When Fraud Detection Shuts Down Credit Cards Inappropriately

reifman writes: On Sunday, Capital One declined a $280 travel reservation I charged at India-based ClearTrip.com and immediately shut off my card for all transactions until I contacted them by phone. It wasn't the first time that CapitalOne had shut off my card after a single suspect transaction. But, I'd actually purchased from ClearTrip.com using my CapitalOne card on two prior occasions. It was an example of very poor fraud detection and led me on a tour of their pathetic customer service. The banks want to cut their losses regardless of how it impacts their customers. Having had my own credit card suspended out of an abundance of caution on a different credit card issuer's part (for legitimate charges), but having recently had some widely known scam charges get accepted, the fraud protection algorithms that the credit companies use certainly seem inscrutable sometimes, and so do the surrounding practices about communicating with customers. How would you like it to work instead?

Comments

Thanks

[Anonymous Coward]

Thanks for the article, it reminded me to pay off my credit card bill.

This is why you call your bank before tourism

[GoodNewsJimDotCom]

If you're going to make out of the ordinary purchases for overseas, or travel overseas, you always want to call your bank ahead of time. This is a standard operating procedure, and nothing to complain about on Slashdot.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Well, but there is still a point here. For example, I have had a couple of occasions of fraud on my account - they both happened when the "accounts got out" (massive breach of the credit union's credit card file). The first racked up three charges for $900.00 in Japan The next was a flight in India (in rupees) that came to well over $1,000 plus the foreign currency conversion fee. However, I have had the same card processor block the card and deny the purchases when I made two orders Newegg.com in the same day. The "fraud detection" is completely broken.

Re: This is why you call your bank before tourism

[Anonymous Coward]

Also calling ahead before big purchases. I've found that the fraud teams at both Juniper Bank and TD are great. Tell them what you are doing and it sales (pun) though. They are even able to manage watching for online purchases that are made.

If something happens I've had them overnight my new card so it hasn't been a big deal.

I'd rather them be cautious vs waiting too long.

Re:This is why you call your bank before tourism

[Anonymous Coward]

I never do this with my Amex and never had any problems. You get what you pay for (or in this case not pay for).

Re:This is why you call your bank before tourism

[Anonymice]

Except that it seems not all banks accept that. I tried to warn my bank when I was going travelling for a year & they said the only thing they could do was put a note on my account - that would only be seen when I phoned up to complain about my card being blocked! Completely fucking useless.
In the end I had to just call my bank over Skype after every other transaction, to get them to unblock it again.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Did the whole "calling before" a trip to Canada. Bank stopped a transaction for food in a shop and rang my home (in another continent). Luckily, someone (son) was house sitting and able to confirm where I was.

Re:This is why you call your bank before tourism

[Anonymous Coward]

As a frequent traveler... that is not true. I travel all over the world all the time(30 weeks a year) and never get fraud stops on my cards in any of the other states or countries I go to and only once in 5 years have been skimmed. But the last 3 times I have had my cards blocked has been within a 10 minute drive of my home.

Re:This is why you call your bank before tourism

[Anonymous Coward]

It's fraud detection, not fraud prevention

Re:This is why you call your bank before tourism

[Anonymous Coward]

Great advice. Unfortunately, in my experience, advance notification will not solve the problem.

Slashdot is an appropriate forum to discuss the constant failure of fraud protection technology.

Bank of America refused transactions in Canada and Alaska after advance notification. They did happily honor a clearly fraudulent transaction from Mexico. When I reported the fraudulent transaction, the agent replied, "Oh, we get fraudulent transactions from Mexico all of the time." FAIL!

Bank of America refused my ATM transaction in England after advance notification. FAIL!

Citibank refused transactions in Alaska after advance notification. They claimed no declined transaction when I call their helpless desk. Their story changed at 5:00 AM the next morning when they called to check the very transactions that were the subject of my inquiry the prior evening. FAIL!

In summary, fraud prevention, in my experience, is a fraud.

Re:This is why you call your bank before tourism

[driblio]

They process billions of transactions a day. Thousands of them are fraudulent. Occasionally they get some wrong. But they do an amazing job - which is why you very rarely find out about fraud for the first time when it shows up on your bill. Most of the time, you never know about it at all. It is far from 'completely broken'.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Y'know... comments like these should be an addendum to the summary.

Re:This is why you call your bank before tourism

[Anonymous Coward]

That's true, but you'd be surprised how often you have to dig to know whether or not a company is foreign. I backed a Kickstarter a while ago and was shocked to find that there was a foreign transaction fee assessed on the payment even though I live literally miles from Amazon. It turns out that they don't process payments for Canadians in the US and don't bother to disclose it either.

Yet another reason to not use KS.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Sort of. Most of the time the thieves will try a small test purchase to see if the number is good before they buy something expensive. In cases like that it's both fraud detection and fraud prevention.

But, Capital One tends to be rather aggressive about it. Buying too many things online, or from foreign places tends to get things tripped. I think PayPal is the only processor I've had that's more aggressive about it than Capital One. And PayPal makes it incredibly inconvenient to undo their protection if they make a mistake. I can flag a payment as fraudulent, but I can't flag a payment as valid. And they'll take the money back from the vendor before even bothering to check to see if it's appropriate.

Re:This is why you call your bank before tourism

[Anonymous Coward]

They trained you well.

No, you DONT need to check with the bank just because they're too incompetent to add appropriate safety measures.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Spending 10-20 minutes on the phone just to prove that the purchase is valid.... So if i'm going shopping and do a few impulse-buys i'm supposed to call the bank before each transaction? No thanks... There is an easy solution for this, that's been in use for quite some time here in Sweden (and other EU countries)

The solution here is to only use cards with a chip + a PIN for validating..
Using it with a signature does not really add anything.. Have myself paid more than $1000 during visits to the US, no ID or passport check and nobody even checked the back of the card to compare the signature.. But how hard is it to overlay a new strip of something to sign on the back..

The current security i have with my bank for online-transactions:
My Debit-card -- Whenever i'm doing a purchase i receive a SMS with a code, that i have to enter in the online-shop, for the payment to be accepted.
My Bank-card -- Whenever i'm doing a purchase the bank will present a preset string i have set myself (so i can validate the bank) and then i will have to type in a password for the purchase to proceed.
Direct-payment from my account (only available on some pages) -- Here i use my normal bank OTP pad to sign the transaction on the actual web-page of the bank. (Ie. instead of getting directed to a VISA payment at checkout i get directed to the bank)

I would really love the time when we have NFC or card-readers in all laptops / cellphones etc and no magnetic strip on the cards.. Online or offline we would use the card to sign a transaction.. As long as nobody physically steals the card, or possibly manage to clone it, false transactions should be at a minimum..
On top of that add support for secondary verification where a phone / TPM-chip in the laptop / yubikey would also sign the transaction..
For something like the above the paymentprocedures would be something like:
Less than $50:
Swipe card. Enter PIN - done
$50 to $500
Swipe card. Enter PIN. Swipe phone/yubikey and enter PIN/passphrase.
$500 and up
On approved laptop: Swipe card. Enter PIN. Swipe phone and enter PIN.
On non-approved computer: Swipe card. Enter PIN. Swipe yubikey or similar and enter passphrase.

To reduce abuse in stores you could store a photo of yourself on the phone (signed by the bank and mapped to your card.) that would popup on the register and matched with the card you are using. No need for the bank to store your photo here so no privacy-issues.... Also allows the bank to issue a list of revoked photo's as a list of checksums that can be stored locally in stores (32-bytes per revocation would allow storing 1 billion revocations in 30Gig + index so say 35GB)...

None of these solutions require a internet-connection so if the ATM or shop is offline they can still choose to approve a transaction offline.

* In above examples i'm talking about the version of the yubikey that have NFC and smartcard-emulation to allow encrypting/signing messages. I'm not promting yubikey and there are many, better, versions but this was the product i could remember at the moment of typing this.

Re:This is why you call your bank before tourism

[spire3661]

Bullshit. I had my card suspended because i sent $2.50 over paypal to a kid in the UK for some software. I went to get groceries later at my normal store and card declined. I was livid beyond belief. There is no excuse for that kind of incompetence over trivial amounts of money. Banking is based on trust, not ultimate security, having too sensitive fraud protection is not helpful to anyone.

Re:This is why you call your bank before tourism

[Anonymous Coward]

I have actually had the following happen (all with CapitalOne):
  - Reported I was traveling and had my card still shut off in the country I reported travel to.
  - Reported travel and had my card fraudulently charged in my country of residence but location I have never visited (I think it was a gas station or convenience store).
  - Received spurious fraud warnings in the country I live.

It seems a simple rule-based check would have been better:
  - Do all charges > $N originate in the same country for a given day?
  - Have you ever had a charge in that state?
  - Does the business making the charge require a physical presence or not?
  - Has the customer requested an exception from any rules/policies?

I chalk it up to just poor implementation/laziness/poor outsourcing that is endemic of banks. Still, it makes you cringe to think about the fact that these organizations are guarding our capital.

Re:This is why you call your bank before tourism

[Martin Blank]

Both of my frequent flier-linked cards have expressly said that there is no need to call and notify them. It doesn't really change much aside from them adding a note to the account which may or may not be read by the fraud investigator--if there is one. Every time my cards have been blocked, it's completely automated, and the programs aren't likely to examine notes left in the account.

Re:This is why you call your bank before tourism

[Martin Blank]

My experience with Citi matches yours, but Chase seems to be on their game. Fraudulent transactions have triggered notifications within minutes of the transaction taking place, and they're very pleasant and professional when I call to discuss them.

Re: This is why you call your bank before tourism

[Anonymous Coward]

As someone who works in a buisness that does this sort of thing, I can say that you are spot on. Fraud detection and prevention happens constantly. Multiple times a second. 1 in every 5 people have had an attempted fraudulent charge stopped by these systems. And credit card fraud isn't the only type of crime these frausters perpetrate. Wire fraud and identity theft are on the rise and are becomming more and more of a problem as the US gets closer to their pin-and-chip deadline.

I don't know why they've stopped issuing new cards. If I took a wild guess, I would say it's because the fraud detection rate is so good that fraud is stopped it before any damage could be done. As a result, the customer is none-the-wiser and continues to buy things they can't afford.

Re:This is why you call your bank before tourism

[whoever57]

If you're going to make out of the ordinary purchases for overseas, or travel overseas, you always want to call your bank ahead of time. This is a standard operating procedure, and nothing to complain about on Slashdot.

Doesn't work.

I travel to the same country about once per year. I call my credit card company in advance and usually, I can make one purchase in that country and after that, my card is blocked.

Sometimes, I even get a fraud warning txt for a small purchase in a US airport where I have a stopover. The tickets were bought using the same credit card, so the card company knows that I will be travelling (as well as my call to warn the credit card company).

Re:This is why you call your bank before tourism

[DERoss]

I have two Visa cards from my credit union. One I rarely use other than for purchases via the Internet; that one sits in my desk at home. The other Visa card I carry with me.

I always call my credit union before traveling. This past summer, we visited out daughter in Saskatoon, Canada. Going, we changed planes in Edmonton with a long layover. Returning, we changed planes in Calgary. Before the trip, I called my credit union and gave them the dates of travel and the three cities I was visiting. Treating my daughter and her family to dinner in a nice restaurant, the Visa card in my wallet was rejected. We had to use my wife's Master Card, for which I also called the bank before traveling.

