; however, effective with the October 2002 edition of the guide, these acceptance procedures were removed from the Bylaws and Rules manual and may be found only here."

I take that to mean that they are obsolete and left in as a sort of version control. It doesn't matter though, like I said, I let it go if they only ask and drop it. It's clear that they cannot require it.

The relevant rule for requiring identification is on pg 48, section 9.11.2:

"A merchant must not refuse to complete a MasterCard card transaction solely because a cardholder who has complied with the conditions for presentment of a card at the POI refuses to provide additional identification information, except as specifically permitted or required by the Standards. A merchant may require additional identification from the cardholder if the information is required to complete the transaction, such as for shipping purposes."

Regardless of whether or not they're required to ask, they're clearly not allowed to actually require ID. I don't care if they do ask as long as they let it go when I refuse.

So do you only file complaints with those merchants that actually refused doing business with you because you didn't want to show ID? I would assume not because in a later post you mention that you always show ID when asked.

I file about merchants would would refuse if I did not show ID, not simply ones who ask and let it go.

Re:Should improve Customer service

[damiangerous]

We can refuse service to ANYBODY for ANY REASON unless it's based on racial/religious stuff. No card member agreement trumps that.

Legally? No, of course not. You're not breaking any laws. A card member agreement doesn't make something a crime. But you can sign away your rights to do a lot of things in a contract in exchange for the benefit of accepting cards and that's what you chose to do. You're agreeing not to turn away MasterCard customers specifically for trying to use their MC in a way you may not like at the price of possibly losing your ability to accept cards.

And no, I haven't read the 150 page, single spaced 8 point font agreement that my merchant banks have sent me

I would suggest you do, especially as a business owner with a lot to lose. It certainly seems cavalier not to. It's not hard even, I read all the fine print and Privacy Notices and countless little pamphlets I'm sent by banks and investments, etc. I can't generally change onerous terms and conditions, but at least I know what I'm getting into and what written word I can fall back on if I need to.

The reality is that Visa/MC isn't going to cut off a merchant for asking to see ID.

I'm not so sure about that. There are only four possible check boxes on the complaint form, in addition to the freeform complaint field. I find it hard to believe that if they didn't care they would break it out so clearly. There are a million things you can do in violation of your agreement that don't have specific ways to be complained about. While I doubt my one complaint does anything alone, I'm sure multiple complaints will at least draw attention to the merchant and start the wheels moving.

The reality is that eventually, you won't be able to buy anything in your area with your credit card because you're being a jerk and you're abusing the store and the employees.

No, the reality is that I've only found one store that has been a repeat offender and it's the Salvation Army of all places. No one else has ever been a problem.

It's interesting that you've built this scenario of me being a jerk and "abusing employees", especially when I've explained multiple times in this thread that I explain it quickly and don't like to make a scene or inconvenience. I guess it's just easier to villify others.

Re:Should improve Customer service

[Penguinisto]

Err, point of order: Debit card transactions pretty much always require a PIN to be entered by the customer, thus no real need to see an ID card.

/P

Re:Should improve Customer service

[Anonymous Coward]

We can refuse service to ANYBODY for ANY REASON unless it's based on racial/religious stuff. No card member agreement trumps that.

Why yes, it does trump that. Read your contract. You can not refuse to take a credit card because the cardholder does not have ID. If you don't like that condition, maybe your business shouldn't accept credit cards.

I've refused service to people just for being assholes (and I will continue to do so). That's completely and totally in my rights as a merchant.

You certainly can refuse service to assholes with credit cards.

If somebody refuses to show ID with their credit card,

Politely declining to show ID does not make someone an asshole. Neither does politely expecting a business to live up to their signed contract. Yelling & screaming while refusing to show ID might make someone an asshole though.

And no, I haven't read the 150 page, single spaced 8 point font agreement that my merchant banks have sent me. And no, I haven't paid an attorney many thousands of dollars to do so for me. There's law, and then there's reality.

The reality is that a business should read the contracts that they sign. Judges are much less sympathetic to a business that doesn't understand a contract they signed than a consumer.

The reality is that Visa/MC isn't going to cut off a merchant for asking to see ID.

I'm sure Visa/MC isn't going to cut you off anytime soon. But they will pass along complaints, ding you in other ways, and with a sufficiently large number of complaints, they will cut you off.

The reality is that eventually, you won't be able to buy anything in your area with your credit card because you're being a jerk and you're abusing the store and the employees.

I doubt it. I've had a credit card of some sort for over 15 years. I have never been asked for ID for a credit card transaction in any country I've visited (USA, Canada, Australia, France, Italy, Greece, Portugal, Netherlands) unless I was buying booze.

Re:Should improve Customer service

[DogDude]

Legally? No, of course not. You're not breaking any laws. A card member agreement doesn't make something a crime. But you can sign away your rights to do a lot of things in a contract in exchange for the benefit of accepting cards and that's what you chose to do. You're agreeing not to turn away MasterCard customers specifically for trying to use their MC in a way you may not like at the price of possibly losing your ability to accept cards.

That would be just fine. We check ID's to prevent chargebacks. If MC gets upset at us for checking ID's to prevent chargebacks which we're liable for, then I wouldn't want to accept MC in the first place. I have to imagine that most merchants feel the same.

I would suggest you do, especially as a business owner with a lot to lose. It certainly seems cavalier not to. It's not hard even, I read all the fine print and Privacy Notices and countless little pamphlets I'm sent by banks and investments, etc. I can't generally change onerous terms and conditions, but at least I know what I'm getting into and what written word I can fall back on if I need to.

You're spinning your wheels. You can read whatever you'd like, and they can print whatever they'd like, but none of it holds any water if it's not legal in the first place. The reality is that the life of a small merchant is so hectic, that there's really no point in reading literally hundreds of pages of legal-speak, especially if you have no idea how valid it is. I'd bet a lot of money that most small businesses are in the same boat.

It's interesting that you've built this scenario of me being a jerk and "abusing employees", especially when I've explained multiple times in this thread that I explain it quickly and don't like to make a scene or inconvenience. I guess it's just easier to villify others.

No. We do it to protect us AND the cardholders. Somebody nitpicking based on some tiny legal-ese for no particular reason other than to be an annoyance is well... an annoyance, and in all likelihood, also going to be a PITA about many other things (ie: this dog collar says it goes to 12 inches, and I measured, and it only goes to 11 7/8"). Customers like that are generally not worth doing business with, and we give them directions to our competition and suggest that they shop there. Big box stores don't care... you're just another number, and the poor clerks have no idea what's going on, anyway. But, I *do* care, and I would take that as abuse towards my employees, which I don't allow.

Re:Should improve Customer service

[Kalriath]

Not entirely true. It is a security risk in that with both the credit card, and the address printed on most photo ID, you then have enough details for Online transactions. You do not with the card alone, as online merchants for the most part require a correct address (ironically for THEIR own protection)

Re:Should improve Customer service

[damiangerous]

No, it's entirely optional. They can be used both ways, that's the point. Smaller merchants often don't even have the capability to do PIN transactions (although it's becoming more common).

Re:Should improve Customer service

[WrongDecision]

Also, the parent poster didn't mention that those MC/VISA Merchant Manuals mention that there are fines up to $50,000 if the merchant refuses to complete a transaction for invalid reasons. I've mentioned that to a few merchants who suddenly didn't need to see my ID. I always refuse to show ID. Usually, the manager is consulted and the clerk is told to complete the transaction. One shoe store refused and was fined a substantial amount, they won't tell me how much. Just carry a binder with the Merchant Manuals with the relevant passages highlighted; they always come around when reminded of THEIR contractual obligations.

Re:Should improve Customer service

[WrongDecision]

Point of order. Most merchants around here (California) don't require a PIN or a signature for small amounts. I've been told that the current limit is $50.00 with either credit or debit cards.

Re:Should improve Customer service

[WrongDecision]

WOW! Where's your store? I know how to get fucks like you fined up to $50,000 for refusing to complete a transaction. And, you do have a contractual obligation to accept my VISA/MC if you are displaying the logo. Stores around here who got "The Letter" know it was because of a complaint that I filed, and ALL of them still do business with me -- just no ID required.

Re:Should improve Customer service

[DogDude]

WOW! Where's your store? I know how to get fucks like you fined up to $50,000 for refusing to complete a transaction. And, you do have a contractual obligation to accept my VISA/MC if you are displaying the logo. Stores around here who got "The Letter" know it was because of a complaint that I filed, and ALL of them still do business with me -- just no ID required.

Actually, I'd just trespass you from the store. End of story.

Re:Should improve Customer service

[jabberw0k]

"Waaah! I want [totally unreasonable thing]."

Asking you to abide by terms of a contract you signed, is an unreasonable thing?

In any case, since when are we required to even possess, much less carry, much less produce on demand, photo identification?

If you are driving, a policeman may ask for your driver's license. That is the only thing a driver's license is meant for. If you are not driving, you don't need a driver's license -- obviously, I would think.

Re:Should improve Customer service

[jabberw0k]

"If you don't leave now I will have you escorted out of my store for trespassing."

"Please - Go right ahead and telephone the police. I'm sure MasterCard and Visa will be thrilled to hear of your abusive actions against a customer requesting you fulfill your agreements with them."

Re:Should improve Customer service

[ednopantz]

If its my money, I'm making sure you are the guy who's name appears on that credit card. If I have any doubt, I'm checking you out before I accept a piece of plastic. I'm the one on the hook for fraud. Not you.

Don't like proving your identity? Then pay cash. We accept that always. Want to give a promise instead? Then get ready for some verification.

How come "checking id when you promise payment in lieu of real money" = instant fascism!! Oh No Everybody Panic!!! 1984!!! AAAAHH!!

And the terms of my contract with VISA are none of your business. Don't like that I look out for my interests? Hit the road, jack.

Re:Should improve Customer service

[ednopantz]

In other words: WAAAAAHHH!!

Re:Should improve Customer service

[Anonymous Coward]

They still don't allow you to force someone to show ID to complete a VISA transaction. You could claim that you have a special contract with VISA that doesn't stipulate this, but you'd be lying.

Re:Should improve Customer service

[Anonymous Coward]

Don't like proving your identity? Then pay cash. We accept that always. Want to give a promise instead? Then get ready for some verification.

Well, if you don't like the contract terms, don't sign a merchant agreement with Visa/MC. No one is forcing you to sign a merchant agreement. But if you sign a contract, you have to live up to the terms. Don't like the contract terms? Don't sign.

Why is it that living up to a signed contract is such a big deal these days?

And the terms of my contract with VISA are none of your business.

I find it highly unlikely that you are so special that Visa/MC changed their standard agreement for you.

Re:Should improve Customer service

[Scudsucker]

Both of those things are a violation of your agreement, you can't require ID and you can't arbitrarily refuse my card. Why is it so hard to live up to what you've agreed to?

Because it's virtually impossible to survive as a business without accepting credit cards, and if all credit cards have the same bs terms....

Re:Should improve Customer service

[Scudsucker]

Asking you to abide by terms of a contract you signed, is an unreasonable thing?

It is if the contract is totally unreasonable and you have to either sign the contract of go out of business.

Re:Should improve Customer service

[Scudsucker]

Why is it that living up to a signed contract is such a big deal these days?

Because you have no choice but to sign one of those contracts, and you have no choice in contracts, dumbass. Unless you consider going out of business and declaring bankruptcy to be a valid choice.

Re:Should improve Customer service

[Tale Surovi]

Just carry a binder with the Merchant Manuals with the relevant passages highlighted; they always come around when reminded of THEIR contractual obligations. So you carry the Merchant Manuals with you every single time you go out shopping? You don't find that a bit...bizzare?

Re:Should improve Customer service

[edb]

Those same rules say that the card need not be accepted at all if the transaction can not be authorized in real time (system is down, etc.).

You don't want to show ID? Fine. The card can't read read, and the transaction won't run. Cash only, thank you, it's nicely anonymous. We don't accept checks from people we don't know (trust).

Re:Should improve Customer service

[jvkjvk]

Asking you to abide by terms of a contract you signed, is an unreasonable thing? It is if the contract is totally unreasonable and you have to either sign the contract of go out of business. It most certainly is not. Let me know what businesses you own so I can avoid them. What's unreasonable is that people like you think that it's okay to break your word because it's too hard to keep it.

By your logic, if you signed a contract to provide $service at $price with $penalties if you did not, you should be able to whine that it was an unreasonable contract and that you would have gone out of business if you did not sign it (after all, you needed that cash!), so therefore you shouldn't have to provide the $service OR have to deal with the consequences of the $penalties. After all, those penalties would put you out of business too!

So, either deal with the fact that you need to honour your commitments or get out of business.

Note: This is not a blanket pass for the banks behind the CC scam we currently inhabit. The current cartel seems inevitably borken. But if you decide to jump in that pool you had better play by the rules you agreed to.

Re:Should improve Customer service

[BBandCMKRNL]

If you did that, you'd be shooting yourself in the foot, not because you pissed off the customer, but because you just ate up part or all your profit on that sale. Why? MC & Visa 'encourage' merchants to swipe cards by charging higher transaction fees for non-swiped cards and telephone authorizations. Keep that up and you'll put yourself out of business.

Re:Should improve Customer service

[Scudsucker]

What's unreasonable is that people like you think that it's okay to break your word because it's too hard to keep it.

Bullshit. If you own a small business, say a shop of some kind that depends on drop in customers, you have no choice but to support either Visa or Mastercard. And you also have no choice in terms because both groups offer the same sort of contracts. And if there is a chargeback, you, as the merchant, have no choice but to eat all of the cost. It is in no way unreasonable to break totally unreasonable terms of a contract made under duress. If Visa/Mastercard refuse to let merchants check for ID, then they should eat part of the cost of fraudulent transactions.

If you want to pissed at anyone, be pissed at Visa/Mastercard for being a cartel. Be pissed at them for trying to prevent merchants from taking simple steps to protect themselves without taking on any of the risk. Or, put it another way: how many movies have you seen where the hero heroically stands up to the little guy?

Let me know what businesses you own so I can avoid them.

I own a large multinational corporation that fronts many businesses around the world. Coincidently, the corporation owns a controlling interest in every store within 100 miles of where you live. Feel free not to shop at any of them. Asshole.

Re:Should improve Customer service

[adolf]

Right, so: In order to defend your Right to Profit, we're all expected to let you do whatever the fuck you want to do, contracts (and the laws which enforce them) be damned.

If you don't like the rules, don't play the fucking game.

Re:Should improve Customer service

[Scudsucker]

Right, so: In order to defend your Right to Profit, we're all expected to let you do whatever the fuck you want to do

Straw man.

If you don't like the rules, don't play the fucking game.

The game is rigged, jackass. Shop owners aren't wanting to get away with "whatever the fuck" they want to do, they just want to take entirely reasonable measures to protect themselves since they have to eat the cost of any fraudulent transactions. If Visa/Mastercard don't like this, then they can assume part of the risk, or go fuck themselves. And until you've given up your means of employment, been the victim of identity theft, or been a shop owner and lost a few thousand dollars on stolen credit cards because the credit card company wouldn't let you check for id's, you can join them.

Re:Should improve Customer service

[adolf]

You know what?

I don't like taxes. It's rigged, man. I tell ya. It costs me thousands, every year. And what do I get out of it? I get my Homeland Security money wasted removing Mooninites from Boston roadways, and a pointless war.

I think I just won't pay them anymore.

You cool with that? I sure am.

You know what else? I'm sick of people walking down my sidewalk. They've got no respect, and they might even be trying to steal from me. I pay a lot of money to maintain that sidewalk. I think I'll start ID'ing everyone who dares tread on my sidewalk, just in case they might be trying to rob me. And if anyone refuses, I'll deny them the use of it, forever! It's my Duty to defend myself and my property from these hooligans and vandals! Especially those wearing blue jeans. Did you know that almost all thieves wear blue jeans? The fuckers are everywhere, I tell ya!

And I sure could use an office for my home business, but signing a year-long lease could easily bankrupt me! I think I'll just squat, instead. It's so much easier, and the whole idea of land ownership is just rigged anyhow.

Once you persuade me of both your need to be a small shopkeeper, and then the need to accept credit cards, I'll begin listening to your arguments. Until then, you're just a whiny prick who thinks he doesn't need to follow the rules. And of course they're rigged! Nonetheless, you agreed in advance to follow them. But you refuse, because you think you need the extra security, and don't think you need the same fucking risk exposure as your peers. Because you are, of course, better than them, aren't you? More cunning. More stick-it-to-the-man. Your bullshit detector is a finely tuned work of art, not to be fucked with. And you are so righteous in your God-given entitlement to accept credit card payments and illicitly demand superflous identification!! Amen, brother! Down with the jeans-wearing thugs!

Nonetheless, I feel bad for you, but creatively interpreting contracts (particularly of the banking sort) is wrong and bluntly illegal. If you didn't like it, you shouldn't have signed it. If the deal is bad, or becomes that way, then don't be a part of it. That's your only honest recourse: To tell Visa Mastercard to go fuck themselves, and stop accepting their cards. Not to bend the agreed-upon rules, individually as you see fit, while depriving me (the cardholder and your customer) of my own rights under that same set of rules.

Federal Reserve is privately owned

[HomelessInLaJolla]

Credit card companies aren't having any difficulty finding people to lend money to at exorbitant rates. The illusion of a multi-trillion dollar federal debt, passed along to the taxpaying public through taxes, is a convenient business m0del, n'est-ce pas?

Medical partners

[Anonymous Coward]

"Likely there are a lot of cc debts which are simply never paid off"

The MAJORITY of that is medical bills. That's why the bank-ruptcy laws were changed.

Stop & Shop's fault

[dreamt]

No matter what people think about who should or should not pay, this was Stop & Shop's fault. The Globe article only slightly mentioned (was covered better on the news last night) that someone basically walked off with the PIN boxes, hacked them, and reinstalled. I know that there are ideas in some of these replies as to which business pays for stolen credit card usage, but Stop & Shop has got to do better than letting someone walk off with their equipment.

Having owned a store

[JohnnyComeLately]

I would say it's set up correctly. Sure VISA makes Billions and merchants eat fraud, but it's really the best point to do it. And, technically, I already do it with Checks (the reason a lot of people don't take them). Some storeowners don't get it and think credit cards are "magic"...they can take all the cards they want and money appears (minus a 5-15% fee) in their bank account. They don't realize they can minimize by: ACTUALLY CHECKING THE SIGNATURE!!!, suggest Debit over Credit (if it's both, their fees are less if it runs as a ATM, and security it better!). But it's the same as anything else in life: If you're uneducated you will always pay more.

Got suckered into a 15 year AARM mortgage with a pre-pay penalty and balloon payment? Education. Paid $30k for a Ford truck (which immediately dropped to a $19k wholesale value) and are upside down in value? Education. If there's one lesson...just one lesson...I could boil my entire MBA, stock market, and general life experience (regarding businees) into:

He who has the most accurate and timely information wins.

Coming back around full circle: This is why merchants should be responsible (and their banks). It forces them (and me!) to educate myself and minimize EVERYONE's risk. A previous owner left draft information for bank auto withdrawal in a binder, on the desk, by the door, for all his customers. Huge fraud potential. Some leave credit card information in the store after the day of sale. Huge fraud potential. I could go on, but I've proven the premise for my conclusion: You have to be active and reduce your costs through fraud prevention. How can I reasonably hold VISA accountable when I'm a merchant stupid enough to charge a card with someone elses name (I've seen guys try to use their wife's card....Dudes do not look like a "Wendy" to me).

On the flip side, I had a merchant pissed because I called in a charge back. Yeah he was pissed, because chargebacks increase fees a bank charge....but I gaurantee you he'll call next time he does an unauthorized pre-pay on my card. I manage a tech support department and we follow the policy I told him he should follow to reduce costs: Always call someone before you charge their card. In my case, he charged a 2nd $700 and then my wife said, "Should there be a 2nd one?" I said, "Nope" (not thinking two steps past why she asked) and so she called the credit card to charge it back. Whole thing could have been avoided.

So there you have it...I've mentioned my perspective from personally being both sides of the "coin" (and being accountable for the $$)....and I'd say the system is set up efficiently, and for the most part, fairly.

Re:Having owned a store

[Anonymous Coward]

The problem comes in if you're an online merchant, you've followed the credit card companies rules for online transactions (AVS and other fraud check devices) and you get a chargeback for a fraudulent charge. How were you supposed to do a better job at verifying the identity of the CC user? The CC companies should be on the hook if they authorize a charge that turns out to be fraudulent. They authorized it, not me.

Re:Having owned a store

[King_TJ]

All valid points, but I'd also say it's arguable that credit card companies themselves have helped foster this "lax" security environment we're seeing on the part of many merchants.

Take, for example, the cases of a woman coming in, buying something using a card with a man's name on it, or vice-versa. The fact is, the credit card companies are more concerned about people using their cards as often as possible than in caring WHO uses them. My ex-wife ran up charges on my cards all the time, despite never even being listed as an "authorized user" of them. When I tried to complain that I never authorized those charges, the credit card companies faxed me back the "proof" that they were legitimate, in the form of photocopies of receipts with HER signature on them instead of mine! Their take on thing is basically "If you're married, who cares? Everything's your problem to pay anyway, until/unless some divorce court judge says otherwise."

And with the proliferation of these electronic terminals that have you sign on a touch-screen after swiping your card through, you'd think they'd do some kind of comparison to a stored signature of yours before approving a transaction. But no! They choose not to include a useful security measure like that in the system. You can draw a stick figure, write "Home Depot Sucks!" at Home Depot, or whatever you like.... It's all the same to the terminal.

Re:Having owned a store

[gamer4Life]

...ACTUALLY CHECKING THE SIGNATURE!!!

Doesn't do a thing except waste time. You would catch more false positives before you catch an actual thief that forgot to learn to forge the signature.

Re:Having owned a store

[lantenon]

Not you? Didn't you ship the item?

Re:Having owned a store

[Benedick]

Throughout this thread, I haven't seen anything from folks who have been the victims. Here's mine and it shows why I am pleased that the merchant has to eat the charge.

I took a vacation year before last and stayed in Memphis. I only used my credit card in one place in Memphis: the hotel. A couple weeks after I got back, the credit card company called me and asked about some charges that did not match my usual pattern. I identified the fraudulent charges, thanked them, and received my new card in the mail a couple of days later.

In the meantime, I called one of the merchants who accepted the fraudulent charges, a large mail-order catalog company. I called them because they mailed me a confirmation statement. That statement listed my home in Texas as the billing address with the ship to address in Memphis. When I got customer service on the phone, I explained the situation and the reply was that the credit card company would take care of it and not to worry. They didn't even take my name or try to identify the charges. Odds are they hadn't yet shipped the goods because the confirmation said some were on back-order.

I didn't hear anything for a couple of months. Except for the fact that I was now on their mailing list and started getting mail-order catalogs from everyone and their dog. Then I received a bill from them for the order. You see, the credit card company had rejected the charge so they came after me. I won't prolong this with all the details but it was an absolute nightmare getting this straightened out. I really hope the merchant had to eat the charges because they were very difficult to deal with.

Re:Having owned a store

[JohnnyComeLately]

"you're married, who cares," too me is just about as bad, but 'less bad' than the merchant who accepted them. I have tried on occasion to use my wife's card, and sometimes fail. I'm willing to bet the merchants who don't allow me to use it are paying lower merchant fees due to their vigilance. How did this come about? The VISA/MC encourage it by rewarding better behavior.

The "Who Cares" is probably more a minimum wage worker 'customer care'(less) response, and not the official response. Technically, they're probably right...if they come after her, they're also coming after you in a way. Arguably, you could have said, "these aren't my charges or my signature, and i'm not paying" (puting the onus on them to prove it is or is not your wife). However, you gave the guy an easy out by admiting it was her. Long story short, if you'd have stuck to your guns, the merchant's bank would have eaten it, and your merchants wouldn't have accepted your wife's signature (assuming the merchant has decent employees).

Issuing Banks Pay

[Anonymous Coward]

Look, I dont know what you all are talking about, but I work at a bank doing Infosec.
The issuing banks pay the bulk of costs in a breach, not the merchants. The merchants DO NOT PAY to have the compromised cards reissued, the banks do . In terms of merchandise, in my experience we have never gone to a merchant and asked for money to cover the costs of stolen goods either. If the crook gets away with the merchandise then theres not much to do.

PCI hasn't done much to protect anyone in my opinion, because the standards are still too low, the staffs are still to small, and not every merchant is compliant. The fact that one merchant, certified or not can expose millions is definitely a case of being strong as your weakest link.