Back at our hotel, I called my credit union. They had entered my "vacation alert" into my account only for the Visa card that was still sitting in my desk in California. During this phone call, they added a "vacation alert" for the Visa card in my wallet.

Interestingly, we traveled in France earlier in the year. For that, I also called my credit union and bank about my travel plans. I used the Visa card I had in my wallet and my wife used her Master Card, all without any problems.

Also, my credit union occasionally calls me about very large Visa charges when I have not even left southern California. Frankly, I am happy that they are monitoring my account. Once my pocket was picked in Washington, DC. My Visa credit limit was totally consumed in the three hours between when I last remembered handling my wallet and when I reported the theft to Visa. It took one day to get a replacement Visa card but several days to restore my access to the account, something I hope the current monitoring procedures would prevent.

Re:This is why you call your bank before tourism

[rossz]

Ditto for me on Chase. They've caught real fraud quickly and got me a replacement card within a week. They've also made it very easy to authorize transactions that trigger their system (large purchases somewhere you've never shopped at will do it). You get a text message on your cell phone that you reply to then ask the shop to try again.

Re:This is why you call your bank before tourism

[brianwski]

> The "fraud detection" is completely broken

I absolutely agree. They have THE WORST programmers/statisticians working on this.

How about adding a simple two-factor authentication? Instead of rejecting the payment outright and freezing the card, text message my phone IMMEDIATELY and I can read a 6 digit code to the cashier to allow the transaction. It isn't perfect, but that one simple step would make it about 90 percent better, more secure, and cut down on false positives. I swear this would increase customer satisfaction and increase the amount of money the credit cards make because they would then accept a higher number of legitimate transactions. What is wrong with that industry?

Re:This is why you call your bank before tourism

[o_ferguson]

It's even worse than that. I've had legitimate purchases through eBay where, when I contact the seller after winning the auction, they say that they are refusing the sale because they thing something about my account may trigger Paypal's fraud protection. I pay the money, and they refuse to accept the paypal transfer, and refund it, because they don't think I'll pass Paypal's fraud protection.

Re:This is why you call your bank before tourism

[Anonymous Coward]

> This is a standard operating procedure

Hahaha, what? No it isn't. That's absolutely retarded. I'm not going to tell my bank what I'm about to do with my card just because their software is shit.

Re:This is why you call your bank before tourism

[geekmux]

If you're going to make out of the ordinary purchases for overseas, or travel overseas, you always want to call your bank ahead of time. This is a standard operating procedure, and nothing to complain about on Slashdot.

Nor should this be a problem for the consumer, or a burden to call "ahead of time".

Let me put this another way. Would you think it normal or necessary to contact your ISP ahead of time should you choose to start surfing secure websites outside of your country?

The burden of securing transactions should be within the framework that provides it. I sure as hell don't have anything to do with the bank vault security guard hours at my chosen financial institution, or anything to do with a banks security. It should be no different here.

Re: This is why you call your bank before tourism

[Zen]

Agreed. This was my very first thought. Then I read the actual article and had to laugh. At no point did he mention that he called capital one prior to making international purchases. I always do this for my card companies. I hope and expect that my credit card companies would flag every international purchase, as well as super high dollar amount store (not online) purchases in states I do not live in or visit frequently. It's desgined to detect fraud. It's not fool proof. I expect that the fraud rate for international charges is pretty high for people that travel infrequently (meaning that with a person that travels once a year or so, if there is an international charge there is a good chance that it is fraud). Why wouldn't you take the 5 minutes it takes to call in and tell them you're traveling to x country on y dates? I do this with all three of my credit card companies. It doesn't take long. I don't have capital one, but I can't imagine it's that hard.

Then he purposefully contacted capital one in a non real-time method, and lo and behold he had problems with it. He tried online chat, twitter, and maybe something else that I don't recall before finalling resorting to the only fool proof tried and true real time contact method - using a phone! Pretty novel idea for when you want assistance that you should talk to someone.

It appears that this guy either wants people to feel sorry for something he brought on himself (didn't let the company know he would be purchasing internationally), or he wants to drive hits to his blog for some ulterior motive.

He had a bad day and wants someone to feel pity for him and agree with him, and he's dragging capital one down at the same time (they did nothing wrong other than customer service was slow for the non phone options).

Re:This is why you call your bank before tourism

[bitingduck]

If you're going to make out of the ordinary purchases for overseas, or travel overseas, you always want to call your bank ahead of time. This is a standard operating procedure, and nothing to complain about on Slashdot.

Which kind of defeats the purpose and convenience of having a credit card.

It's also generally not necessary - I've gone on foreign travel on short notice and had no issues with my card, and even gone to some pretty unusual places and used various cards with no issues (the most difficult was that the card I prefer to use for travel didn't have a chip in places that were chip only). The only false positives I've had that turned the card off have been when I went to buy gas at a particular gas station in Montreal before return rental cars. It happened more than once because it was about a mile from my partner's house there. The same card provider has reliably caught a number of real positives, and their email/text system now works fast enough that other false positives get caught before they turn the card off.

Re:This is why you call your bank before tourism

[Archfeld]

BofA's viper system is really bad. I called both the bank and cardholder services, as well as opened a Lloyd's of London account and still encountered several refusals, having to call and confirm the note that I had already left with specific itinerary. I just started using my Amex and had no issues from that point on. What is the saddest is that after having returned home BofA refused a local charge because the previous charges had been in GB. They were quick to correct the issues when I did contact them though, and getting ahold of a customer service rep was fast and easy.

Re:This is why you call your bank before tourism

[Geoffrey.landis]

For example, I have had a couple of occasions of fraud on my account - they both happened when the "accounts got out" (massive breach of the credit union's credit card file). The first racked up three charges for $900.00 in Japan The next was a flight in India (in rupees) that came to well over $1,000 plus the foreign currency conversion fee. However, I have had the same card processor block the card and deny the purchases when I made two orders Newegg.com in the same day. The "fraud detection" is completely broken.

Isn't it likely that they blocked the new egg purchases because the account was hacked and previous purchases that day were fraudulent?

Closing the barn door after the horse got out-- but there may have been other horses in the barn that could get out.

Re:This is why you call your bank before tourism

[bitingduck]

I've had similar experiences with Chase. Once they caught someone buying a big screen TV from walmart.com on Dec 27. I was off on a multi-day bike ride and happened to check my email during a break and it had an email asking if I spent $2700 at walmart.com. A short phone call later and a new card was being fedexed.

Another time I did several legitimate but commonly fraud related transactions one morning (new cell phone, some software purchased by phone, a couple other things I don't remember) and they called me. It wasn't any of those that had alerted, but a $9.99 charge from some anonymous sounding company that's some kind of default name for whatever tool the fraudsters were using. A few minutes later the card was cancelled and a new one on the way.

The current method with text/email confirmation on potentially sketchy charges works well and quickly.

Re:This is why you call your bank before tourism

[JustAnotherOldGuy]

If you're going to make out of the ordinary purchases for overseas, or travel overseas, you always want to call your bank ahead of time.

I do, and they still freeze it. I call the bank and CapitalOne, and they still freeze the card. This has happened to me about 10 times in the last 5 or 6 years, regular as clockwork.

Re:This is why you call your bank before tourism

[Applehu Akbar]

Always contact the bank before you travel with Visa or MC. American Express is designed for travel, so you don't have to notify them.

Re:This is why you call your bank before tourism

[mspohr]

I did this with my Bank of America VISA card. Called them and told them dates and places of travel.
They still blocked my card the first time I tried to use it.
They are clueless. I cancelled the card.

Re:This is why you call your bank before tourism

[Applehu Akbar]

"In the end I had to just call my bank over Skype after every other transaction, to get them to unblock it again."

Get Chase.

Re:This is why you call your bank before tourism

[Macman408]

Maybe because it's not uncommon to test a stolen credit card with some trivial amount first, before making a huge purchase with it. That, combined with it being foreign, probably triggered the fraud alert.

Maybe it's obvious, but if you're having bad experiences with your bank, maybe you should... try a different bank? I can recall only a few instances where my bank has suspected fraud, and they've always called me before my card was deactivated. Once was when I moved halfway across the country, and I spent $350 at Target for random housewares - while I was loading the bags into my car in the Target parking lot, my bank called to make sure it was me. On the other hand, I've travelled to a number of different countries (often without notifying the bank), and I don't recall ever having a problem with my card.

I'll take a stab in the dark, and say it's because my card is through a large but local credit union, where they actually care about individual customers. I think the huge national outfits tend to care about customers in aggregate - if they can offer a better deal than everybody else (e.g. more cash back, or a "double" rewards card), then it doesn't matter if they lose you as a customer - they'll pick up two more to replace you. But that means that to maintain their margins, they have to catch fraud with a much higher false positive rate, because they can't afford any loss.

Re:This is why you call your bank before tourism

[Anonymous Coward]

It depends on the card company.

I have two Visa cards that I cannot use at all. As soon as I try to use it, it is suspended and then they send me a new one. When I try to use the new one, the same thing happens. So I gave up.

My Amex card is fine and I can use it anywhere in the world.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Fraudsters use small amount online transactions to test card functionality. There is an entire economy of buying card numbers (presumably from breaches) and either making counterfeit cards or testing them for validity, and then selling filtered lists for a higher price.

The models are not by any means omniscient but every behavior is determined 100% by empirical data comparing fraud and non-fraud transactions of similar types.

There is still a significant amount of fraud uncaught by systems or let to pass by the banks for fear of affecting too many legitimate customers.

Operational departments of banks can override the models and insert their own rules which may be helpful or harmful. There are significant differences in the business performance, operational efficiency and customer service between different banks, even when they use the same fraud detection model.

Re:This is why you call your bank before tourism

[stevel]

Another Chase fan here. Just after I arrived in Ireland for a two-week vacation this past May, I get a notice from Chase that they're canceling my card due to (actual) fraud and sending me a new one. Except that I was depending on the Chase card while I was in Ireland. Their CS was extremely helpful and suggested a setup where they'd authorize card-present transactions while I was in Ireland but block others (unless I explicitly authorized them.) (And then I was embarrassed when my card was declined in Ulster, but that was my fault because I wasn't in Ireland anymore - and they had asked what other countries I would be in.)

American Express has also been good about fraud detection and alerting me instantly, though on a previous European trip I noticed a whole slew of bogus charges to my card using a number that had been canceled two cards ago. Their explanation was that if it came through a processor that had done a valid transaction before (which had been the case), they'd let it go. No big deal to get it taken care of.

Re:This is why you call your bank before tourism

[demonlapin]

Chase really has wonderful service. Card declined? Call customer service, it immediately rings to an American call center with people who have the authority to fix your problem. Five minutes later, the transaction goes through.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Not all banks are this horrible. Switch to another one.

As long as you keep your money with them they will never change.