The only glimmer of hope is that customers demand everyone do more and vote with their dollars. If people lose more faith in Internet transactions, there will economic hell to pay and everyone will suffer.

Re:Issuing Banks Pay

[Anonymous Coward]

Actually I want to clarify something. In my experience the usual course of action is straight to the compromised individual's bank, not to the place that the fake charge came from. In this scenario we put money back in your account, cancel your card, and issue a new one. I do not believe that the cost of the merchandise is ever recovered by reversing charges to individual merchants.

If you go back to the merchant that the fake charge came from, i guess that is one course of action, and yes, the merchant loses in that scenario.

Overall though the cost of reissuing the cards is the greatest cost, and the fraud is secondary.

Exactly how it should be.

[Anonymous Coward]

The merchant is the one responsible !

Do an experiment. Pay for stuff with a card for a week. Count the number of times that the clerk actually:

Looks at the name on the card.
Checks the back of the card for a signature.
Asks to see ID in the absence of a signature (or where you might write "CHECK ID" in big bold letters)
Asks to see your ID period.

You may be surprised. I routinely use my wife's personal card, which has only her name on it, and nobody even gives as much as a glance at the name.

It's really so bad, that when people do ask to see my ID (I write "CHECK ID" on all my cards.) that I thank them.

Point is: If a merchant can't be bothered to verify the identity of the card bearer, as well as the card owner, then they fully deserve to be out their merchandise and their money.

Stop & Shop going out with a bang.

[Anonymous Coward]

"I know that there are ideas in some of these replies as to which business pays for stolen credit card usage, but Stop & Shop has got to do better than letting someone walk off with their equipment."

I recommend a pressure plate with some C4.

Merchant pays? Not all the time.

[Itninja]

I am an online merchant and I use both Google Checkout (in the foreground) and Paypal Payments Pro (in the background) to process CC transactions. Both of those providers will (and have for me in the past) eat the fraudulent charges as long as I had taken all required steps to ensure the transaction was genuine.

For example, I had one $100 sale that, a few months ago, came back as 'fraudulent'. Paypal asked me to provided documentation to show the steps I took to verify the buyers information. I keep all these records, so I sent Paypal address verification, proof of delivery, etc. After about a week they contacted me, told me that I followed their verification process properly, and that they would absorb the cost of the disputed transaction.

Mod parent up!

[khasim]

As long as that is the case, Visa/Mastercard has no motivation whatsoever to increase security and decrease fraud.

EXACTLY!

Instead of working out a BETTER SYSTEM, they just pushed the fiscal responsibility for the FLAWED SYSTEM to the merchants.

The merchants are the ones LEAST ABLE to fix the existing system or implement a better system or validate that the transaction is legit.

The ONLY people that this is good for is Visa/Mastercard. They make huge profits without the risk.

Re:Mod parent up!

[bastion_xx]

There are better systems, just ask our Europeans counterparts. It's near impossible to buy anything in the UK (and I assume other EU countries) where the merchant does not have chip/PIN capability. Chip cards significantly reduce the risk to the merchant, and thereby reduce the discount rate paid, and provides the merchant with more chargeback rights.

Granted, if the merchant puts out a Visa or MC logo, they still have to honor swiped transactions (not withstanding that one Brick Lane curry house that kept saying no-no-no-chip only -- but I digress), but will do everything in their power (and the merchant agreement) to dissuade swiped transactions.

Anyone who's had to work with Mastercard Visa, AMEX, Discover, JCB/Diners, and the rest know how bad it can be. But remember, these are just the associations. Look to the members who make up these organizations (or sit on the board of the publicly traded ones) and ask them why they haven't increased security. That's you BoA, Chase, Citi, and the rest.

But then again, one step down the food chain (and off to the side) are the acquirers. If they and the the ISO's under them would provide merchants (their clientele) with chip/PIN solutions, that would go a long way to help the merchants out. Supporting such solutions, on razor thin margins (measured in single basis points in the most competitive markets) is always low on the list (along with decent merchant reporting).

But, then again (2), the issuers would have to have products that support Chip/PIN. The only one I ever see, AMEX Blue, may be a good card, but I bet it's still used 98% of the time as a regular old track 2 swiped transaction. I'm interested in any large merchant that has card readers capable of chip transactions.

So, you have the unholy triumvirate: banks and issuers that give out cards; ISO's / acquirers that accept card and settle for the merchant; and the associations that sets the rules for card acceptance, fraud processes, and such. If I was Visa, I'd issue a mandate to, err, issuers, that as of date x, all cards must be chip capable (with world-wide standards). At date x+n, acquirers, ISO's, and merchants must be capable of accepting Chip/PIN cards or face fines.

Anyone who has had to deal withe craziness of PCI and it's predecessors knows the frustration, fear, and pain of not meeting association deadlines.

And while I'm on it, what is the adoption rate of Verified by Visa or the other SET-based solutions? These offer reduction is discount rates too, if implemented.

Sorry for the rant, but having a waiter tell me to go down to a cash machine because by US-issued credit card isn't chip capable has got me a little feisty.

Re:Mod parent up!

[RzUpAnmsCwrds]

Chip + Pin does nothing to dissuade online fruad, unless you are going to require everyone to have a smartcard reader attached to their PC.

While credit card fruad at real (physical) merchants does happen, it's relatively small compared to what happens online. There are just too many cameras and too many opportunites to be caught or arrested.

I'm not saying that we shouldn't move to smartcards - just that they need to be supported for online transactions before they will be able to make a real dent in fraud.

Slightly OT about merchants eating charges

[hellfire]

I'm absolutely shocked by the ignorance some people about credit cards. Now I'm not talking about a Joe on the street, I'm talking about people taking the orders. Many merchants favor convenience over everything else.

For example, in the order processing system I support, we mask the first 12 digits of the credit card when you retrieve an existing order. It didn't always do that, but it eventually did as part of an upgrade to comply with the PCI standards above. That makes sense, lots of systems started doing that even before the standards and now all of them do. But one guy wanted to argue with me that it will hurt his customer service because he can't read the card number. I explained to him that it's out of my control and that Visa imposed these restrictions on all computer systems and you can't buy a system that doesn't have this feature any more. Further more merchants and software companies could be fined by Visa if they didn't have these restrictions.

I was going to explain why Visa mandated the changed and explain card security when he demanded: "We'll take the chance, change it back." If I were his customer, I'd have yanked my business, knowing that it's an easy inside job for him to steal my credit card.

Also, it's happened to me twice recently, where two major chains I visited (Superfresh and Target) took my card and made me sign an electronic signature capture device for my signature. In both cases, the signature pad and/or pen was broken and was basically reading garbage. I could not write my signature. In both cases they said "we don't need your signature" and just ushered me out of line. Okay they are major chains, and could eat a charge now and then, but hell you would think they would care about their signature pads a little more. Maybe close the line or have replacements on hand to easily swap out. Everyone going through that line that day was a potential risk to the merchant for a chargeback, just because they didn't capture a proper signature. And that exposes me as well because I'm unable to sign my signature which leaves me open for question when signing other receipts.

The way security works now in credit cards I feel is good, and it's designed to increase the security on integrated systems. 80 to 85% of credit card number theft is an inside job. People stealing card numbers and internal information, and computers just make it easier to do that without restrictions on said computer. The merchant doesn't care if you get hit with fraud. Visa cares because if their cards are insecure, no one will use them. So Visa makes the merchant's care by assigning responsibility to them, because that's were most fraud occurs. It's very logical.

Re:Slightly OT about merchants eating charges

[adolf]

The signature, AFAIK, is only there to signify that you, the authorized card user, agree to the terms of the Cardholder Member Agreement or some other such nonsense.

It has nothing at all to do with accepting any particular charges, or as an affirmation of successful completion of any particular sale.

It's just to state that you agree to the terms of the same contract you signed when you got the card initially. But since that contract is not available for your review at the time that you're being asked to agree to it, the POS agreement signature is really not particularly valid, anyway.

I, therefore, sign all such documents with an X. It's worked so far.

PCI Misconceptions

[brufar]

A lot of people seem to have a misconception of exactly what PCI is, what it covers, and what it does.

PCI affects all areas of the transaction stream.

When looking at ATM's for instance the units must be tested and Certified (InfoGuard, TNO and T Systems). If you attempt to open the device it dumps the program and tampers the unit so it can't be reprogrammed. this prevents a situation such as the one at stop and shop where a malicious party opened the POS device and apparently hooked up a device to sniff the card reader (article is a little vague on exactly what was done to the POS devices) There should be no place in between the PIN PAD and the CPU of the device where data can be read in the clear without causing a temper condition to the unit.

Some of these requirements are relatively new and some older terminals that are currently in place may not meet these requirements. Any existing units that are relocated or changed must meet the new requirements at that time. One exception to this is Data encryption. All terminals must now transmit data using 3DES encryption, any terminals that are not utilizing 3DES encryption and are running the older Single DES were to be taken off-line at the end of last year.

Also all software run on the device must be certified through testing and any software changes must be re-certified as well. Software is sent to the device in an encrypted format, routinely verified on the device for changes, and units must identify themselves with a unique set of keys in order to access updated software. On top of that each Switch (STAR, CORE DATA, ECS, LYNK, etc..) that the terminal may dial into has to certify the equipment and software to work with their systems before you can use that terminal to process transaction through that switch.

Now go to the company/merchant/etc.. that is processing transactions whether they be web based, Point of sale, or ATM. any company that has Card data on file is subject to PCI requirements as well. This can be everything from segmenting card holder data on the network, encryption the database containing card holder data, additional logging requirements that show who accessed what data, when and from where. Physical security, the PCI requirements are quite extensive. https://www.pcisecuritystandards.org/tech/download _the_pci_dss.htm

If a card number is lost it costs VISA,or Mastercard about $60.00 to re-issue a new card. now if several thousand cards get lost those numbers can get large rather quickly. If you are PCI compliant as a merchant or processor, and have adhered to all 240+ requirements of the PCI certification that apply to you, and you loose card holder data, you will probably dodge the huge fines (think tens of thousands or millions of dollars here depending on the size of he breach) levied by VISA in case of a breach which is on top of the fees to re-issue the cards. if you are NOT compliant all those fines and fees will be passed on to you.

PCI is not an instrument put in place to address the use of a stolen card. it's to prevent the loss of large numbers of card holder data at one time.

I think it's great the industry is imposing the regulations on itself, some of which are extremely stringent. And it beats the heck out of how the government could butcher doing the same process by trying to regulate it.

Re:PCI Misconceptions

[Anonymous Coward]

It may great that the industry is imposing the regulations on itself, but I can assure you that self-regulation will generally be in their self-interest.

The card brands didn't establish PCI to combat fraud per se, because as we have established above the brands don't pay (directly) for fraud. The card brands established PCI to maintain consumer confidence in their cards.

The brands lose more money from loss of confidence in card transaction, than they do from fraudulent charges.

Follow the money.

Re:PCI Misconceptions

[Anonymous Coward]

PCI is just like HIPPA, SOX, or GLBA. A GENERAL framework. Yes, this includes things like encrypting PINS back to the ATM "switch" (Visa, in this example). But its still pretty weak, and most online sellers dont know enough about security (application security especially) to do anything about it. Theres not enough people and systems to watch out for fraud, PCI isnt enough alone.

Anyway, VISA DOES NOT PAY TO HAVE CARDS REISSUED. Banks pay for reissued cards, and credit monitoring (if your bank knows what it is doing).

Visa is just a branded network, kind of like Nyce, Cirrus, Star, or Plus. Look at the back of your card.

Where's my rate cut?

[teflaime]

Credit card companies justify their ridiculous interest rates by pointing to the losses the "have to eat" when credit card fraud happens. Since they no longer have to eat those losses, where's my rate cut, you theiving bastards?

Re:Where's my rate cut?

[julesh]

Credit card companies justify their ridiculous interest rates by pointing to the losses the "have to eat" when credit card fraud happens. Since they no longer have to eat those losses, where's my rate cut, you theiving bastards?

They're talking about a different kind of fraud. They're talking about people who steal identities, use them to apply for high-limit cards, then go on a spending spree before disappearing and never being seen again.

There's nobody they can charge in these circumstances.

Re:Where's my rate cut?

[Slashdot Parent]

No, the high interest rates are because of the high risk you'll take their money and run, big guy.