Re:This is why you call your bank before tourism

[brxndxn]

This would probably fix 99.99% of all credit card fraud.. Will they do it? I doubt it. I swear there is somehow a business in allowing certain fraud. If there wasn't, the credit card companies wouldn't be so shitty in preventing it. Fucking Discover.. I travel a lot (usually within the states). I go to San Francisco and try to buy dinner for clients (after making a previous purchase successfully in San Fran).. DECLINED.. right in front of my clients. Make a phone call to Discover and they 'fix it' and I tell them I want my card to work. Then I go to pay the bar tab at LAX for a layover on my way back.. DECLINED.. right in front of everyone at the bar. It's so fucking annoying that I started carrying cash. Fuck these credit card companies.. I wish Bitcoin was accepted everywhere.

Re:This is why you call your bank before tourism

[fustakrakich]

You ever been hit? For those that have, statistics mean squat.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Agree 10,000%

A a victim of ID theft, I appreciate the CC companies erring on the side of caution.
But it's not magic, either. If you have "random" buying patterns, obviously, it'll be
hard for any software to accurately predict what's legit and what's not legit.
Mater of fact, if I'm going to do an unusual CC purchase, I call them in advance
just so it goes through without a hitch, even if it's domestic.

Additionally, banks have "banking" regulations which they must follow; PayPal isn't
a bank and has no or random rules regarding your security or ID protection; just so
you're aware. If the only way to get something is via PayPal, I don't need it that badly. ...The more you know...

CAP = 'motive'

Re:This is why you call your bank before tourism

[JimMcc]

If you're going to make out of the ordinary purchases for overseas, or travel overseas, you always want to call your bank ahead of time. This is a standard operating procedure, and nothing to complain about on Slashdot.

Even that doesn't ensure that you don't have problems. We used to use HSBC. As we found out, their fraud detection algorithms are terrible. I returned from a trip to Mexico to be greeted by a flurry of voice mails from them telling me to call them and that my card had been shut off. I called them to straighten things out and was told that I should have called them before travelling to Mexico. I asked them where they would look to find this information and he responded that he would look at my customer account and in the comments section it would say..... Oh. I see you called us to tell us you'd be traveling in Mexico.

That wasn't the first major fubar on their part and a week later I cancelled the account.

Re:This is why you call your bank before tourism

[dcollins]

At this point, I think everyone I know has had an instance of a false positive shutting down their account at some point. I've even had it over a $5 political donation in a state I previously resided. This is not "an amazing job".

If you installed a spam blocker that just uniformly deleted all your emails, then you'd never see any spam and I guess that would also count as "an amazing job".

Re:This is why you call your bank before tourism

[IamTheRealMike]

Yeah, it is completely broken. This is a problem more or less specific to America.

I have several cards. I travel constantly. I have never, not once, told my bank where I am going and I have never, not once, had my card declined.

How do they achieve this witchcraft? Well,

1. The cards are all EMV. The magstripe can be cloned, but you can't use it in most countries (other than America)

2. Many online purchases are protected by 3D-Secure, which basically just lets your bank put a login/ID verification screen after the card number is entered

3. Their fraud models expect people to travel whereas lots of Americans don't

Re:This is why you call your bank before tourism

[IamTheRealMike]

Instead of rejecting the payment outright and freezing the card, text message my phone IMMEDIATELY and I can read a 6 digit code to the cashier to allow the transaction

How about an even better solution - insert your card into a reader, type in your PIN and that's the two factors right there. You know...... the system that's already used everywhere in the world except for America? It works pretty well. I think the USA is starting to roll it out now, albeit a slightly crippled form of it (they managed to take the 2-factor system everyone else uses and make it 1-factor).

Re:This is why you call your bank before tourism

[Anonymous Coward]

Contacting credit card companies ahead of time doesn't work reliably; they often simply ignore it and block the transactions anyway. So, the idea that this is a solved problem is bullshit. Furthermore, you shouldn't have to second guess the fraud alert algorithms of your credit card company in order to avoid being inconvenienced.

And, yeah, the stupid state of credit card security in the US is something to complain about on Slashdot: the causes of this problem are deeply related to technology, law, and their relationship.

Re:This is why you call your bank before tourism

[NostalgiaForInfinity]

But they do an amazing job - which is why you very rarely find out about fraud for the first time when it shows up on your bill.

The quality of the job they are doing is determined by both false positives and false negatives and both are far too high.

US credit card companies aren't doing an "amazing job", they are doing a piss poor job.

Re: This is why you call your bank before tourism

[NostalgiaForInfinity]

1 in every 5 people have had an attempted fraudulent charge stopped by these systems. And credit card fraud isn't the only type of crime these frausters perpetrate. Wire fraud and identity theft are on the rise and are becomming more and more of a problem as the US gets closer to their pin-and-chip deadline.

And the reason this kind of fraud is so frequent is because your industry uses extremely poor security. Fraud detection software should be largely unnecessary if credit card transactions were properly protected using available technology. That means proper use of public key cryptography, one time card numbers, smart cards, pins, and instant notification.

Re:This is why you call your bank before tourism

[NostalgiaForInfinity]

I have to second these experiences: I found Bank of America and Citibank to be absolutely horrible and incompetent.

Re:This is why you call your bank before tourism

[Anonymous Coward]

1. The cards are all EMV. The magstripe can be cloned, but you can't use it in most countries (other than America)

EMV is good. Beware of contactless payments.

2. Many online purchases are protected by 3D-Secure, which basically just lets your bank put a login/ID verification screen after the card number is entered

I really hate this system when traveling. Most banks in my country is using text message for confirmation code -> I have to use my phone and roaming to get access to my money. No, I cannot change phone related to card when I am abroad you know it is unsecure .... Try to use GSM phone in the area with CDMA coverage. Give me a token, password list or allow to change phone number.
3D-secure is working only if both parties are using it.

3. Their fraud models expect people to travel whereas lots of Americans don't

I just informed bank that "I am traveling a lot" and they marked some check box ... no more problem with internet purchases on 3 continents at the same day.

Re:This is why you call your bank before tourism

[Anonymous Coward]

The current method with text/email confirmation on potentially sketchy charges works well and quickly.

In-country this may work well.
When traveling, I hate text messages to the "designated phone number". I prefer to obtain local phone for local calls. Roaming & smartphones does not compute.

Re:This is why you call your bank before tourism

[Anonymous Coward]

It's about convenience. The credit card companies don't get paid when you pay with cash. They accept a certain amount of fraud in order to make cards the most convenient choice.

Re:This is why you call your bank before tourism

[Anonymous Coward]

They've caught real fraud quickly and got me a replacement card within a week.

Uh, my local bank caught fraud within a day and issued me a new card within like an hour (the time it took to get there and the 10 or 20 minutes service to get a new card). Unless that "within a week" was because you chose not to just come in and get a new card...

Re:This is why you call your bank before tourism

[Anonymous Coward]

If you're going to make out of the ordinary purchases for overseas, or travel overseas, you always want to call your bank ahead of time. This is a standard operating procedure, and nothing to complain about on Slashdot.

And every time I call and tell them I'm traveling they tell me the same thing, "I'll note that on your account but be aware this will not prevent our system from declining charges believed to be fraudulent."

So in other words, there is no fucking point to telling your bank because they'll decline your card anyways.

Re:This is why you call your bank before tourism

[Calydor]

And somehow that still seems better than my bank, which allowed a series of purchases on a hacked Trion account when ArcheAge released - on a credit card that had expired a year before.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Wrong. Called ahead, still had it shut off. CC issues fraud detection is garbage. They justify charging high interest rates to accept risk of both default and fraud yet then they shift the risk of fraud to anyone possible and ignore the needs of the customers they're claiming to protect from risk.

Re:This is why you call your bank before tourism

[Anonymous Coward]

2. Many online purchases are protected by 3D-Secure, which basically just lets your bank put a login/ID verification screen after the card number is entered

Exactly. If the webshop is broken into (or even under surveillance by criminals), they will never capture that bank verification. Because a redirect is used - it does not go through their website. All the shop gets is accept or reject from the bank that does the verification.

The system where a stolen credit card number can be used for shopping is broken - webshops with bad security are hacked every month. Fortunately, parts of the world has moved on. The number (and other info entered in the shop's form) is simply not enough to perform a transaction.

Re:This is why you call your bank before tourism

[Anonymous Coward]

It's common practice for fraudsters to make a small charge on the acct to see if it is successful and then a few hours or day later BAM they hit it hard with a large transaction. How about we go back to the days where fraud charges are the liability of the consumer and you can just learn how to use your card without compromising the account info? If you want to live in the digital age you have to accept fraud prevention algorithms, because you sure as hell don't have the patience to research every vendor's reputation before using your card. People like you getting "livid beyond belief" over these minor inconveniences, your just babies with plastic cards that want everything now. If my card is declined I call up and find out why, it takes 3-5 mins at the most as long as you don't scream like a baby at the automated system when you call. Also your bank likely called you with some sort of automated message about reviewing transactions. Answer your damn phone next time.

Re:This is why you call your bank before tourism

[Anonymous Coward]

What's wrong with the industry is it uses pull not push. It's always going to be an uphill battle of imperfect solutions as long as "you" is really only what someone else says you are.

It's a fundamental problem with your "identity" being passed around like a $5 hooker while your bank only uses the cheapest condoms, sometimes.

It's also why no matter the hate and vitriol I have some bitcoin, push not pull is the killer feature and it's baked right in.

Re:This is why you call your bank before tourism

[confused one]

I call Amex before I travel. It's just a good idea to let them know in advance. Same is true for my Capital One card, I call them before I travel. That way I'm not standing in an airport, on the phone, trying to convince them that, yes, it really is me, when I'm trying to pay my bar tab.

Re:This is why you call your bank before tourism

[jonnythan]

Nothing about his post indicates that these transactions happened the same day.

Re:This is why you call your bank before tourism

[ILongForDarkness]

Except some banks, at least mine does, explicitly tells you there is no need to call them when you are travelling. Could be different at your bank but I suspect that the minimum wage slave taking the call generally says "uh, huh, I've added a note to your file" and waits for you to get off the line so they can keep their average call length down. A "note in the file" likely doesn't feed into their automated system that is used for fraud prevention, especially since their is a good chance that the system that the customer service rep uses is made by someone else than the fraud detection system.

Always have sum local currency on hand, IMO the only way to go. I'd say a couple days expenses worth, hotel, cabs food included. Ie about 300 euros or so if going to europe and lesser or more depending on cost of living where you're headed. As it says on the back of your card: This card is the property of bank X and must be returned upon request or the equivalent wording: your bank isn't under any obligation to honour your card when you are away at "camp" in Sudan nor do they have to respond to your urgent requests form your Iranian cell in a timely manner. They might lose your business but that doesn't help you when the hotel calls security when you try to leave after they tell you your card is no good.

Re:This is why you call your bank before tourism

[Xian97]

I have had the same thing with two back to back purchases on Steam. Valve won't let you buy two of the same game in a single transaction, so during a sale I bought one copy for myself and another copy for a friend, and the card was declined on the second purchase.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Fuck no. I'm not giving random retailers my current phone number (nor should the banks link one card to one phone). I'm not addicted to my phone so I don't require it to be in my pocket at all times when I'm shopping. I want to be able to buy things when my phone is dead and that could include buying a new phone when the current one gets accidentally crushed. My $80 a year cell plan fits me perfectly minutes wise but has a 25 cents charge per text message. I'm not willing to pay a text message 'tax' on every purchase. Not everyone has a phone let alone can receive text messages. Like email, there's no grantee a text message will be timely. Checkout is already slow enough, lets not add a text message wait. And you know for some people that will be "oh, my battery just died. Oops, can I pay later?" and a 20 minute argument on why they deserve free things for now and will pay later. And another group will fiddle around doing someone else on the phone instead of paying attention to everyone waiting on them. And you'll need to deal with places that don't have good reception, and..., and..., and....

A secure dongle could be used, but the cost of giving everyone one (or building it into the card, though I did see a few of those years ago...) far out cost dealing with the cheapest call centers to approve the few transactions that are denied.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Get a better credit card company. There are some to choose from.

Re: This is why you call your bank before tourism

[ljw1004]

Call your bank before tourism?

I've never had that work. Four times in a row I called to let them know I'd be travelling and they suspended the credit card a few days after my purchase.

This was First Tech Credit Union, by the way. I think they're just more provincial than a big bank... My Chase credit card has never been suspended abroad even without calling

Re:This is why you call your bank before tourism

[Eythian]

I didn't read it that way. I read it as the newegg orders were in the same day as each other, and that's what triggered it. Not connected to the actual breach.

Re:This is why you call your bank before tourism

[mysidia]

they say that they are refusing the sale because they thing something about my account may trigger Paypal's fraud protection.

File a complaint with eBay. Report them as a Non-Performing seller which is an eBay Terms of Service Violation.

A completed sale is contractual, the seller must go through with the transaction, otherwise they are violating the contract and can even be sued by you.

Re:This is why you call your bank before tourism

[mysidia]

My BoA Visa card has constantly hit their "fraud detection". I don't use the card terribly often anymore; it seems every other time I did use it for an online purchase of any sort, it triggers the fraud detection: even one time I was using it in a local shop; I think the local shop had some kind of issue with their CC machine as they needed to run the card through twice.

It was very annoying that every 4 weeks or so, they were calling me up with a "fraud alert".

I have been much happier in my experience with Amex and Citi.

Re:This is why you call your bank before tourism

[mysidia]

Would you think it normal or necessary to contact your ISP ahead of time should you choose to start surfing secure websites outside of your country?

Well, your ISP doesn't look at what websites you are visiting (or shouldn't). Unless your ISP is a Cell provider or Dialup account, there's no way you left the country and still use your ISP's services.

Let's try another one: Would you think it's necessary to inform your ISP you will be accessing your e-mail account from outside the country?

(HINT: Many ISPs use geoblocking. On an ISP provided e-mail account, many times overseas IP addresses will be blocked by firewall from contacting the ISP's servers over POP3 or SMTP)

Let's try another one.... would you think it's normal or necessary to contact your Cell phone carrier, before leaving the country and thus using international data roaming service?

Re:This is why you call your bank before tourism

[aitikin]

File a complaint with eBay. Report them as a Non-Performing seller which is an eBay Terms of Service Violation.

A completed sale is contractual, the seller must go through with the transaction, otherwise they are violating the contract and can even be sued by you.

Unless the seller lists as only Paypal validated addresses and your account isn't shipping to a validated address...for example. Paypal considers any non-validated address as insecure and (for lack of a better phrase) "Ship at your own risk". A good number of sellers will not ship to non-validated address and, even if you validate after the auction ends, still can't trust it.

Re: This is why you call your bank before tourism

[aitikin]

Please explain what you mean by, "properly protected using available technology." I work in online/phone based sales and we have probably the best fraud prevention known in the US, but I'd like to see what YOU think that means.

Re:This is why you call your bank before tourism

[Anonymous Coward]

You're joking.

Travel overseas is quite enough hassle without having to call every bugger I ever do business with. The whole point of a credit card is that it works just about anywhere. If it's suddenly going to stop working just when I happen to find myself unexpectedly needing money in Singapore or someplace, then the card itself has literally no value to me.

Re:This is why you call your bank before tourism

[o_ferguson]

This was their issue. I completed the sale and gave them a shipping address that was not my regular one. They said that was grounds to kill the sale, even though I said "well then send it to my regular address" - since it was a digital product (unlock code) anyway and I didn't care what address was on the invoice, but they said that using the address where I actually was when submitting the invoice was grounds to kill the whole deal.

Re: This is why you call your bank before tourism

[rickb928]

0. Ditto that, merchants expect an authorization response between 20-100 ms. Doing effective fraud detection is an interesting proposition. You can justify slower responses for some fraction of transactions if you are enhancing the testing of them for fraud, though for big retailers be ready to justify the delays if they get noticed.

1. New cards are not a very good solution for fraud, since a cardholder can be a victim of 3-6 breaches a year. Sooner or later you run out of account numbers. And you're doing fraud detection anyways, so just included parameters from the breach, and watch the attempts bounce off your system. Plus, cardholders like me resent having to change so many bill pay systems when they change my debit or credit cards. Very disruptive. Some systems permit the previous (assumed compromised) card to stay active, for instance for subscriptions. Yes, AOL took advantage of this to the point that they were indistinguishable from fraudulent activity for a while. There are others. The dispute process usually nails these miscreants.

2. Contrary to popular myth, card issuers do have a stake in fraud prevention. The inevitable disputes cost money to process, cardholder satisfaction falls and other issuers will happily use surveys to find out you're slipping in satisfaction and dive in. It's competitive. Fraud is a potential detractor.

Re:This is why you call your bank before tourism

[rickb928]

"I absolutely agree. They have THE WORST programmers/statisticians working on this. "

Idiot. I work in this industry. The fraud and authorization teams have our BEST programmers, analysts, and engineers, the most resources, and perform brilliantly. They are one of the most important KEYS to our success. And they are under constant scrutiny internally.

Pretend you know anything about this.

Re:This is why you call your bank before tourism

[mjwx]

> The "fraud detection" is completely broken

I absolutely agree. They have THE WORST programmers/statisticians working on this.

How about adding a simple two-factor authentication? Instead of rejecting the payment outright and freezing the card, text message my phone IMMEDIATELY and I can read a 6 digit code to the cashier to allow the transaction. It isn't perfect, but that one simple step would make it about 90 percent better, more secure, and cut down on false positives. I swear this would increase customer satisfaction and increase the amount of money the credit cards make because they would then accept a higher number of legitimate transactions. What is wrong with that industry?

They'll never implement 2 factor auth because all the mouth breathing idiots will complain about it. Look at how many whinged when they talk about switching from signature to PIN (this has already happened in my country but the laggards still have a big cry about it). Its just too inconvenient.

I think the big players already have tried this (IIRC: Verified by Visa was the product name for Visa) but I haven't seen it in years because no-one wanted to use it.

The second issue with this is, if you make people jump through hoops to buy things, people will make fewer impulse purchases. A lot of the credit addled will go back to using cash because their bank has made it "too hard" as well.

You're right that 2 factor auth would kill 99.5% of credit card fraud, however it would kill a percentage of purchases and that cant be allowed. Right now it's cheaper to eat the costs of fraud than to lose a percentage of their fees. That is what is wrong with the industry.

Re:This is why you call your bank before tourism

[geekmux]

Would you think it normal or necessary to contact your ISP ahead of time should you choose to start surfing secure websites outside of your country?

Well, your ISP doesn't look at what websites you are visiting (or shouldn't). Unless your ISP is a Cell provider or Dialup account, there's no way you left the country and still use your ISP's services.

Let's try another one: Would you think it's necessary to inform your ISP you will be accessing your e-mail account from outside the country? (HINT: Many ISPs use geoblocking. On an ISP provided e-mail account, many times overseas IP addresses will be blocked by firewall from contacting the ISP's servers over POP3 or SMTP)

Ah, in order to put this back into the context of the original discussion, let me clarify. In my ISP example, I was referring to you sitting in your home on your chosen ISPs network attempting to contact a server or services on the internet that happened to be hosted outside of your country. Obviously this happens rather seamlessly all the time for consumers, as we don't hold the burden of ensuring we get the "OK" from our ISP before doing so.

The same should apply for any banking institution and the framework they wish to do business in.

Let's try another one.... would you think it's normal or necessary to contact your Cell phone carrier, before leaving the country and thus using international data roaming service?

Only if I was a moron who failed to understand that 99.999% of cell phone data plans do not include international support by default.

And if I did have an international data plan already configured on my device (as I do with corporate devices I manage), no I do not feel it necessary to alert my cellular provider. Again, the burden of security belongs to the players who built the framework they operate in. If you can't manager services seamlessly for the consumer, then stop offering the service. It is that simple.

Re:This is why you call your bank before tourism

[rsmith-mac]

Chase really has wonderful service. Card declined? Call customer service, it immediately rings to an American call center with people who have the authority to fix your problem. Five minutes later, the transaction goes through.

Indeed. They even tell you to call them collect when you're traveling outside of the country (you need to know how to do it, but it means they eat the cost of the call).

Re:This is why you call your bank before tourism

[Anonymous Coward]

This, exactly this. I travel to a certain city rather often. Bought a bunch of stuff on a particular card of mine one day and then went to buy a gift for someone. Wasn't terribly expensive either. Card declined. This is not in another country, and it's not in a place that's terribly unusual for me to be.

My response included a lot of annoyance, which was somewhat satisfying, but my actual response has been to relegate that card to back burner status. I hardly use it for anything anymore, and I made sure they know why. If you're going to inconvenience me then you're not going to make money from my transactions. That is the correct way to respond to their nonsense.

Same thing with my credit union. They turned off my card without notifying me by phone or anything because I dared to buy gas with it twice in the same day. I returned a rental car, had to buy gas for it, and then it so happened my own car needed gas. So sue me. They get the special treatment: I only use their card in situations that are relatively high risk, like gas pump purchases.

I'd have little problem with this if notifications were as swift as turning cards off, and if turning the card off could be reversed just as fast by, say, responding to a text message. That they don't think of things like that just proves where their loyalties lie, and so I don't care about them or their fraud prevention.

BTW, banks, when you get around to leaving me a voicemail asking me to call some 800 number I've never heard of telling me there's a problem with my card, do you really think I'm going to do that? No, I'm going to call the number I have on file for you and of course that takes longer, which is just more annoying. How about making your answering systems more intelligent, like maybe route me to the right place automatically if it sees there's a problem with my card?

To the people who think chip and pin is the answer: Go read the European press, especially consumer complaints about banks. Chip and pin is hideously broken in Europe, but of course the banks deny it's possible so as to avoid having to actually pay for the fraud that their broken system enables. Having a system that everyone knows is broken is one thing: chip and pin is more insidious. It's broken and too many people actually believe it's secure.

Re:This is why you call your bank before tourism

[mysidia]

They said that was grounds to kill the sale, even though I said "well then send it to my regular address"

My response to them would be that it is not acceptable, and I expect them to complete the sale through my validated address.

Again, if they refused, I would immediately leave negative seller feedback on the listing and submit the Non-Performing Seller complaint form to eBay.

Re:This is why you call your bank before tourism

[Anonymous Coward]

> Fuck these credit card companies.. I wish Bitcoin was accepted everywhere.

Agreed.