A consumer credit line like a credit card is an unsecured loan. If you charge your bigscreen on your Providian card who "Gave you the credit you deserve" and when they come to collect, you tell them to go pound sand, there really isn't much they can do. That's why Providian was on the verge of bankruptcy before being bought by WaMu.

The high rates are for the high credit risk. Want a lower rate? Get a higher credit score and shop around for a better rate.

Or better yet, pay your balance off every month on time, every time, and pay no interest at all.

The risk to the credit card issuer due to fraud is minimal. Either the merchant pays or their insurance company pays. The issuer doesn't pay unless you charge off.

Re:Where's my rate cut?

[teflaime]

My credit score is over 800. Credit cards are only for emergencies. I just object to having to pay 16% interest because my I have to buy a plane ticket to my grandmother's funeral after I plundered my savings to buy a house.:P Credit card companies would assume less risk if they didn't send 90 million credit card solicitations a day. But it's a Milton Friednman world and corporations exist only to screw the rest of us.

Bull

[iamacat]

Credit card today is a dumb piece of plastic with no security to speak off. When credit card companies come up with a decent authentication scheme and implement it in ALL locations, they can pass the responsibility for fraud to vendors.

Fraud == Money for Visa/MC

[Anonymous Coward]

The problem is that Visa and Mastercard see PCI-DSS as a money-making venture. If you've ever read through the requirements, they are basically impossible to implement in the real world. Every change must be documented to the T, and approved, and first tested in a full dev environment. One problem with this is patching systems, how fast can that process really occur? If a vendor releases a patch, you're probably going to need 2-3 weeks to comply, but if you're breached within that time period, you can be fined hundreds of thousands of dollars by not having a patched system, and if you patch a live system within approval, or testing in a dev environment, or documenting it, you're in violation of PCI-DSS. The process is always going to be skewed to their benefit, and not to the merchants.

With all the fraud issues out there, it wouldn't take much for Visa/MC to almost entirely eliminate it with additional data verification requirements, the problem is they'd lose too much money if fraud didn't exist (Verified by Visa and Mastercard Secure Code are a step forward, but the subscription rate to those programs is extremely slim. Make it a requirement, and things would change). Did you know that on a chargeback, they charge the merchant $25.00, and still keep the interchange percentage they originally charged, and take the full charge amount back out of your account? It's a total racket.

why are these numbers being stored?

[ALpaca2500]

when i swipe my debit card through the machine at stop and shop, it says "approved". At that point, the money is wired from my bank to stop and shop, and my personal information should be purged. or am i mistaken, and is there a reason for stop and shop keeping everyone's crdit and debit card numbers?

Re:why are these numbers being stored?

[cdrguru]

Approved means nothing - just that your card says it has been approved for use and the amount is covered by your account. Period.

Later that day a batch of transactions are sent to the processing company. This is how the merchant gets paid. Why isn't this done immediately? Because there is a per-batch charge on top of the authorization charge. So it makes sense to build up a number of transactions to be sent over at the end of the day.

The batch also allows the merchant to change or void the transaction before it is submitted for payment. It is how restaurants get the tip added on to the charge. What you are signing is something printed from the approval process, not the actual submission of the charge.

Then there is the problem of disclaimed charges. You buy something with a credit card and when the bill comes you call the credit card company and say "I didn't buy that!" They contact the merchant and make him prove that you really charged it. Unless they have records - and often a security camera video of you - they get stuck for the bill. You can always say you didn't really sign that. If they have a record of the charge they have something. You're thinking they can get away without any records and that won't work.

Re:why are these numbers being stored?

[el_gordo101]

The article was light on details, but what I have read and heard the past few days was that the card readers were physically removed from the checkout lanes, tampered with, and then replaced. The swipe readers were then used to collect card numbers and/or PINs. It was not a breach of their back-end database, it was collecting the data off of each customer that used the affected card readers.

Re:why are these numbers being stored?

[Kalriath]

I don't know. EBGames here in NZ does the same thing. They swipe the card through the EFTPOS terminal (which causes the bank to provide an authorization) and THEN they copy the credit card number, expiry, and CVV2 code into their computer systems. One time I asked them not to and they said it's "required for reconciliation".

Re:why are these numbers being stored?

[Anonymous Coward]

A typical terminal capture system relies on the terminal or POS system to hold all of the transactions. When you swipe your card, a request is sent to the issuing bank (your credit card company) for authorization. When the transaction is authorized, the terminal gets that and pops out a receipt for you to sign. The merchant does not get a deposit until the transactions are settled (sent to his merchant service provider). Once settlement happens, all data is dumped.

If something happens to the terminal and dumps all the transactions, a proper paper record will allow him to re-enter the transactions and everything is transparent to you. The paper receipt also allows the merchant to back up a transaction in case of chargeback inquiries. Some people like to cross out part of the card number when they sign the receipt, those people don't know that the merchant can easily reprint the receipt when they walk away.

Re:why are these numbers being stored?

[BBandCMKRNL]

Later that day a batch of transactions are sent to the processing company. This is how the merchant gets paid. Why isn't this done immediately? Because there is a per-batch charge on top of the authorization charge. So it makes sense to build up a number of transactions to be sent over at the end of the day.

It depends upon the transaction type and the merchant.

I go to the grocery store, three minutes from my house, and buy cat food with the debit card. when I walk in the door with the cat food, if my wife is in our online banking at the time, she will tell me, "You spent $4.29 on cat food. Please shred the receipt as I've already entered it into Quicken."

Note, this does NOT show up as a pending transaction as it does when we eat at a local restaurant that indeed batches transactions once a day.

Yes, the merchant always pays.

[alisson]

And it eats small retailers alive. Most small businesses can't AFFORD very much by the way of security, nor their own credit authorization system. So instead, they typically accept cards through a middle-man, that has terms which make you wonder how small retailers stay in business.

Say you pay for goods with a stolen credit card. For phone or internet verification, all you need is the verification code, which is listed ON the card. And if the cardholder denies the charges? The merchant gets hit. Say the merchant files a police report of fraud? The merchant still get hit. The authorization companies have no incentive to provide any security, and why? Most merchants MUST accept credit cards to survive. A large portion of their customers won't pay any other way.

Say you DO buy good with your own card, yet deny the charges later on. The merchant gets hit. Now, like a good merchant, they kept your receipt on file. It has your scribble of a signature, which(like most americans) vaguely resembles the half rubbed off scribble on your card. Is it entirely plausible to deny you signed it, and say your card was stolen.

The burden to prove fraud always lies with the merchant, who, in many cases, has no means to do so. The security for transactions always lies with a merchant, who in many cases, has no means to provide it.

Cards are a rather flawed system, particularly when not in person. Not to mention how unfriendly credit cards are to customers. It's wonderful to have cash now, but not worth the interest charges. Past that, their unfriendly to merchants, but due to the "convenience" of cards, they're all but required.

You'd think the same with cleared checks, but no

[Anonymous Coward]

My friend had a cashiers check given to him by a 3rd party for a car he was selling. He took the check and deposited it into his account with a bank that sounds like TNC and is located in PA. Check clears, so he pulled out the money and uses it to buy a different car. Life seems good. A night or two later him and I decide to go shoot some pool and get some wings. He checks his account online, only to find it's nearly 3 grand in the hole. After a few rounds of calls to "TNC" he finally learns the cashiers check was a fake. Guess who's stuck with the loss even though THE CHECK CLEARED??? Not the bank! After some researching we've sorta figured out in the US and Canada, just because a check has cleared does not mean the check is legit and valid... apparently the clearing "process" is just a damn joke is just a delay for you to get your money, not time used to check everything is correct.

After contacting the local police and being passed over to the local FBI branch he came to learn this had happened a few times before in our area. I just hope the other banks actually protect their customers better than "TNC". Needless to say he switched banks after that, and when I moved my girlfriend into the dorms at *P*itt I yelled at the people pretending to be helpers for the freshman but who were really trying to get you to sign up at "TNC". Guess you could say leason learned the hard way.

Re:Having owned an ONLINE store

[Anonymous Coward]

None of your comments make sense for an online store. outside of standard card checking stuff, their is nothing we can do to stop fraudulent use, and we get screwed over and over again. We can't check a signature, can't suggest debit over credit to check PIN and can't make sure Wendy is really a woman. So, drop the attitude about 'education.'

I've seen it happen. (Sort of.)

[Kadin2048]

Some friends of mine still tell a story from pre-internet days: an obviously fraudulent order was reported to the police, who actually took action(!) Two police officers dressed as couriers delivered a fake parcel and nicked the thief when he signed for it.

This is what really gets me about internet/mail-order fraud. The risks would be huge if the police gave a shit, since frequently it is blatantly obvious, and the thief has given the place and time he's going to receive the goods, and all that has to be done is turn up and put cuffs on him. No-one cares though.

They start to care when the amount of money exceeds trivial amounts, though. Not too long ago, I spent some time living in a house with a few guys (*cough* Craigslist *cough*). One of the other people in the house was actively engaged, I suspected, in some type of shady dealing. Needless to say, I moved out in a heck of a hurry. As it all came out later, this not-too-bright fellow thought he had discovered the perfect scheme: he was copying credit card numbers down at work, and then using them to buy things online, which he had shipped to various empty houses, and then he'd go and pick the stuff up later, and pawn or fence it on eBay. (And this is pretty much all I know about it; I don't quite get how he was getting the billing zip codes, which are usually required, or anything else.)

He got away with it for quite a while, too -- somewhere around six months, maybe more -- probably because he never used the same card more than once, never bought stuff from the same online store, and never charged more than $100 or so per card. But eventually the credit card companies must have caught on, and run all the accounts that had disputed charges through some sort of filter, and figured out that the common thread was the retail establishment where he worked. One day, according to the story I heard, they just walked in and arrested him. They had a stack of photos of him picking up packages from other people's houses, plus transaction details from the various merchants with the stolen CC numbers and the shipping addresses.

So both the credit card companies and the police have some level of interest in going after people engaged in fraudulent activity, but the bar seems to be pretty high. I've no idea how much money had to go missing before someone at one of the CC companies (or an automated program of some sort) decided to take a closer look and see what the common thread was, but it must have been in the thousands of dollars, perhaps tens of thousands.

In this case, I don't see how the merchants would have ever caught on; to all the places where things were ordered, it looked just like a regular transaction. It was only at the CC back offices, where they had the ability to cross-reference all the suspect accounts and see that they had all visited the same store within the past 24-48 hours (or whatever, I assume this is how they caught on), that they had the capability of doing anything. To push the financial burden out to the merchants, probably would have meant that he could have gotten away even longer.

Re:I've seen it happen. (Sort of.)

[Target Drone]

I've no idea how much money had to go missing before someone at one of the CC companies (or an automated program of some sort) decided to take a closer look and see what the common thread was

They may have figured it out from his IP address. If your on highspeed you IP tends to remain the same for weeks or months at a time. Other providers may be different. The credit card API that I used had an optional field to send through the IP address of the customer making the purchase. If enough online retailers fill in the field then it's pretty obvious that you have charge backs on different CC numbers that were purchased from the same IP address.

The Power of Cartels

[yintercept]

Expanding on this thread. The credit card cartels actually benefit from the fraud since they can slam merchants with fees.

If there were competition in the credit card business, then merchants could choose different merchant services, or have more say in which cards get used.

One way for merchants to deal with credit card fraud would be for merchants to tack different service fees on to different cards. A merchant might charge a 1 percent fee on checks or debit cards, a 3 percent fee on card A, a 4% fee on card B (which seems more prone to fraud), a 5% fee on card D (which requires higher merchant fees).

As it stands, of course, the credit card companies prevent merchants from the one logical course of action in the light of credit card fraud ... charging fees based on the performance of the payment method.

The power of a cartel is that what goes around never comes around. And you you get to take a percent of what goes around.

Re:The Power of Cartels

[Anonymous Coward]

They can't, its against the TOS of any credit card to do so.

Re:The Power of Cartels

[swillden]

Just one general comment: Anyone who talks about "credit card companies" doesn't know what they're talking about. Those who understand the credit card industry call them by their real name: "banks".

Visa and Mastercard are not companies in the normal sense at all, they're consortia of member banks, and they're primarily funded by dues paid by the members. They're clubs, basically, whose primary job is to establish standards so that their members can interoperate (issuing bank A's card can be read by acquiring bank B's machines and the two can communicate to authorize the transaction and arrange payment).