Re:This is why you call your bank before tourism

[o_ferguson]

Once they use the "refund" feature on paypal there's no way to leave feedback because the transaction is marked as incomplete. I told them I would contactebay about it but didn't care enough to actually do so - just went to the next cheapest vendor and spent a few cents more.

Re:This is why you call your bank before tourism

[o_ferguson]

I spent like 45 minutes on text chat with their support guy complaining about it. Don't know where the transcript is tho.

Re:This is why you call your bank before tourism

[Richard Bannister]

If you're going to make out of the ordinary purchases for overseas, or travel overseas, you always want to call your bank ahead of time. This is a standard operating procedure, and nothing to complain about on Slashdot.

It actually makes no difference in my experience.

I've had my bank shut down my VISA card twice now for the first international transactions made in exactly the location I've told them I'm going to be.

I think what happens is that a computer stops the card immediately and flags it for a human to review at a later point, but in the mean while I have a dead piece of plastic and an embarrassing situation at a checkout.

Re:This is why you call your bank before tourism

[bruce_the_loon]

The detection algorithms assume two purchases at the same store within minutes of each other are usually a sign of double-dipping or card cloning at the store. Physical presence at a store normally results in a single transaction, not multiple, for most shoppers.

Dealing with this in an online store can be difficult as multiple purchases are normal. Amazon's Kindle store handles this by delaying some of the transactions if they would appear too similar. I just bought two ebooks via the Kindle for $10.00. The first went through instantly, the second came through nearly six hours later. This is an interesting way to do things and I think Amazon only does it with the Kindle store because they can remove the book if the transaction fails later.

Re:This is why you call your bank before tourism

[Anonymous Coward]

> The "fraud detection" is completely broken

I absolutely agree. They have THE WORST programmers/statisticians working on this.

How about adding a simple two-factor authentication? Instead of rejecting the payment outright and freezing the card, text message my phone IMMEDIATELY and I can read a 6 digit code to the cashier to allow the transaction. It isn't perfect, but that one simple step would make it about 90 percent better, more secure, and cut down on false positives. I swear this would increase customer satisfaction and increase the amount of money the credit cards make because they would then accept a higher number of legitimate transactions. What is wrong with that industry?

Having worked in the fraud industry, be aware that each financial institution involved in the transaction (issuing bank, and acquiring bank) have their own fraud software. One of the big players is the same on that gives us credit scoring. There are two approaches taken. AI and rule-based.
AI is dependent on self-learning, and was still rudimentary when I left the industry 6 years ago. This was backed up by some great academic research. Until these transactions can hit the volume where aggregate math starts to apply (like foreign currency exchange) there is not enough data for a program to become 'super reliable'. The problem is it lacks 'irrational logic' that rule based detection software can implement much more quickly, since the rules are created by humans. For example, a few small transactions at various shops may seem legit, until a huge attempt somewhere else is pretty straight-forward for AI. What about the consistent single-item charges in a retail shop? What about when fraudsters think of novel data theft approaches, like replacing POS card machines at gas/petrol stations (which has happened in at least one country)?
Financial shops used to EACH have a fraud write-off of several million in the late 90s early 00s. That is now down to low 6 figures, or 5 figures annually.
Chances are if you have lost your card, your phone can also be compromised or in a low/no signal store. This is why the codes that return to the POS device have meanings (like, oh shit, call the cops and detain them since we definitely know it is fraud).
In the UK chip and pin is huge in preventing fraud. I'm surprised how loose a transaction in other countries still is, especially America since it is a top fraud country.
http://www.forbes.com/sites/halahtouryalai/2012/10/22/countries-with-the-most-card-fraud-u-s-and-mexico/

Re: This is why you call your bank before tourism

[NostalgiaForInfinity]

I work in online/phone based sales and we have probably the best fraud prevention known in the US, but I'd like to see what YOU think that means.

As I was saying: "public key cryptography, one time card numbers, smart cards, pins, and instant notification". It means, among other things, that you don't ever get any credit card numbers or billing addresses. All you get is a one time code for a specific amount of money, valid for a limited amount of time and valid only for you. If anybody steals your customer and order database, they can't do anything with it. It also means that you can instantly verify that the payment is valid without contacting the credit card company.

On the customer side, it means that he needs to talk to his smart card credit card in order to generate that code, and that requires either a pin or even a second physical token. In addition, customers get notified of large charges as soon as they get generated (not when you process them), and optionally verify them via their phone.

Re:This is why you call your bank before tourism

[RubberDogBone]

If you travel in Canada a lot, no doubt you know Mastercard is by far the predominant card in Canada. Everyone and then some accept it. Fewer accept Visa, and far fewer things like Amex or Discover.

Next time going to Canada, just take a Mastercard.

Re:This is why you call your bank before tourism

[RubberDogBone]

Used to have an HSBC US Mastercard. They recently sold that card business to CapitalOne. They are the card issuers now and have converted everyone to CapitalOne cards. Yay, said I.

Re:This is why you call your bank before tourism

[rioki]

I think in this case the issue was not really the fraud protection, but the abysmal customer service. Similar things happened to my, but one phone call always resolves the issue; even at 11PM on Sunday.

Re:This is why you call your bank before tourism

[AmiMoJo]

How do Americans get money out of cash points? In most of the world you insert your bank card and enter a PIN number, so people are already familiar with PINs and happy to use them.

I much prefer PINs to signing, because I can't reliably reproduce my signature. I have arthritis in my hands, sometimes I can't write clearly. Some people are numerically dyslexic or can't use numbers for some other reason though, so there has to be an alternative for them.

Re:This is why you call your bank before tourism

[jrumney]

The first racked up three charges for $900.00 in Japan

This is a similar situation to where my card has been blocked when I didn't want it. I had already advised the bank that I was travelling overseas, but when using my credit card to buy Shinkansen tickets for myself and my wife, the cashier tried to put them through as EIGHT separate transactions - one for each ticket in each direction, and one for each Shinkansen Express Supplement. The bank blocked them from the third transaction, and I got a phone call about 10 minutes later.

Re:This is why you call your bank before tourism

[AmiMoJo]

All my cards allow me to register my trips online and it seems to prevent them from being flagged. Normally use far from the card's home country is flagged up immediately by the system.

Re:This is why you call your bank before tourism

[AthanasiusKircher]

Nor should this be a problem for the consumer, or a burden to call "ahead of time".

Let me put this another way. Would you think it normal or necessary to contact your ISP ahead of time should you choose to start surfing secure websites outside of your country?

Does your ISP provide your service for FREE? Do they send you money periodically if you use a lot of internet service?

I have unquestionably profited many thousands of dollars in "rewards" over the years from credit cards. I only once paid a fee of $30 or something (due to an unusual situation where I screwed up the timing of a transaction).

Yes -- I know most credit card users carry a balance either continuously or once in a while. Yes, I also know that credit card companies charge merchants for transactions, though in 98% of places I buy things, there is no price advantage for paying cash, so it's actually in my financial interest to charge and get some reward money back (thereby partially rebating the merchants fees to myself, which I would have paid for in cash anyway most places to subsidize those who do use cards).

Thus, I have a "magic card" that I swipe when I go to stores, which provides me with a convenient record of most of my financial transactions -- and they're nice enough to pay me a couple hundred dollars per year or so for using it.

So -- I'm not going to complain too much if I have to make a 2-minute phone call once in a while. If fraud levels are high, credit card companies lose more money, and that means they probably don't pay me as many rewards or fees go up or whatever. So, it's to my benefit to help them prevent fraud, too.

I can see your complaint if you have to pay for a premium card with an annual fee, or if you already feel like you pay a lot to your card company in interest or fees. I don't. And any sane person who lives within his/her means doesn't pay interest and fees (except if they are in a dire financial situation -- in which case, why are they taking so many trips?).

The burden of securing transactions should be within the framework that provides it.

If there's an easy and cheaper way to do it, fine. But I'm not going to complain too much about a convenient service I don't have to pay for (and which sends me checks periodically). If more businesses offered cash discounts that would be greater than my rewards, I might change my mind (and behavior).

Re:This is why you call your bank before tourism

[Anonymous Coward]

1. The first problem is the US itself, no 3Dsecure, no EMV no NOTHING to protect the card. I can write down my card number & CVC right here. without access to my phone or my email you can go fsck yourself and not pay for something with my money.

2. you have no idea how much stuff is prevented without you ever knowing. you think the payment processors and issuers should tell us everything they do? why? it's like saying "hey scammers, here are the techniques we use, make sure you circumvent them".

3. if your bank didn't return the money then you should switch banks...

Re:This is why you call your bank before tourism

[Anonymous Coward]

Iny my experience, it doesn't matter. They'll still lock the card because, as the OP alluded, the right hand does not know what the left hand is doing at the CC company. Two recent examples:

1) Called AmEx 3 times to remind them I would be traveling thourh the center of Oz only to have the card locked when I tried to buy gas at a cattle station.
2) VISA card locked *twice* during a cross-country drive in the US when attempting to purchase gas in Southern UT and lunch in southern Colorado.

Re: This is why you call your bank before tourism

[aitikin]

I can tell you this, after the trouble I get from clients when I have to ask a client what their BILLING ADDRESS is because they didn't put it in and it's not the shipping address, the general public is far too lazy to go through that process.

Re:This is why you call your bank before tourism

[Chelloveck]

This happens regularly, yet you still use CapitalOne? I think I see the problem...

Re:This is why you call your bank before tourism

[Anonymous Coward]

That's a "what's wrong with your bank" issue, not the credit card industry as a whole.

My bank does exactly what you describe. It's a service I had to sign up for (free), but it is offered.

Re: This is why you call your bank before tourism

[omnichad]

as the US gets closer to their pin-and-chip deadline.

Wasn't that October 1st (unless you're a gas station)? Can't get much closer than already happened.

Re: This is why you call your bank before tourism

[nedlohs]

So you claim to have great fraud prevention, but actually have terrible fraud prevention because you don't want to lose the business of lazy people.

Nothing wrong with that, but why claim otherwise?

Re:This is why you call your bank before tourism

[omnichad]

1. The cards are all EMV. The magstripe can be cloned, but you can't use it in most countries (other than America)

October 1 has passed. America is now an EMV country. Any merchant who accepts a card by its magstripe that has an EMV chip, they are liable for the fraud. Any bank that still uses magstripe cards are liable before the merchant.

Re:This is why you call your bank before tourism

[JustAnotherOldGuy]

This happens regularly, yet you still use CapitalOne? I think I see the problem...

Other than this relatively predictable bork up,they've been pretty good.

It's not an earth-shaking problem and it's easily fixed. To be honest I'd much rather have them trigger a little too easily than the alternative.

Re:This is why you call your bank before tourism

[omnichad]

What we call an ATM? We insert our bank card and enter a PIN. You can use a credit card too if you've set up a PIN and want to pay the exorbitant interest rates for a cash advance. Most people are used to using a PIN for their debit card in stores already. However, I use a credit card equally as often due to rewards programs. As of October 1, we're a Chip and Signature country for credit cards. Any merchant that doesn't have a chip card reader is liable for all fraud. Any card issuer that doesn't issue EMV cards is liable for fraud. However, I've only received one chip card so far and not even my debit card yet.

Re:This is why you call your bank before tourism

[Anonymous Coward]

American Express has never done such a thing to me in over twenty years, and I've done everything from charge a $15,000 order at Home Depot to charging a $500 catering bill in rural Colorado.

My former CapitalOne card, though ... holy crap. The worst ever was when I had Washington Mutual. They shut my card off on Thanksgiving day while I was out of town. When I called to ask why, they told me it was fraud prevention but the department that could reactivate my card was closed for the holiday weekend. So I'm stuck out of town with no gas, no banks open to get cash, and a card that doesn't work. If I hadn't had my American Express card I would have been stranded by Washington Mutual for four days in another state. I wouldn't have even been able to get a hotel room. I would have had to sleep in my car for four days with nothing to eat or drink. I dumped them as soon as I got home. They went under less than a year later. Fuckers.

Re:This is why you call your bank before tourism

[Anonymous Coward]

5 minutes is a long time with a cart full of groceries blocking a line of people behind you.

American Express is better. The one time in twenty years that I even encountered fraud prevention, my phone rang less than 30 seconds after my card was declined. It was an automated system to verify the transaction. I verified the transaction and it worked the second time I swiped the card. Total time ... less than a minute. I didn't need to call them to find out what the hell was going on, and I didn't have to talk to a brainless automaton.

That customer service is why I'm willing to refuse to shop at merchants that don't take American Express (I'm looking at you Costco).

Re:This is why you call your bank before tourism

[Anonymous Coward]

No, dipshit, not everything is in cell phone range, not everyone carries a cell phone all the time, and not everyone wants to wait for everyone in front of them to tell the cashier some secret code. Additionally, it won't work against a $5 wrench, and will, in fact, encourage the thief to take your card and your phone with unlock code via the $5 wrench method. The new chip cards, on the other hand, will roughly eliminate cloning, which is the major source of these problems.

Re:This is why you call your bank before tourism

[omnichad]

Same amount total, same vendor, within a few minutes. Triggered probably to prevent (accidental) duplicate purchases. Add another item to the second order to make it a different amount and it probably wouldn't have been declined

Re:This is why you call your bank before tourism

[jittles]

If you're going to make out of the ordinary purchases for overseas, or travel overseas, you always want to call your bank ahead of time. This is a standard operating procedure, and nothing to complain about on Slashdot.

I never bother with this. I travel international on a semi regular basis and travel nationally all the time. Every once and a while I'll get a text message asking my bank if I made a purchase, but they approve the transaction before I ever even notice I got the text. I travel to California at least once every quarter and had the bank call me and ask about a $1000 purchase at a California grocery store chain. I was nowhere near the state of California. So far, fraud detection has been seamless and convenient for me.

Re:This is why you call your bank before tourism

[flink]

How about adding a simple two-factor authentication? Instead of rejecting the payment outright and freezing the card, text message my phone IMMEDIATELY and I can read a 6 digit code to the cashier to allow the transaction.

My Citi card already does basically this. If they detect a suspect transaction, they text my phone. If I reply "yes", it goes through, if not, the transaction gets declined.

Re:This is why you call your bank before tourism

[operagost]

I can say the same for Citi. You can have them call or text you when they flag something. I had this happen recently when a slew of CC numbers were stolen at a local restaurant. They let the first one go through, which is understandable because it was another area business I could have easily patronized. When a second transaction came in to the same store, they blocked it and marked the previous one as suspect. I was able to walk through some other recent transactions with the rep over the phone to make sure we removed the fraudulent ones, and she ordered a new card for me right away. It also only took one day to get to me.

Re: This is why you call your bank before tourism

[NostalgiaForInfinity]

I can tell you this, after the trouble I get from clients when I have to ask a client what their BILLING ADDRESS is because they didn't put it in and it's not the shipping address, the general public is far too lazy to go through that process.

Yes, and you wouldn't have to ask clients for their "BILLING ADDRESS" anymore; all you would need is to ask them for a single number. They get that number from a display directly on their credit card, on a small card reader, or from their smart phone. In addition to being safer it's also easier than the bullshit you make people go through right now.

Using the "billing address" as a security token, as credit card companies are doing, is stupid, insecure, and an invasion of privacy. You have lousy fraud prevention.

Of course, people like you should really be cut out of the process altogether. When people order online, the browser can talk to a USB credit card reader, request a payment, and the card reader then displays the amount, asks the user to input a pin to confirm, and then transmits the one time payment token.

Re: This is why you call your bank before tourism

[Anonymous Coward]

Please explain what you mean by, "properly protected using available technology." I work in online/phone based sales and we have probably the best fraud prevention known in the US, but I'd like to see what YOU think that means.

Did you read his post, cockstain? One time use "numbers" should be the norm. If I'm going to spend $25, generate a "number" with a limit of $25. If someone steals that number, they get nothing from it. The current practice of one number for everything does not make sense with current technology.

Also switching to a model more like Bitcoin would be a good idea. With Bitcoin, anyone can deposit coins into a wallet, but having that address does not let you take coins from it like a credit card number. The user has to send it to another address. Credit cards should operate more like that.

Re: This is why you call your bank before tourism

[tlhIngan]

New cards are not a very good solution for fraud, since a cardholder can be a victim of 3-6 breaches a year. Sooner or later you run out of account numbers.

it's actually later.

The 16-digit card number is composed of a 6 digit type and institution code, and with restrictions, the last digit has to meet an algorithm (Lund's algorithm), so you have at least 9 digits that are completely independent of each other. The institution code has a first digit that tells you the type of card (4 = Visa, 5 = MasterCard, 6 = Amex I think), and the rest identify the institution and even sub-family of cards (many banks share many codes). And of that, a billion independent card numbers. A big institution often has control of the last 3 digits of their institution code, giving them a total of what, 1 trillion numbers. If they have 200M members, that's 5000 numbers for everyone, on average.

There are generally plenty to go around, and I'm sure once they run out, they'll probably start to recycle them, given it will have been decades since the last time the number was valid.

Re:This is why you call your bank before tourism

[Cederic]

Fine. Design a better fraud detection/prevention mechanism that has fewer false positives and still catches most fraud.

Please, do.

Re:This is why you call your bank before tourism

[Cederic]

I've trained my card company, they let me perform 5-6 consecutive Steam purchases for the same or different amounts with no fuss.

Much the same reason as you, although also because I sometimes buy something then spot something else.

Re:This is why you call your bank before tourism

[Cederic]

Which kind of defeats the purpose and convenience of having a credit card.

Hmm, no. Most people travel abroad infrequently and a single contact to their card provider prior to travel is not onerous.

This does not prevent you from benefiting from pre-authorised credit available within a second when you wish to make a purchase for which you do not have the current liquid funds available.

This also does not prevent you from benefiting from the fraud protection offered by credit cards and not necessarily available with other payment cards and mechanisms.

Re:This is why you call your bank before tourism

[Anonymous Coward]

If you're going to make out of the ordinary purchases for overseas, or travel overseas, you always want to call your bank ahead of time. This is a standard operating procedure, and nothing to complain about on Slashdot.

You probably don't own a Capital One card if you are saying that. I've had numerous credit cards over the years - CitiBank, Chase, Capital One, Discover, American Express. We typically put $7K-$8K per month on credit cards and pay it off at the end of the month. Capital One is the only credit card I've ever had that:
1. Denies a charge ( most of the time for a ridiculously small amount-once it was $1.25) while you are standing in line instead of approving it and calling or emailing to ask if it was a valid charge.
2. Will accept a duplicate charge of $5432.48 and deny a second charge of 19.49 when my daughter bought the exact same shirt on two different purchases.
3. Completely ignore the fact that you have bought airline tickets, hotel tickets, rental car and have called them to tell them you are going on vacation and deny a purchase of gas for the rental, groceries for your week long stay or just about any other ridiculously small charge. IT happens EVERY time we travel and we travel several times a year.

Re:This is why you call your bank before tourism

[Anonymous Coward]

We DID call them regarding two separate trips. It did not stop them from declining purchases at a gas station for $27 after approving 3 transactions at three restaurants. The calls USED to work, but the new algorithms do not interface with any notes on your account.

Re:This is why you call your bank before tourism

[kmoser]

If you're going to make out of the ordinary purchases for overseas, or travel overseas, you always want to call your bank ahead of time. This is a standard operating procedure, and nothing to complain about on Slashdot.

I travel overseas every couple of years and have never had to call my bank ahead of time. My traveling companion often gets their card flagged for fraud when traveling overseas (and even occasionally when traveling domestically) unless they call ahead. I attribute this to the fact that I use AmEx and my companion uses CapitalOne. (Not shilling for AmEx, just saying.)

Re: This is why you call your bank before tourism

[rickb928]

Amex starts with a 33 or 37. 6 is shared by a multitude of types, including Discover. Diners Club USA uses 54 and 55.

The first four are more useful than the first single digit.

Many issuers do use segments for product types, so the available account numbers for an issuer nay be less than the mathematical maximum, and since account numbers generally have to meet MOD 10 crc, the available combinations are less.

Re: This is why you call your bank before tourism

[rickb928]

Woops, Amex uses 34, not 3.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Confused the hell out of me the first time someone swiped a card at my till. Out popped a little slip of paper, and a flashback to childhood made me get a pen and say "Sign here I think?".

Turns out I was right. Only times I saw swipe cards was with American and Kiwi customers (and a couple of Australians).

So you know, get yourselves together.

Re:This is why you call your bank before tourism

[lsatenstein]

For my web purchases, when the authorization goes from the merchant to the Bank, the Bank pauses the reply to the merchant and presents me with a question that only I can answer (from a list of question/answers) that I completed at their card enrollment.

When I respond correctly, the transaction is approved. If I err in the response, the merchant gets a rejected transaction notice.
Eg. I approved my own real-time purchase to Newegg this way.

Re:This is why you call your bank before tourism

[Magnus Pym]

Why can't they make it opt-in then? You can choose to have 2-factor enabled... or not. That will protect the responsible at least... and as someone has already pointed out, this is standard for ATM cards anyway.

Re:This is why you call your bank before tourism

[mysidia]

Once they use the "refund" feature on paypal there's no way to leave feedback because the transaction is marked as incomplete.

OK... apparently in September 2015, there are some changes to the process.

Refund because they refuse to ship will count as a "Defect" on the seller's record, unless they Actually Lied and claimed that the buyer requested to cancel as the reason chosen for refunding. If they did that, I would definitely contact eBay customer service and complain about the seller and them cancelling the transaction without permission.

I would try the old Seller Non-Performance complaint form to eBay customer service, anyways, though.

I wonder if there is still a workflow that allows still leaving negative feedback, such as finding a "Mark transaction as payment sent" option somewhere, and then post the Negative FB.

It doesn't help that eBay keeps monkeying with their website design lately.

Re:This is why you call your bank before tourism

[Anonymous Coward]

I did this with BoA recently. Posted travel advice in advance. Then daily they shut down my card, forcing me to call them, they all apologized profusely and promised it wouldn't happen again. During the 2 weeks, any swipe except cash out locked up the card. On the last day I did a swipe in Shanghai airport with no problems, then a swipe at LA airport locked it all up again... By the time I had reached home, it wasn't working again.

so, yeh, standard procedure doesn't always work.