Note that there *are* Visa and Mastercard corporations, but they're just regional organizations established to manage the work of the club. Some of these corporations also own transaction processing intermediaries and various other supporting businesses, but those are strictly penny ante compared to the money they get from dues which, in turn, is miniscule compared to the money issuers and acquirers make from finance charges and transaction fees.

Re:The Power of Cartels

[Anonymous Coward]

Australia allows fees. The card companies make you sign contracts saying not to charge a fee, but this is against the Trade Practices Act.

I had merchant facilities with VISA/MC/AMEX/Diners and I charged for Diners transactions because of their high merchant fees and because Citibank sucks.

Re:The Power of Cartels

[Anonymous Coward]

Hmm.. Maybe I'm oversimplifying this, but wouldn't it be easier to just just offer a 5% "discount" for cash purchases? Of course "discount" would be the real price, and the 5% for non-cash purchases is the service fee disguised as the regular price.

Re:The Power of Cartels

[letxa2000]

Gas stations in the U.S. used to do that.

Re:The Power of Cartels

[Anonymous Coward]

They can't, its against the TOS of any credit card to do so.

Finish reading the post... that's what he said....

Re:The Power of Cartels

[Lost Engineer]

I used to go to a liquor store that gave a 10% discount on some items for cash.

Something tells they were avoiding a little more than merchant fees.

Re:The Power of Cartels

[Scudsucker]

Just one general comment: Anyone who talks about "credit card companies" doesn't know what they're talking about.

Um, no. Are they companies? Yes. Are they offering credit cards? Yes. So...they're frikkin credit card companies. More so since all credit card companies might be banks, but not all banks offer credit cards, anymore than all banks offer brokerage services or insurance.

Re:The Power of Cartels

[swillden]

Just one general comment: Anyone who talks about "credit card companies" doesn't know what they're talking about.

Um, no. Are they companies? Yes. Are they offering credit cards? Yes. So...they're frikkin credit card companies. More so since all credit card companies might be banks, but not all banks offer credit cards, anymore than all banks offer brokerage services or insurance.

Yes, but those who understand the industry don't use that terminology.

Re:The Power of Cartels

[Anonymous Coward]

Anyone who talks about "credit card companies" doesn't know what they're talking about. Those who understand the credit card industry call them by their real name: "banks".

American Express is not a bank, and yet they are a "credit card company". I guess you don't know what you're talking about.

However, in some countries, American Express has a bank subsidiary, for the sole purpose of issueing credit cards.

Re:The Power of Cartels

[swillden]

Anyone who talks about "credit card companies" doesn't know what they're talking about. Those who understand the credit card industry call them by their real name: "banks".

American Express is not a bank, and yet they are a "credit card company". I guess you don't know what you're talking about.

Touche. I have done work for AMEX, but so much more of it has been Visa/Mastercard/JCB that I tend to forget AMEX. There are also Discover and Diner's Club.

It's still true that people who know the industry talk about banks... and then when called on it say "Oh, yeah, and AMEX".

Re:The Power of Cartels

[yintercept]

A cartel is a "consortia of members".

The plural of "company" is "companies." In basic grammar, the plural of something generally means a group of somethings.

Yes, there are banks that have an extremely complex nexus of contracts that allow them to skim a sizeable profit off business. The complex nexus of contracts helps hide them. Referring to them as credit card companies is fine in my book.

Re:The Power of Cartels

[yintercept]

Contracts with credit card companies prevent you from having discounts for other credit card companies. I think that they do allow discounts for cash. Of course, the problems with doing all of your business in cash is that bandits with guns rather than bandits with plastic cards take the money.

As a web designer, I haven't figured out how to get cash through the net. I tried letting them fax dollars in.

A gentleman from the Secret Service discussed the issue with me, and let me off saying that my collecting dollars through fax was the worst attempt at counterfeiting that he had ever seen.

+5 Insightful

[dunc78]

This should be modded +5 insightful. People aren't very good at following money, and think corporations and even moreso the government are magical entities that grow money on trees. People who don't think customers are footing the bill for this are the same people that think that municipal WIFI is free.

Re:+5 Insightful

[PitaBred]

But if the cost is spread among all users, and heavier on the users who cause the most cost, it's a self-correcting system. Nothing is perfect, but this sounds like it's a pretty good compromise all around.

Banks don't get it either

[Alwin Henseler]

From the summary:

there are tens of thousands of merchants who don't understand the basics of information security

Neither do banks themselves, sometimes. In the Netherlands where I live, banks would like to have their customers use 'plastic' wherever possible. With plastic meaning bank card + pin number, or a type of e-wallet called 'chipknip'. Credit cards are not a very popular payment method here AFAIK (these e-wallets aren't either, but that's a different story).

But the weird thing is: a customer is expected to keep his pin number a secret (eg. not write it down anywhere). At the same time, you're expected to type this 'secret' number into terminals at shops, gas stations, restaurants, grocery stores, etc, etc, etc, on equipment you can't verify whether it's tampered with, and under the watchful eye of security camera's and customers waiting in line behind you.

Keep something a secret, and use it in as many (possibly not trustworthy) places? I won't pretend to know much about information security, but that makes no sense.

Another example: recently an online payment method was introduced called iDeal. After placing your order on a webshop, the merchant sends you to your own bank's website, where you can enter password (or other method of authentication), and give the okay for specified amount to be transferred from your account to the merchant. Looks easy enough, doesn't it?

But: Helloooo! After many e-mail phishing attacks, people have been warned not to click on links they receive in e-mails, or follow links on untrusted websites. At the same time, they are encouraged to follow links provided by online shops, which they may not really know or done business with before. How is that webshop to be trusted? Because they have a decent looking site? Because they offer this payment method (and thus need to have some sort of agreement with a bank in place)? Because others have ordered items there? Come on! Don't be surprised if online buyers don't check anything anymore, after getting used to paying this way. Click icon, enter online banking password, done!

For clarity: you sign the 'okay' on your bank's website, using its normal authentication/confirmation procedure. It's like doing a money transfer via your own bank, but streamlined from webshops 'checkout cart' to 'confirm payment'. My critism doesn't involve the security of this particular method (with a customer that pays attention), but how it gets customers used to be on a webshop site, and 2 seconds later enter their online banking details (passwords etc). That sequence isn't a good thing to get used to, and it's ridiculous that banks are promoting this.

It's really a wonder abuses are rarely heard of, but I assume in most instances where it happens, word doesn't get out, and the costs are added to 'the cost of doing business' (=running a bank). There are several reasons I still prefer cash for day-to-day shopping, and the above is one of them. Welcome to our brave new world, where fiction and reality blurs increasingly into one.

Anecdote

[king-manic]

My family owns a very small chinese food place. We had a mastercard account. My parents were ludites and refused to upgrade to an electronic terminal because they didn't understand how to use it. Our bank/merchant account reseller droped the imprinter proccess and implemented a complicated IVR. My sister registered a transaction on the ivr for 62.86. The IVR registere dit as 44,400.00 instead. We got a notice about it after and co-operated in resolving it for our customer. Despite the fact it was an obvious mistake and was greater then the actual limit of the customers card we got a charge back of $2456.00. Which is more then the total MC orders we get in a year. We tried for weeks to address this since we were sure it was a ivr error. especially since it exceeded the customers limit. but we had no course of action to resolve it as an error. we were stuck with a $2456.00 chargeback because the IVR either had a bug or did not do a proper check ont he amount. We dropped MC support and dropped all of our MC cards because of this. but it won't protect merchants form other arbitray decisions Visa/MC/AMEX make.

Re:Anecdote

[jrumney]

My brother was once mistakenly charged $12,000,000 on his debit card, putting him $11,999,000 in overdraft. This happened on a Friday afternoon. The following week, he spent 3 days trying to find someone at the bank with sufficient authority to reverse the charge, and a further couple of days trying to get the $20,000 in interest charges credited back (which did not happen automatically after they reversed the $12mil). The merchant in this case was the bank itself - he had ordered a new customised card, which was supposed to have a $12 fee. So I'd keep fighting for that $2456 if I was you - try small claims court. This sort of thing does happen, and it often is the bank/credit card company's fault, especially when it well exceeds the limits that are supposed to protect the customer from silly charges.

Re:Anecdote

[king-manic]

Thank you for the suggestion. I think we'll move on. The legal fees would exceed the amount to be recouped. I'm in canada and we have a loser pays system. The bank themselves were somewhat gracious but Visa itself was beeing bullies. The bank waived their commission ont he transaction but Visa was the one demanding their cut. Small claims may not incur very must legals fees but the lose rpays system doubel it if we lose and a win would recoup less then the $2456. We'd spend th time and labour; and then still face the possibilities of losing and losing the legals fees of both parties.

The other half of the problem

[GreyPoopon]

While security at merchants and banks might be half of the problem, the following quote from the article sums up the other half:

It's still such a nightmare to get the problems resolved.

The biggest problem for consumers is not getting back the money they lost. It is repairing their credit record. We have a situation where three credit bureaus are collecting and disseminating private financial data about consumers. There is little or no control for the consumer over what information is given out in a credit check and to whom, and there is little or no control for the consumer about what information hits their credit report and what impact it has. Scour the web, and you'll find plenty of horror stories about consumers who have tried to clear their credit records of erroneous entries. In an identity theft situation, a consumer requires a team of lawyers working overtime to even partially restore their credit record after such an attack. What we need in this country is a complete revamp of the credit system that provides the following:

1. Consumers have control over what credit information is sent and to whom. Each and every attempt to pull a credit report should be approved by the consumer, and the consumer should be able to say whether or not just the credit score is sent, or whether more details are provided. Consumers could provide up-front authorization for financial entities that they are already doing (or intend to do) business with by providing the credit bureau with pre-authorization.
2. Once a case of identity theft has been proven, recovery should be simple with no lawyers required. There needs to be a foolproof method for a consumer to prove his or her identity, and then the consumer should be able to get reports of activity from the credit bureaus and involved financial entities. Once this is done, the consumer should be the authoritative source of determining which charges are accurate and which are a result of the identity theft. Obviously, responsibility for defraying these costs should fall on the shoulders of the entity whose breakdown in security was responsible for the theft.
3. Credit monitoring should be provided by each of the credit bureaus automatically at no additional charge. Any unusual activity should be immediately reported to the consumer.
4. Disputes in the information contained on the credit report should be handled promptly by credit bureaus, with a several financial penalty for failing to do so.
5. Disputes between the consumer and creditors that cannot be resolved should immediately be sent to arbitration by an uninvolved third party.
6. Consumers that are not satisfied with the results of arbitration should still have the option of appealing the decision using the court system.
7. In the event that a credit bureau is unable to adequately perform the above requirements, their license to operate should be revoked, a copy of all data on consumers should be sent to the each consumer as is appropriate, and all remaining copies (physical or electronic) of any data on consumers should be destroyed.
8. Financial entities should not be allowed to share data about consumers with each other -- not even with their own subsidiaries.
9. Financial entities should be required to specify clearly to a consumer what data they will collect and exactly what information will be sent to what credit bureaus and under what conditions it will be sent.
10. Financial entities caught harassing consumers by damaging their credit record intentionally or by using credit information in "creative" ways to support raising interest rates should have their license temporarily suspended pending the results of an independent investigation. The license should not be reinstated until all employees even remotely involved are removed from their positions. This would include members of the board of directors. Such action would not preclude criminal investigation and charges.
11. Credit bureaus should be required to maint

Re:The other half of the problem

[Slashdot Parent]

Consumers have control over what credit information is sent and to whom.

This would help a ton, because when someone attempted to impersonate you, you'd see the request for a report and deny it. The other thing you said about score vs. full detail wouldn't help much, because everyone would just request a full report. I am a landlord, and if you want to rent from me, I get a full report. Case closed. You don't want to send a full report? Well, you can rent from somebody else. I don't care.

Once this is done, the consumer should be the authoritative source of determining which charges are accurate and which are a result of the identity theft.

This would never work. Anyone with negative items on their credit report could just claim "ID theft" and get legit items off their report. But given #1, ID theft would be much more rare.

Credit monitoring should be provided by each of the credit bureaus automatically at no additional charge.

You can already get free reports. You should use them. Have you ever used credit monitoring? It's worthless. Better to take matter into your own hands.

Disputes in the information contained on the credit report should be handled promptly by credit bureaus

Already required.

Disputes between the consumer and creditors that cannot be resolved should immediately be sent to arbitration by an uninvolved third party.

This is basically what happens, but the CRA is the uninvolved third party.

Consumers that are not satisfied with the results of arbitration should still have the option of appealing the decision using the court system.

This is how it works currently. Also, a consumer may add a personal statement disputing any item on the report.

In the event that a credit bureau is unable to adequately perform the above requirements, their license to operate should be revoked

CRAs are not licensed. Anyhow, they are required by law to perform most of what you mentioned above or they will be fined.

Financial entities should not be allowed to share data about consumers with each other -- not even with their own subsidiaries.

Prepare to pay higher interest rates, then. That's how banks are able to provide better interest rates to better customers. If they don't know you from some deadbeat across town, you're going to be paying the same interest rate he's paying, and I guarantee that he's paying more than you.

Financial entities should be required to specify clearly to a consumer what data they will collect and exactly what information will be sent to what credit bureaus and under what conditions it will be sent.

Seems fair, but you should just assume that if you agree to pay someone and you don't pay, you'll find it on your credit report.

Financial entities caught harassing consumers by damaging their credit record intentionally or by using credit information in "creative" ways to support raising interest rates should have their license temporarily suspended pending the results of an independent investigation.

Not sure what you mean by damaging credit intentionally, but read the Fair Debt Collections Practices Act and Fair Credit Reporting Act and see if that's what you're looking for. The consumer already does have some powerful protections. Regarding raising interest rates for those who become a higher credit risk... well, you signed an agreement that said the credit card issuer could do it. You don't like it, don't sign. Dirty little secrets: 1. If you call your CC issuer and ask them to lower your rate, they will. 2. If you pay your balance in full each month you pay no interest and don't have this problem.

Credit bureaus should be required to maintain a separate scoring system, visible to consumers at

Credit cards and small business

[RebrandSoftware]

Here is my experience with accepting credit cards directly through a merchant account:

-You process a transaction.
-It passes all fraud checks by the merchant account and processor.
-You're happy because you've made a lot of money.
-You transfer the money to your account a month later when you pay yourself.
-All of the sudden, 3 months later, you get a chargeback notice and all of the money is withdrawn from your account.
-You have to file paperwork with the merchant service in order to dispute the chargeback.
-If you are selling a non-shippable product (like software) you are completely screwed and will never get your money back.
-Eventually if you have enough chargebacks the merchant service cancels your account and puts all of your money on hold.
-You revert entirely to paypal.

I had higher hopes for Google Checkout since they claim to have great fraud filters: not true. They are even more misleading.

The system SCREWS small businesses like mine. You receive no training in preventing fraud and when you finally catch on it's too late. Luckily my customers are happy to pay through paypal, which has a much lower rate of fraudulent transactions, but it makes my business look less professional to not accept credit cards directly.

Is it really so hard to put a password on a credit card? That's all I ask for: one little password. That would virtually eliminate chargebacks.

Re:Credit cards and small business

[Anonymous Coward]

Is it really so hard to put a password on a credit card? That's all I ask for: one little password. That would virtually eliminate chargebacks.

Most (all?) new cards include a verification code printed on the back.

Re:Credit cards and small business

[Todd Knarr]

Is it really so hard to put a password on a credit card? That's all I ask for: one little password.

You mean like the CCV that's on every current credit card (or at least all Visa, Mastercard, Discover and American Express cards I've seen)? The one that merchants are supposed to ask for and use to validate the transaction but never ever store on their systems?

Re:Credit cards and small business

[Anonymous Coward]

Amen to that, i also sell software online, and chargeback system is due for a reform. My software has a server side backend so I can tell if a person filing the chargeback was happily using the app for the past three months before deciding to get the money back that way. And again, since it is software purchased and delivered online, I'm totally screwed. And no, banks usually don't care to listen to arguments: "show me proof of delivery UPS, Fedex,etc.. No? Buyers gets money back". The scheme is becoming more and more popular. Small online businesses unite!

Re:Credit cards and small business

[jtheisen]

That number is written down on the credit card itself. Also, it's transmitted along with the credit card number itself, even if it's not stored. Why not using one-time passwords? You get a list of numbers and are asked for one if you want to do a transaction. The list is issued by post and then you didn't even need ssl for security.

The merchants can do little to enforce such a system, that's up to the banks and credit card companies; so it's their fault that most parts of the world are left with pretty insecure payment systems.

ATM fees make cash expensive.

[Kadin2048]

Cards are a rather flawed system, particularly when not in person. Not to mention how unfriendly credit cards are to customers. It's wonderful to have cash now, but not worth the interest charges. Past that, their unfriendly to merchants, but due to the "convenience" of cards, they're all but required.

Cards are effectively required because of one thing: ATM surcharges.

Customers use credit cards, and their kin, debit cards, because it's obnoxious and impractical to use cash anymore. If you get your paycheck direct-deposited into a checking account, it's much easier to pay with plastic (and then either write a single check at the end of the month, or have it debited electronically) than it is to go to the ATM, withdraw cash, pay with cash, and then deal with the resultant change. Plus, it's difficult to find an ATM that doesn't charge you a fee for getting cash.

To a consumer, using cash costs money -- if you withdraw in $50 increments, it could be as much as 4-6% ($2 to $3 per ATM transaction) -- while using a debit or credit card is free.

If it weren't for ATM fees, I'd probably still use cash more often. But given that my bank doesn't have any local branches, and it's a pain to constantly worry about where the nearest fee-free ATM is, it's easier just to use plastic for everything. There are more merchants around who accept credit cards, than there are fee-free ATMs.

Port-ahoy.

[Anonymous Coward]

"Who Pays For Credit Card Breaches?"

The Goatse.cx guy.

companies do not need to hold on to detailed credi

[CanadianBuck]

It is my opinion that companies do not need to hold on to detailed credit card information one second after they receive payment. I was shocked that companies have the detailed credit card numbers and expiry dates months after the money has changed hands. The only company that should have that information is the Credit Card Company themselves. If every company that allows credit cards hold on to that kind of detail, then this very personal information is available at much too many points. In fact once the money has changed hands from the Visa for example, the retailer does not need anything more than the date of the transaction, and approval number. Everything else should be transmitted or shipped to the credit card vendor. Much in the same way Cheques are done. You would not imagine that a giant retailer would hang on the details of your personal cheque, with your account numbers, any more that they should hold on to your complete credit card data. Perhaps they might want to hang on to that little slip of paper with my signature, however that does not have the detailed credit card number (it is covered with security asterix) or expire date. As the world gets more and more dependant on electronic transactions, security for personal data becomes more and more important.

Sorry - Merchants *AND* CC are to blame

[AnalogDiehard]

Two years ago I started signing the back of my cards with the warning PHOTO ID REQUIRED. One out of ten merchants who saw the card in person bothered to check the back of the card, much less ask to look at it. So merchants share the blame because their security is lax.

Credit Card companies also share the blame. Do you know how EASY it is to open a fraudulent credit account without your knowledge? When we were separated, my ex forwarded all my mail to a PO Box without my knowledge/consent, opened a credit application in my name, filled it out, and returned it. She used all my personal information and signed her name, and checked herself as authorized user. If I had not caught that, the cards would have been mailed to her PO Box and I would have never known about them until she maxxed out the $12,000 credit limit. I had a suspicion about my missing mail and filed my own forwarding, and I caught it in the nick of time.

The CC company was way too lax in authorizing an account using an application THAT DID NOT EVEN HAVE MY SIGNATURE. As you can imagine, I went through the roof and blocked her from everything, including any chance of opening new accounts or loans. That single event did more damage to her case in divorce court than anything else. She got nailed on financial abuse because this event occurred AFTER I filed papers - very big offense.

From a different point of view

[BladedThoth]

Just have to toss this in quickly. I've been on the LP side of things and such before for a decent-sized national chain. The merchant pays for it if it can be proven that no precautions were taken by the merchant or it was negligent. First thing they ask for is the original signature slip or the digital form. No signature? You get charged. Signature doesn't even come close to the name? You get charged for it. As well, using various techniques they can tell if it was a man using a woman's card or other way around. Usually in a fraud case, the card is used numerous times and trending, requisition for tapes and bank attempts of cash withdrawals can proof without a doubt that you as a merchant was negligent in your duties as outlined in your merchant account agreement (You have read it, haven't you? Have you called to ask questions?) As mentioned, the cost always ends up at the customer, just like shoplifting does. It is unfortunately a cost of running a business. While banks profit from fraud, per say, it actually loses money to hire people to deal with fraud, to track it, to follow it back. They are interested in recouping the cost of fraud that can't be directly attributed to merchant fault. This fee is moreso in place as a penalty to those who didn't do their job right and to encourage change. What's to stop a business from taking potentially fraudulent sales by not following good steps such as checking ID, making sure the ID is real (to the best of your knowledge, I've seen some KILLER fake IDs in my time that have fooled the police even,) verifying the card number matches the digital version of the number, and make sure the signature is similar (either to the card or to the ID, or both.) It is a privledge, not a right to accept VISA/MC and it makes you money. If you find yourself loosing money due to these rather than make it, either because you can't manage your own fraud policy or that you are a large target for credit card fraud, then you need to figure out if it is worth it as a business option. Its like buying a house. You buy a house, it looking like a great deal. 5 years later your furnace blows up, even though you had it inspected before the purchase and the previous owner said it was fine. This is like trying to go after the old homeowner because it blew up; Whether it blew up because you never had the gas elements cleaned or it blew up just because it happens, it's your responsibility. You either should have been prepared or its your own fault for it, noone elses.

Kill the cards?

[phorm]

I'm assuming that in such a case the cards would be either tagged or disabled? I know when my girlfriend's card went through a retailer that was found to have been hacked at the time (or had an employee stealing CC #'s) it was cancelled by the CC company and she had to wait on a new one.

Re:companies do not need to hold on to detailed cr

[Cauchy]

Ah, but these companies have important uses for this information. A few years ago, I noticed that when I checked out at Meijer, I would often receive coupons for products related to previous purchase that were unrelated to what I was buying at the time. How did that happen? Well, the only commonality (other than me, myself) was my credit card. Apparently, using your credit card to track your purchases is not against their merchant agreement. It should, however, be against the law.

banks never eat the loss

[Anonymous Coward]

Credit card companies and banks never ate the loss, don't today either.

In the US, credit card related losses to banks and credit card companies are 100% deductible off their tax bill. That means that it is the US government and US taxpayers that are paying because of the lost tax receipts from the deductions.

One quick way of tightening security at banks and credit card companies, and having them cooperate with investigations of credit card theft and ID theft is to take away their deductions for thefts. Make it 75% deductible next year, 50% the following year, 25% after that, then zero on the fourth year out, watch how fast the banks and credit card companies will get their asses in gear and cooperate with investigations. Only when the thefts really hit their bottom line will they get serious about security. And anyone reporting on this issue needs to state the situation like it really is, the taxpayer/government pays, not the banks/credit card companies, for thefts, only then will the public really start to understand the situation for what it really is. Instead of thinking of how bad it is for banks/credit card companies, or merchants to eat the losses.

Re:companies do not need to hold on to detailed cr

[CanadianBuck]

Well, normally your credit card information does not include address, unless they are shipping something. However.... for the most part our names and addresses are in the public phone book. I am more concerned with the Detailed CC information.

Merchants need to check Signatures

[grahamsz]

In the US, merchants are amazingly sloppy about checking a signature match.

I've routinely signed my signature on my wife's card at checkouts and on pizza orders and despite the fact that I'm obviously not a Sarah and our signatures are very different it has never been questioned.

At least in europe they actually examine the match and will require further identification if they aren't satisfied that it's a consistent signature.

Issuing banks take the beating.

[Anonymous Coward]

It just so happens that I manage a credit card fraud department. The merchants would like you to believe they are taking the loss on fraud but that is not the case. The bank issuing the card is most often takes the hit. The merchant has almost no responsibility at all to ensure the card is not fradulent. They have no obligation to verify ID or signature. In fact any signature at all makes the charge legal. I have seen fraud cases where the merchant verified that the person with the card was not the card holder and still put the transaction through. They followed the rules and the charge is good.

Under Visa's rules the card holder is not liable for fraud. Once the card holder identifies a transaction as fraud the bank has to refund the money. If through research it is determined that the charges were valid the card holder is charged not the merchant. There are some situations where the merchant is responsible but they are not the majority of cases.