Conversely for my NAB credit card, I never posted travel advice. It got locked up one trip where I'd literally used it in three countries within the same day (Thailand, Vietnam and China). After calling them they lovingly unblocked it and it's only locked up once since - when a dive bar in Shanghai tried to scam me by swiping it twice and stacking up the receipts for signing.

Re: This is why you call your bank before tourism

[aitikin]

What? Where did I claim to not want to lose the business of lazy people? I'd be all for this becoming the standard, but the general public would not. And without the general public (or at least the banks), it never will happen.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Alright, I'll bite. You don't sound like someone who was called a bank before. And don't recognize how stupid it is for us in this day and age to CALL anyone for this kind of thing any more.You haven't purchased train tickets in the EU from the US either. The Eurostar has breathtaking security precautions, and after all that your CC company freezes your card? Come to think of it you probably have very boring and predictable "tourism".

But back on point, geeks feel better knowing they aren't alone feeling this way, and some of us might be in a position at these same institutions and make this point internally.

Repeat after me: they are NOT trying to protect you from fraud. They are (successfully) saving THEMSELVES money. But apparently not enough to do it correctly. Get another card and enjoy canceling your account.

Re:This is why you call your bank before tourism

[Anonymous Coward]

Citation required. The participants of this discussion strongly disagree with your use of "occasionally".

Re:This is why you call your bank before tourism

[Anonymous Coward]

Maybe a standard operation procedure for an american traveling abroad once in a decade, but definitely not for the rest of the world.

Should everyone really call their banks continuously (and wait in the line for long time) to just tell "I want to travel abroad"!? How long this notice would be in effect? If I book flights now, should I call again two weeks later to tell them that I want also book hotel and then again to tell that I want to use ATM in a foreign country?

Isn't it the whole point of credit card that it's a global?

Re:This is why you call your bank before tourism

[Anonymous Coward]

In Europe Verified by Visa and Mastercard securecode is widely used.

For example if I want to buy something with a credit card, I'm redirected to my bank's website, and I need to enter my banking credentials (including one time password) to approve the transaction.

Re: This is why you call your bank before tourism

[nedlohs]

You gave the reason for having terrible fraud prevention as the general public being too lazy.

I agree, 99% of your customers will go elsewhere if you use a more secure system that is also more work for them.

I conclude that you don't do that because you don't want to lose the business of 99% of your customers.

And hence you have terrible fraud prevention because you don't want to lose the business of those lazy people.

If that's not the case then what is the point of mentioning that most people are too lazy for that process?

Re:This is why you call your bank before tourism

[Martin Blank]

When I traveled to Europe a couple of years ago, the Chase card was the only one that had enough room on it to cover everything I expected to spend on during the trip. I called and asked what would happen if my card were lost or stolen, and they promised next-day delivery of a new card to any of the places I was staying (Zurich, Florence, and Venice). They also offered a temporary bump in the credit limit since I had a pending payment of several thousand dollars over a weekend that might not clear until I was actually in Europe.

There's plenty of general Chase business practices to generate complaints, but I've never had a problem with them and they've always gone out of their way to make my life easier.

Re:This is why you call your bank before tourism

[Martin Blank]

Local banks commonly have card machines in their offices. Chase operates theirs from a central location, but I've never had a replacement card take longer than two days to arrive and it's usually the next day. In the meantime, existing authorized autopayments (Verizon, virtual server, a few other things) usually go through for at least a couple of months.

Re: This is why you call your bank before tourism

[aitikin]

Your statement asumes that this system you gave forth is A. Not more work for the customer (hint they think that anything new and different is more work) and B. an option in the current online marketplace. From your description, A is not the case (customer now has to create a new number EVERY TIME THEY BUY, thus more work), B is not the case either as, to my knowledge, no credit card company will verify any transaction without a billing address. So your point seems quite moot.

Re: This is why you call your bank before tourism

[nedlohs]

The point seems obvious enough. The credit card industry has extremely poor security, because as you said their customers are too lazy to actually want the inconvenience that comes with good security.

Which is fine, it's a choice. It does mean that having " the best fraud prevention known" is almost as bad as having "the worst fraud prevention known" since both are terrible. Sure pathetic is better than non-existent, but it's something to brag about.

Re: This is why you call your bank before tourism

[aitikin]

Literally millions of dollars worth of fraud prevention is almost as bad as letting millions of dollars of fraud come through?

Re:This is why you call your bank before tourism

[cthulhu11]

CapitalOne is distinctly worse than average, as is Bank of America.

Re:This is why you call your bank before tourism

[cthulhu11]

So, you assert that such purchases should always be planned days ahead of time, so that one can burn two hours on hold and being transferred, then only executed during banking hours? Feh.

Re:This is why you call your bank before tourism

[cthulhu11]

Is that worth the APR doubling that they enact when they buy the bank you actually signed up with? Not for me.

Re:This is why you call your bank before tourism

[Anonymous Coward]

I work in this industry and the problem is that the bank has to weigh the cost of fraud vs. the cost of dealing with customer support calls/pissed off customers. Since fraud costs are pretty high and the great majority of customers don't travel, they tend to err on the side of caution.

The other problem is that the credit card networks/infrastructure are essentially monopolies/oligopolies, so a full two factor auth as brianwski suggests would require the networks to add additional plumbing, which is like asking your cat to dance a jig for you.

The bank I work for does have projects in the works for both SMS verification as well as for travel prediction, but both are in dev.

As the original top commenter noted, you can always do is tell your bank that you're travelling... one phone call is all it takes. I think some banks offer the ability to specify travel status via app as well.

One final thing to note is that as EMV chip cards roll out, card-present fraud will drop significantly (to be replaced by online fraud), so I would expect the models to adjust accordingly.

Re: This is why you call your bank before tourism

[nedlohs]

Yes.

how about lessy shitty implementations?

[Anonymous Coward]

in case of web buys, you could force people to confirm through use of one time pads on their banks systems. the system to facilitate this exists. very few sites use it because credit card processing is so competed nobody seems to care about the rules in the first place. another thing is companies saving the cc data etc...

HSBC are worse

[DCFC]

I have had serious problems with the aggressively incompetent HSBC 'fraud' detection.

The 'best' was when they claimed the reason they had (again) blocked my card was that a whole batch of cards had been compromised and it wasn't just my card.

Sadly for the liar at HSBC was I'm a tech journalist, so I immediately contacted their PR department who denied any knowledge of the breach.

It was just made up to make me go away.

Re:HSBC are worse

[west]

It's likely that your card was used at a location for which an abnormal number of cards were found to have been skimmed. This is usually the reason that a whole batch of cards get cancelled. ("Kill every card used at Joe's Gas Station between Monday and Thursday.")

Ten years ago, the US banks didn't want the expense of switching to EMV. The cost would be that Americans would have to expect to have several cards declined at any one time because of fraud-fighting measures. The banks knew this was the future.

As it was, as all the world's bank card fraud organizations migrated to the US, the US was compelled to switch anyway. (You never want to be the last vulnerable man standing.) They'd have been far better going a decade ago.

Re:HSBC are worse

[radarskiy]

How did you determine which one was the liar?

Re:HSBC are worse

[DCFC]

A perfect philosophical question, impossible for me to answer but ultimately it doesn't matter which bit of HSBC were lying.

Re:HSBC are worse

[Anonymous Coward]

They did that to me because somehow I'm not allowed to hit online sales at 5.30am!! At some point during the year (like now), Aldo-Shoes will announce its yearly sales. Somehow I was doing an all nighter, got the email at 5am and started shopping immediately. Checked out, typed in my SecureCode and the transaction was refused. So i lowered it from £140 to £90 and then it went through. 3 hours later, at 8.30am I get a call from HSBC Mastercard (indian accent) and the guy tells me he blocked a transaction and wanted to confirm if second one was legit. So I told him "On your system, does it say that these transactions were SecureCode authenticated?" He said yes. So I asked with an angry tone: "What business is this of yours to block a SECURECODE AUTHENTICATED TRANASACTION?" He seemed to have lost his voice and apologised. Then I told him "Because of your stupid decision, I lost out on over £50 of sales and the boots I was buying are now out-of-stock. How do you propose I get those boots that Aldo will never make or sell now?" He apologised. About a week later my credit-card protection letter came and it was bumped from £25/yr to £30/yr. Last year when CPP scandal broke, I asked for my refund and got about £200 for all the years that this scam had been going on. I have no regrets because when fraud occurs or a seller is a fraud, we in the UK are covered under various banking protection schemes and distance selling laws (not by CPP).

Re:HSBC are worse

[Anonymous Coward]

You are conflating two different things. It is one thing to cancel a card and send you a new one because of the fraud you were describing. I have had that happen as well. It is another to just decline transactions without any kind of notification. In the first instance you are usually notified that you will be receiving a new card and why. In the second instance you are left high and dry with hopefully another credit card or enough cash to cover the transaction.

Text message on use

[sunderland56]

My CC sends me a text message whenever it is used. It's quick (usually arrives before I've signed the slip), it's free, and it doesn't need some stupid app installed with insane permissions. So, *I* can decide which transactions are bogus, instead of some computer algorithm; and when a truly bogus one does appear, I can notify the bank immediately. The bank can then concern themselves with actual proven bogus purchases, instead of thousands of "suspect" ones.

Re:Text message on use

[thegarbz]

and when a truly bogus one does appear, I can notify the bank immediately.

Why is that critical, don't you have any consumer protection laws? I was in China early this year and someone lifted my credit card details. I didn't contact the bank for a good 6 weeks after it happened (because I didn't know about it), and after that quick phone call everything was sorted out, the 6 week old charges were reversed and everyone went on with their lives.

It seems like your system is a lot of effort for little gain.

Re:Text message on use

[sunderland56]

It seems like your system is a lot of effort for little gain.

Effort on the bank's part: essentially zero. It's just a post-process script.

Effort on my part: essentially zero. I buy something, I get a text, I can ignore it. As an added bonus, when monthly bills get paid automatically, I get a text reminding me, and including the exact amount. Kind of useful, really.

But then *if* my card was ever compromised, I know about it very very quickly. Yes, there are consumer protection laws; but I'd rather be ahead of the game, and alert my bank about fraud as soon as possible, rather than wait for a nasty surprise at the end of the month. Sure, in the end, you won't be out much if any cash from a fraud; but you WILL be out a bunch of time and effort fighting bogus charges, dealing with lawyers and mediators, having no access to credit for a period of time, and suffering potential dings on your credit rating.

It's like being shot, and making a full recovery in hospital. Still nasty. A text message saying "Duck! Now!" is a cool thing.

Re:Text message on use

[Anonymous Coward]

What CC is this? I'd like to get one.

American Express

[LaoTzePhuuk]

I travel quite bit and I have found that American Express (AMEX) does the best job of fraud prevention & detecting bad transactions without losing the ability to use my card.
The only downside is how many merchants don't take AMEX at point of sale :(

Re:American Express

[Anonymous Coward]

How could your findings have been that? Do you have cards from most of the world's major banks?

Re:American Express

[crvtec]

American Express is phenomenal. There are times where I have to work the late shift and end up buying something random at 4AM. Initially, they'd text/call to confirm the purchase, but after a while, they learned my (nonexistent) patterns and haven't blocked any legit transactions. Even when hours away from my home town (vacationing), no declined transactions. With that said, they manage to figure out which transactions are fraudulent, and block them, all without inconveniencing me. If only AmEx got into the antivirus/malware/IDS/IPS business...