There is also the cost of re-issuing compromised cards. Our cost of re-issuing cards following the TJ Maxx breach will probably reach nearly $100,000. Where do merchants lose that kind of money?

Re:Issuing banks take the beating.

[adminstring]

What planet are you from, AC? This is not at all what I have experienced as a merchant. If there is a dispute, it is up to the merchant to prove that the charge is legitimate. If the charge is not legitimate, as in cases of fraud, the merchant eats the charge and the chargeback fee. So if a fraudulent signature is given, the merchant eats the charges. I agree with you that the card holder is not liable for fraud - that is true. But when there is fraud, it is the merchant, not the issuing bank, that eats it. And this is true even if the issuing bank erroneously said that the address matched when it really didn't. Under the current system, the merchant assumes all the risk and always ends up paying for other people's negligence or malfeasance.

Re:Issuing banks take the beating.

[edb]

Absolute and utterly untrue. Either you are lying through your teeth, or you have no connection to the credit card industry (in which case you are lying through your teeth).

What about the software vendors?

[Norin Radd]

Merchants have always been responsible for the costs, sure, and there's precious little chance of Lord Visa actually doing anything to *really* shore up security in their system, like say, making the lending banks more culpable. But having seen this sorry drama myself first-hand, I can tell you that whoever supplies the infrastructure to the merchants is an important piece of the puzzle as well. Not all merchants use a little black swipe-box for credit transactions. The bigger they are, the more likely it is that their credit authorization system will be tied directly into their point-of-sale system, and most merchants don't create their own POS.

For example, BigMart buys a HAL register system with its attendant back-end. The registers handle the swiping, and the back-end send the charges to the lending bank. Well, if the security on the back-end sucks (open ports/unpatched systems, anyone), then the system gets cracked and BigMart is left holding the bag. Welcome to the wonderful world of CISP return-of-compliance. And the HAL company certainly isn't going to be paying the costs.

CISP and PCI have improved the situation by mandating better security models. But when it comes down to liability, it's still a dog-eat-dog "whose ox is being gored" world of big business. Have a good lawyer.

Re:Misses the point -mod DOWN

[Prometheus Bob]

..And the issuing bank for that MC/VS card is somehow able to know automagically the moment someone's card goes missing? Your merchant processing agreement (MPA for those in the industry, the thing you sign to establish a cc processing acct) clearly states you take responsibility. An authorization is saying that there is enough money on the card - NOT that the person in front of you is who they say they are. That's why industry best practices are to verify the signature on the back when it's retail, check address if moto/ecomm, and check CVV if ecomm. If the signature looks iffy, the address or Card code is incorrect, you are to void the transaction and DENY that form of payment - That you don't is you taking risk onto yourself. And if it's credit card fraud, you were ripped off, that's not the bank's fault.

[sarcasm]
But don't listen to me, I don't work in the Credit Card Processing industry or anything.
[/sarcasm]

Re:companies do not need to hold on to detailed cr

[Anonymous Coward]

Ah, but you forgot about the part where two weeks later you call your credit card company and say, "I never bought this, I have no idea what this charge is for." The credit card company then calls the merchant and says, "The customer said they did not recognize this charge, do you have an invoice?" And the merchant says, "I delete 100% of all my customers credit card information, I have no way of looking up a charge to a specific credit card to give you an invoice." And the credit card company says, "Ah, don't worry, we'll just hit you for the full cost of the item plus a chargeback fee."

<sarcasm>Wow, it's REALLY in the merchants' interest to delete your credit card information the second they receive payment.</sarcasm>

Dumbass.

Supply and Demand

[Slashdot Parent]

Don't forget that prices are determined by both Supply and Demand.

Raising merchant credit card fees is a negative stimulus on supply (fewer suppliers, since it costs more to supply). Basic microeconomic theory would state that a constriction in supply would cause prices to increase and quantity supplied to decrease. To what degree depends upon, as you noted, "yada elasticity yada".

Say it with me "America isn't the world"

[Piazzola]

I don't know about the US, but here in Spain, you always have to show your ID if you're using a credit or a bank card. It doesn't matter whether you have signed it or not. I can't imagine just being able to walk into a store and hand someone a credit card, when the store has no way of confirming that it is yours.

AVS is even worse than that...

[adminstring]

I can run transactions through with my credit cards and completely wrong addresses, and still have AVS tell me as a merchant that the address matches the card's billing address. How is this possible? It's up to the issuing bank to compare the addresses, and many issuing banks, rather than doing the (easy, automated, computer) work, just tell you that the address matched when it's nowhere even close. Yet who pays if someone makes a fraudulent charge, even if the bank erroneously (or lazily) says the address matches? Not the bank... the merchant pays.

Golden rules of being a happy customer

[Anonymous Coward]

Here are my golden rules of being a happy customer:

1) If I do not like a place, I don't shop there.

2) If I feel a place does not like me, I don't shop there.

3) I always pay cash, except for 3 or 4 online purchases per year.
      I have a credit card for these online purchases, and I have individually
      negotiated a low limit on monthly transactions with my bank.

4) I never give out personal information to retailers unless I am 100% convinced
      that the database this is info will be kept in is secured against any sort of
      cybercrime by state of the art security measures.
      Currently, Rolodex data storage systems satisfy this requirement.

5) I do not use discounts or rebates of any kind

6) I do not shop at places that offer shady discounts or rebates, if I feel I
      pay for them or other customers are taken advantage of.

Maybe I am missing some of the "greatest deals" and "free offers" this way, but then, on the other side, I save up on a lot of worry and hassle.

Re:Misses the point -mod DOWN

[letxa2000]

Your merchant processing agreement (MPA for those in the industry, the thing you sign to establish a cc processing acct) clearly states you take responsibility.

I'm not disputing that that's what the MPA says. That doesn't make it right or fair anymore than the fine print in Microsoft's EULA is right or fair just because they decided to make it so.

An authorization is saying that there is enough money on the card - NOT that the person in front of you is who they say they are.

Obviously. This works great in card-present transactions. Over the Internet, though, the merchant is in even less of a position to know whether the transaction is valid than Visa/Mastercard. At least Visa/mastercard has access to the billing address, their computers can look at past history to see if the charge is unusual, etc. If they can't act as intermediary in card-not-present transactions, they shouldn't offer the service. Then all Internet merchants (and phone merchants, and those that bill credit cards automatically each month like cell phone companies) would look for a viable alternative REAL FAST. And there'd definitely be one real quick if Visa/Mastercard was no longer a monopoly.

Truth is, if that happened, Visa/Mastercard would be among the first to come up with an alternative because it'd be in their best interest to do so. The reason they don't know is because, like I said, they're a monopoly and are content to just screw the merchant. This is not sustainable and WILL eventually change.

Re:Misses the point -mod DOWN

[Prometheus Bob]

Truth is, if that happened, Visa/Mastercard would be among the first to come up with an alternative because it'd be in their best interest to do so The alternative is to verify the address/zip info and Mastercard Secure Code or Verified by Visa. The card code on the back of the card as well. I agree that ecommerce/moto transactions put a lot of the risk on the merchant, but it's the nature of the environment you're in.

often the customer pays

[Anonymous Coward]

They fail to mention that increasingly often the companies and merchants make the customer pay for credit card theft. I know several people in person who are still in legal battles against their credit cards companies who are trying to make them pay for fraudulent charges. Unfortunately they have some of the best lawyers and this is just another one of many reasons not to use credit cards.

Re:often the customer pays

[dollar99]

Another way the customer pays is when their credit rating gets knocked down several points because of the "fraud" note tacked on to the credit rating.

Re:Misses the point -mod DOWN

[letxa2000]

The point is that Visa/Mastercard aren't just saying "Internet is dangerous, you're on your own." They're essentially doing it for all merchants. Whether the card is present or not, Visa/Mastercard will charge back the amount in question if it is determined it was fraud. What if the card is present, you ask for ID, and the thief has an ID that looks valid and which matches the card? Then it's your word against Visa/Mastercard's and guess who is going to lose 10 times out of 10?

The current policies of Visa/Mastercard are unacceptable across the board. Arbitrarily holding the merchant responsible for all fraud is not acceptable whether it's an Internet or card-present transaction. As I've said, the customer is in the business of buying, the merchant is in the business of selling, and Visa/Mastercard is in the business of making some money facilitating the transaction. A customer is at risk because he can buy bad goods that could go bad at any time, the merchant is at risk because he can get sued by a customer or, in the case of brick and mortar shops, they can be held up. There's risk all around. The only one that's completely insulated from risk is Visa/Mastercard when, ironically, they're the ones with the deepest pockets and yet they don't even share the risk for the part of the transaction that they are involved in.

Like I said, it's unacceptable. It's a monopoly that's abusing its power exactly as a monopoly or cartel usually does.

Re:companies do not need to hold on to detailed cr

[CanadianBuck]

They don't need the whole CC number and exp date for that, do they? You name, and approval number should do. That will take them to your invoice.

Re:You'd think the same with cleared checks, but n

[Worldwatcher2u]

Anybody that accepts a third party check of any kind is asking for trouble. Red flags everywhere. Read the damm check, a Cashiers Check is not what you think it is.. not a guarantee that the check is "good".

Re:Misses the point -mod DOWN

[Worldwatcher2u]

You dont even have a clue. I worked credit card fraud for years, you don't even have a clue as to what is really happening. The fault is with the CC company, the merchant and the person who had it stolen from.

Remember Secure Electronic Transaction?

[plover]

This is my biggest frustration with PCI (and Visa.) In the mid 1990s Mastercard introduced a protocol called Secure Electronic Transaction (SET). It was exactly what you requested above -- a better system. It completely defined a standard for strongly encrypting the cards at the terminal. The encrypted authorization and settlement data could be safely carried throughout a merchant's IT network and other systems. PCI as we know it would be reduced to its subset of physical tamperproofing requirements, and retailers would never have been in a position to leak account data.

It bombed for a couple of reasons. First, it made heavy use of public key cryptography, and on the CPUs of the day that sort of encryption would have slowed each credit transaction by at least three to six seconds. Second, the merchants didn't like it because it was complex and very large, producing authorization message sizes ten times larger than anything they were used to (and thus ten times slower over their over-burdened networks.) But the most important reason it bombed was that it rendered Visa irrelevant. SET made authorization transactions so strong that they could be passed securely and directly to your bank, even over the public internet. There was no need for the data to flow through the consolidating and percentage-skimming hands of a Visa provider or a secured network, because the data blobs were securely armored.

The first objections above could have easily been overcome by Visa. For at least the last 20 years Visa has been strong-arming retailers into installing new systems and upgrading hardware through the threat of rate hikes. Do you think the retailers wanted to install expensive mag stripe readers back in the 1980s? They didn't want to spend the money, but they didn't want to have their rates jacked up by an extra percentage point either. Virtually every other Visa "innovation" (such as 3DES and PCI) has been introduced with the same strong-arm tactics. So if Visa wanted SET to succeed, they would have simply threatened another rate-hike to non-compliant merchants. But since no such threats came down, SET withered quietly away.

So all these credit-card leaks from various merchants over the last ten years could have been completely avoided except for the deliberate interference of Visa. Think about that.

Don't be a Dick.

[Anonymous Coward]

It's really even worse than you portray it. Yes, the merchant has to eat the cost, but it's worse than that. Let's look at a simple example.

Merchant sells widgets for $100 at a gross profit margin of 20% (i.e. the cost of goods sold is $80). Let's say someone fraudulently purchases one of his widgets, which results in a chargeback of $100 to the merchant. The merchant is also out the $80 he paid for the widget. What this means is, the merchant now has to sell an additional 9 widgets to recoup the cost of one fraudulent transaction, before he makes a single penny to pay rent, utilities, payroll, and put food on the table for his family.

With smaller profit margins common amongst small merchants, the problem is compounded. At any rate, chargebacks are devastating to small business.

I don't give a flyin' flippin' fritatta that requiring ID is against the MC merchant agreement. When it comes to fraud, MC doesn't care, and the issuing bank and acquiring processors don't care either - they're still making bank on the interchange fees. The merchant is ultimately responsible, and if the merchant wants to takes steps to protect themselves from fraud, even if it disagrees with some agreement of dubious legality, I'm all for it.

I work in the Credit/Debit card industry, and it is my opinion that the merchant agreements are made under duress. You agree to the Visa/MC rules, or you don't take Visa/MC credit/debit cards - and if you don't take plastic, you probably can't compete.

So to the GP - go ahead. Threaten the merchant with a complaint if they insist on ID. Threaten their livelihood.

It is, after all, your birthright to be a dick.

duh...

[Anonymous Coward]

Honestly, it's the way it should be, though the credit card companies need to do some work too. I've had fraudulent charges go through without a hitch that didn't have the right name or security number, so basically somebody just put in a random number and name and it still went through!

billing zip codes

[artifex2004]

I don't quite get how he was getting the billing zip codes, which are usually required, or anything else.

Certain stores have started asking for zip codes for AmEx cards, to 'help protect you.' That's Wal-Mart, Target, many gas stations, etc. Other stores, like Radio Shack, Micro Center, and Fry's, try to create buyer profiles of customers, so they will ask for your name and information when you buy stuff. Sometimes they claim it's mandatory for things like rebates.

Anyway, I'm sure most of us just give the zip code if asked. And we're used to salespeople looking at the backs of our cards, too, so someone can easily memorize the 3 or 4 digit number in the time it takes to pretend to look at the signature.

Protection From Frad Online

[Variable12345]

Internet merchants do have fraud protection options available to them. Any merchant being hit by a large number of charge backs should explore 3DSecure: http://www.cardwatch.org.uk/spot_and_stop/html/3ds ecure.htm?display=html http://www.visaeurope.com/merchant/handlingvisapay ments/cardnotpresent/verifiedbyvisa.jsp http://www.mastercard.com/us/personal/en/cardholde rservices/securecode/index.html When setting up with your payment services provider you should find out exactly what services they provide to help protect you from fraudulent transactions. Card holder address verification and card verification code/number (those 3 digit numbers on the back of your card) checking will help reduce the number of bogus transactions that get through 3DSecure will allow you to shift liability for charge backs from yourself to the bank.

You are Wrong

[Slashdot Parent]

I have written on my credit card "Please ask for ID" instead of a signature. While technically not "allowed," I'm surprised at the number of places I've gone that haven't bothered to notice no signature and never bothered to ask me for my ID.

If the merchant was following the rules strictly, they would reject the card outright no matter how many IDs you show them and no matter how much you beg and cry and plead.

Signing the back of the card is not some sort of signature verification, as though the pimply-faced, $5.50/hr, checkout clerk is somehow some sort of certified signature expert and can verify that the faded, washed-out signature on the back of your card matches the receipt you just signed. Signing the back of the card says, "I have read and understand the terms and conditions for use of this card, and I agree to them."

Unless your John Hancock really looks like "Please ask for ID", then your card is invalid and should be rejected as such.

Medical Insurance

[Anonymous Coward]

It's the same way with medical insurance. Some companies are more reliable than others.

Just the other day I had some company demand refunds for patients seen in 2005.

Re:companies do not need to hold on to detailed cr

[MoneyT]

Here's a couple perfectly valid reasons why a merchant might want to hold on to such information:

1) Transaction history for research (chargebacks, billing disputes, tax purposes, etc)

2) No reciept returns. "No reciept, no problem, if you paid with a card, I can look that reciept up here."

3) Catching fraudulent returns. I once caught a guy who was trying to return stolen merchandise for cash, the way it worked was he returned a stolen item for store credit, and picked up a slightly more expensive item, he paid for that with his debit card (cash equivilent transaction). He would then head to another store in the chain and attempt to return the item for cash back, insisting that he had bought the original (stolen item) with the debit card he paid the difference on. A quick transaction check shows a few months of small purchase large return transactions on this card, and no original purchases. A little bit more digging shows no original purchases associated with this customer at all. The end result is fraudulent transactions are stopped and a shop lifter is uncovered.

While #3 certainly isn't common, #2 and #1 are common enough that I see many merchants being perfectly justified in storing such data. I also see the public being justified in holding that company liable should such data be compromised.

Brainless

[Slashdot Parent]

Credit card companies are branches of banks

Extremely misleading--borderline falsehood. True: credit card issuers must have bank charters, but there is no requirement that they participate in retail or commercial banking. Also true: There has been consolidation in the monoline credit card industry, such that there aren't any more large monoline credit card issuers, but that was not always the case. Before 2004 or so, MBNA, Capital One, and Providian were the third, fifth, and seventh largest credit card issuers (respectively), and were monoline. MBNA and Providian were bought, Capital One decided to go into retail banking and bought some branch banks (they offer deposit accounts, auto loans, etc. now) My point is, credit card companies are not automatically branches of large banking conglomerates.

They are affiliated, strongly, with insurance and investment companies.

That's sort of true for AmEx, and B of A (if you really want to consider them investment companies... they are certainly bottom tier in that department... and B of A offers some insurance, but is certainly not a major player), but what about Capital One? What's in your wallet, man? ;) (just a little joke... I know who ya are)

Just as any other large corporation when one division suffers a loss then, in nothing more than the ledger book, the losses are distributed amongst the other divisions.

That is really out of touch with reality. Most large business groups do not keep poorly-performing lines of business open for long. They tend to be more focused on profit, not shunting losses among divisions.

Think about that next time the interest rates on home mortgages goes up, or the premium on the insurance plans, or when the quality of service for medical insurance goes down, or when the price of motor fuel goes up...

Pure tinfoil hat thinking. Plain and simple. A company isn't going to bleed losses in one LOB just because another is profitable. And credit card interest rates have zero to do with the price of gasoline in China.

These things happen because the businesses are recouping losses. Why are credit card rates so high?

Credit card interest rates are high because credit risk is high.

Think about it. Let's say you charge up $5,000.00 on your credit card. You get a bill from MBNA/Bank of America/WhoeverOwnsThemThisWeek for $125.00 (2.5% of your outstanding balance is a common minimum payment). At this point, you have three options:

1. Pay the $125.00. Result: you get a bill next month for $123.75. Rinse, lather, repeat.
2. Pay more than $125.00. Result: you get a bill next month for less than $123.75... or $0, if you paid off your entire balance. See option #1.
3. Instead of sending money, you send a letter to your bank instructing them to go pound sand. You're not paying. Result: They'll call you. They'll yell at you. They'll tell you you owe them money. They'll demand payment. They'll call you nasty names. But in the end, the loan was unsecured, so they are basically up a creek. Their only recourse is to sue you and then attempt to collect. The average amount collected is higher than the average collection costs, so they generally don't even try unless you owe tens of thousands of dollars

What does that have to do with the price of tea in China or the interest rate on your credit card? Because the CC company's only recourse if you decide not to pay is to make menacing phone calls (until you realize you can just tell then to quit calling and they are required by the FDCP Act to stop), they have a ton of losses. That 18% interest rate you pay is to cover the fact that the CC company is taking on an enormous credit risk.

That's why mortgage rates are so much closer to the prime rate. Very low credit risk. You no pay, bank take your house and you wind up homeless in la jolla. End of s

Are you kidding?

[Slashdot Parent]

If you buy milk and bread on credit, you may have bigger issues.

Paying for groceries with a credit card is fast, alleviates the need to carry around large amounts of cash, and gives me 5% back (on grocery store purchases).

Why would I not pay for groceries with a credit card?

And why are you holding up everyone in line by paying with a check? It's not 1982 anymore, buster.

Make the time

[Slashdot Parent]

You're spinning your wheels. You can read whatever you'd like, and they can print whatever they'd like, but none of it holds any water if it's not legal in the first place.

MasterCard has hired a small army of lawyers to write that agreement and they have refined it over time based on their experience defending it in court.

Do you really want to bet your "I don't know how valid it is" position against MasterCard's army of lawyers who say it's valid?

More importantly, Do you really want to pay your own lawyer, your own court fees, and possibly MasterCard's legal fees, for the privilege of asserting your "I'm not sure if it's valid" defense against a time-tested, professionally-written agreement?

From one small business owner to another, I'll advise you to read what you've agreed to and abide by it. Ultimately the choice is between you, MasterCard, your attorney, and your attorney's children who you will put through college with all the legal fees you'll be paying.

Re:companies do not need to hold on to detailed cr

[CanadianBuck]

You still do not convince me that they need the whole credit card number and expiry date to do what you are saying.

The persons name, type of CC, approval number, and last 4 digits of the CC.

If a hacker were to steal that information it would be of no value except bragging rights.

IF the merchant needs more DATA than that they can ask for it from the merchant bank. Especially for chargebacks. The Credit Card company would provide all the data for that, just like a bounced check.

I'm sorry for your loss

[Slashdot Parent]

Ok, your situation is solvable. Here are the steps that you can take:

1. Stand back, take a deep breath, and look objectively at your situation.
   
2. Admit that it is entirely your fault and that you are not a victim. You agreed to pay 16% interest on that credit card. You bought more house than you could afford. You failed to maintain sufficient liquid savings for emergencies. You charged that plane ticket. No corporation is out to screw you--you screwed yourself.
   
3. Admit that only you can fix this problem. You created it, now you need to fix it.
   
4. Call your credit card issuer and ask for a lower interest rate. Let them know that you are in financial dire straits and that you have been advised to declare bankruptcy. That's not lying--I'm advising you right now. (Don't really declare bankruptcy!)
   
5. Search online for a credit card with a lower interest rate. Check bankrate.com, google, and the other usual suspects. Try to find one that also has free balance transfers. With an 800 FICO, you'll qualify for any card.
   
6. Can you pay off that ticket within a year or six months? Get a card with 0% on balance transfers as a teaser. Do not charge anything else on that card! You have been warned. DO NOT DO IT. That will be a very expensive mistake.
   
7. Can you borrow the money from a family member at a more favorable rate? I mean, it was for grandma's funeral.
   
8. Most importantly, convince yourself that when you agree to something, and when somebody holds you to your agreement, you are not being screwed. You are being treated fairly. Don't agree to something that you find..well.. disagreeable. :)

Again, I'm sorry for your loss. Just keep a clear head and you can solve this one, ASAP.

Good luck!

Re:I'm sorry for your loss

[teflaime]

Yes, Mom:P.

IMNSHO.. You are pussies who deserve it.

[ClioCJS]

If you don't fight the problem, you are part of the problem. They just made $2.5K off your laziness. This encourages them to continue to act like this. You aren't helping yourselves or anyone else. In fact, if that is your attitude, you more or less deserve it.

I'm not nice.

Re:IMNSHO.. You are pussies who deserve it.

[king-manic]

The problem is it's set up so that a "win" still is as much of a loss as the current situation. A lose would double our loss.

Re:IMNSHO.. You are pussies who deserve it.

[gatesvp]

Um, the "Loser pays" system in Canada does not apply to small claims court. Nor is the "Loser Pays" system automatic, it's just more commonly used here.

The deal is, you have the documentation to back you up. If it has been less than 6 months, then you're likely still in range. The entire process will take approximately 1-2 days (8 to 16 hours) and you have $2,500 on the line (so that's worth two days isn't it?).

All you have to do is go to small claims court and fill out a few forms. There are no lawyers, just you, the defendant, the judge and your papers. What's more, if someone from VISA doesn't show up, it's an automatic victory and VISA owes you the $2,500, so now VISA (who screwed you) has to spend a bunch of their time just to keep their money. In a case like this, there is simply no way that VISA can demand double damages from you.

Think of it this way. You can put in 16 hours of work (or less) and get 2,500, that's like $156/hour. Seems worth it.

I'm lazy, so I'll ask you.

[ClioCJS]

Is it the same as Visa? Because they just replaced my MasterCard with a Visa...

Re:Misses the point -mod DOWN

[Prometheus Bob]

The person is committing credit card fraud, and IF he pulls one over on you, all MC/VS is saying is "look, it's not the issuing bank's fault, and it's not the customer's fault. We weren't told this was a stolen card until 2 days later...and you could check if it was him. Did you get a signature? Did you verify it's the same as that on the back of the card...etc"

If someone gives you counterfeit/stolen bills you don't go "damn that US currency! If only it wasn't a monopoly!" It's not MC/VS fault this happened with the card. The only person that can check the signature is you. If it doesn't match up, void the transaction and ask for another form of payment. If they give you stolen money to pay for that big screen tv, that'll be taken back for the original owner too!

It's up to the merchant at that point to follow up against the person that commited fraud against them. It's not the cardholder or the currency maker (MC/VS in this case) fault.