Advice: Just cut up the card

[Anonymous Coward]

I've had this happen a couple of times now. Once I even spent a half-hour on the phone, while traveling, with customer service trying to convince them that I was who I said I was. Gave up and cut up the card. Highly recommend just having a lot of accounts and ditching cards after a set time investment (e.g., ten minutes) trying to get them re-enabled.

It doesn't matter what we would like. All that matters is having enough people ditch their cards to wake the credit card companies up to their lost profits.

Re:Advice: Just cut up the card

[Martin Blank]

Closing accounts can negatively affect your credit score by reducing available credit and time of oldest account (and possibly average age of accounts). If you try to maintain the same number of accounts, you also add to the number of applications, which is another negative against credit scores.

Re:Advice: Just cut up the card

[Anonymous Coward]

GP did not actually say to close the account, just to not use the card.

My experience with the lowering of credit score is it is temporary if the accounts are paid in good standing.

Re:Advice: Just cut up the card

[Anonymous Coward]

This is probably true, but the effect is relatively minor. If you religiously pay your bills on time and have reasonably solid employment, you're going to be gold, no matter what the other factors. (Source: personal experience.)

Re:Advice: Just cut up the card

[Anonymous Coward]

Exactly this! I actually yelled at the Capital One customer service rep to just cancel my card at the last instance of them declining my transaction for lunch at a restaurant 5 blocks from my house that I had eaten at a few times before and then wanting to go through a whole multi-department song and dance to get the card back on.

Re:Advice: Just cut up the card

[Anonymous Coward]

And none of this matters in the slightest unless you're planning to apply for a mortgage in the next 18 months.

FUD about credit ratings? On Slashdot? Please ...

Chase cards text and email

[peon_a-z,A-Z,0-9$_ !]

My experience has been actually very good with Chase cards...

They decline the transaction then text you asking to reply "1" for Yes or "2" for No if it was you. Then you just reply "1" and repeat the transaction and it goes through.

Simultaneously they send an email with a green "yes" and a red "no" button that functions similarly.

Re:Chase cards text and email

[rmdingler]

Nice, and very different from the less than pleasant, lengthy series of phone conversations I was subjected to as a Citi customer reversing a fraud denial.

OTOH, I would prefer the fraud software to err on the side of caution, but KISS...>

A simplified reversal process might also include a couple of test questions texted or emailed to a number/email on file.

Re:Chase cards text and email

[Nutria]

My experience has been actually very good with Chase cards...

Ditto. The only time they ever declined *us* using the card is when we used it out-of-state and forgot to call ahead of time.

We've purchased many airline tickets from them without a peep, but have had them detect and block attempted fraud three times (issuing new cards every time).

Re:Chase cards text and email

[Anonymous Coward]

The person who used my cellphone number before I got it had such a deal, apparently, with her bank. Unfortunately, she never notified the bank that she no longer used that number, so I got frequent calls from Chase Bank asking her to respond to credit card activity. At first, I called Chase's response number to alert them to the problem, but after several fails, I simply took to refusing all credit requests made in her name.

I'm sure that her experience was even more annoying than mine was -- and mine went on for months, during which time I found out quite a lot about her personal buying habits.

Re:Chase cards text and email

[rossz]

You don't need to call them when you travel. I used their online banking to set the locations and dates when I would be traveling in Europe. I'm sure the same could be done for other states.

Re:Chase cards text and email

[Anonymous Coward]

An e-mail with big green and red buttons? Are you kidding me? This is a fucking dream for phishers, and strong evidence that you shouldn't trust Chase.

Re:Chase cards text and email

[Nutria]

Chase has an online system for setting dates and locations. We did that, but still got flagged.

Stupid computers. Now we call, and speak to a human. (Ignore the fact that the person we talk to types it into a computer...)

Re:Chase cards text and email

[Anonymous Coward]

My experience has been actually very good with Chase cards...

They decline the transaction then text you asking to reply "1" for Yes or "2" for No if it was you. Then you just reply "1" and repeat the transaction and it goes through.

Simultaneously they send an email with a green "yes" and a red "no" button that functions similarly.

Yes. Our experience with the Chase Slate has been good. It's declined a few things but it was always easy to straighten out.

Re:Chase cards text and email

[RubberDogBone]

This has happened to me too but the problem is when the charge is declined at checkout and you then use a second card to pay.

Then the phone rings asking if the charge was legit. Well, what do you say? If you say yes, MAYBE they will process the charge that you already paid for another way, but if you say no, maybe they block your card from then on or flag the merchant who did nothing wrong.

What do you do? It's a terribly flawed way to determine if fraud has happened.

Re:Chase cards text and email

[Anonymous Coward]

> "1" for Yes or "2" for No

Better not fumble on the keypad.

Re:Chase cards text and email

[Anonymous Coward]

The thing that's bizarre to me is, I use capital one as my primary card, and they do the exact same thing which makes me wonder about the article poster. Within seconds I get a text and an email, and I reply to the text with 1 or 2, and/or click the "I did make this purchase" or "I didn't make this purchase" link in the email and all is dealt with. Of course unless it's newegg, who cancels the order anyway.

And honestly, I'm not sure what this guys problem is. I'd rather an overly sensitive fraud detection algorithm rather than an overly lax one. Perfect would be ideal obviously, but too cautious trumps not enough when banking matters are on the line.

Re:Chase cards text and email

[dbitter1]

Nope, I think they are the worst, by far. To wit:

I get a call from them saying that my card was compromised, used at Walmart.com for some big screen TVs or whatever INCLUDING the proper CVV code. Mind you this is my UA Visa, which sits in my locked desk unless I'm flying that airline and only for that airline... and I haven't flown in several months. But OK, whatever, bad things happen once and awhile. They send me out a new card.

I get my new card, and my first purchase is to get a cell phone from an overseas merchant (yay, unlocked phones for no surcharge!). I activate the card, and even expecting this to go south, put in the travel plans section the UK. Place my order, and... denied. OK, still not too bad, I'd agree the transaction LOOKS suspicious. Call them up, give all my secret details (so now, hope the NSA is taking care to encrypt their notes, as they've skimmed everything someone needs for identity theft from my cell phone conversation) , and they reassure me my security permissions have been adjusted and to go ahead and retry the purchase.

Fine, no big deal other than... grr... merchant killed my account so I have to spend 5 min re-typing in all my information. Then... bam! Denied again! Call them back up, livid... same game again "oh sorry sir, we've adjusted your security settings..." and retype everything and boom... still denied.

Kept the Chase droid on the line this time, and he talked with his supervisor, and whatever, same game... and finally got the card to go through.

Unfortunately the merchant flagged it this time as suspicious (which, now, it was... no fault of theirs) and wanted me to fax my credit history over... politely told them it wasn't worth the effort and sorry to bother them.

---

I've also had Chase reject multiple large transactions from the same store, with card present... like when you are at a closeout appliance sale and want to purchase more than one item, but want to put each one in your vehicle to figure out how full you are...

I guess the most insulting thing, as a former merchant, is that the MERCHANT gets screwed if fraud is passed on, not the bank... so the bank is just making my life difficult... I did not ask for high-risk treatment. At 1-3% of the transactions, they make a LOT of money on me each year, even after the rewards are paid out... so my love for this terrorist treatment is unwelcome, and the new card (from another bank) is in the mail...

Re:Chase cards text and email

[peon_a-z,A-Z,0-9$_ !]

To each their own.

I used my UA card for over $25,000 purchases this year (for the status credit) in the United States, Austria, Germany, and Armenia, and have not had the issues you had. When I do have an issue, such as ordering the new Nexus 5X on Google's site but inputting the wrong zip code, the above mentioned text message response and then properly inputting my ZIP code fixed it.

Additionally I have two Chase Freedom cards, one of which authorized a $750.00 PayPal transaction that was fraudulent, but then emailed me about it afterwards. I confirmed it was fraudulent and it was gone in a couple days.

Your use case of multiple purchases at the same merchant might be indicative of fraud similar to me using the wrong ZIP code, but if you have it set up correct for the SMS response it really isn't an issue; it just seems like user error.

Re:Chase cards text and email

[peon_a-z,A-Z,0-9$_ !]

No, your example it is as follows:

Step 1: Block the transaction

Step 2: Ask if it was you?

Step 3Y: If the same transaction is re-ran, approve.

Step 3N: Block the card

There's no ambiguity to whether the transaction will go through or not. If you say Yes, it will not charge you unless you redo the transaction.

Cancel your card.

[mspohr]

I had this problem repeatedly with my Bank of America Visa card (and so has my daughter). Whenever I would travel anywhere, my card would be declined (often at very inopportune moments) and I would have to call the get the card working again. This even happened when I took the time to call them in advance and tell them where and when I would be traveling. I finally got fed up and cancelled the card.
My other credit cards don't seem to have this problem. I guess they have a different fraud algorithm.
I wouldn't presume to tell the card companies how to do fraud protection. Some do a better job than others. Find one that works for you.

Re:Cancel your card.

[Anonymous Coward]

I took the time to call them in advance and tell them where and when I would be traveling

Mom, I want this! Can I buy it? Please....Pretty please.....

Re:Cancel your card.

[Anonymous Coward]

I had this problem repeatedly with my Bank of America Visa card (and so has my daughter). Whenever I would travel anywhere, my card would be declined (often at very inopportune moments) and I would have to call the get the card working again. This even happened when I took the time to call them in advance and tell them where and when I would be traveling. I finally got fed up and cancelled the card.
My other credit cards don't seem to have this problem. I guess they have a different fraud algorithm.
I wouldn't presume to tell the card companies how to do fraud protection. Some do a better job than others. Find one that works for you.

My Bank of America debit card will always decline multiple transactions at the same place. It is really annoying because sometimes you want to do that. For example, you may have a vending machine to buy a pass for the train and it only let's you buy one card at a time but you need to buy two. Or, this other time when they restaurant refused to run my wife and my food as a single transaction and instead ran it as two separate ones and had the second one decline. It means I have to have multiple banks with multiple checking accounts all with some money in them to work around any one bank deciding to cancel a card and make you be without access to your funds for several weeks until they get around to sending you a new card.

Re:Cancel your card.

[Anonymous Coward]

I found my BoA card to be suspended for making multiple purchases, one right after another, from Humble Bundle.

That was displeasing but very understandable. What isn't understandable is why that's happened about six times now. (To clarify: this has happened when doing the same thing with the SAME merchant, at later dates.) Haven't they figured out that this occasional series of transactions, less than $10 a piece, should be considered "normal behavior" for this particular card carrier?

Tell me about it

[ClickOnThis]

My pet frog used my card without me knowing. Do you have any idea what it costs to ship special-order flies, worms and a massively tricked-out terrarium from Bangkok?

Frog protection my ass.

Re:Tell me about it

[Anonymous Coward]

https://www.youtube.com/watch?...

It's happened to me several times...

[ErikTheRed]

and with different banks, occasionally to the point where they forced me to get a new card (and change a zillion automated payments). I wouldn't mind so much if this actually worked, but none of these cases involved a specific fraudulent charge - it was just done because they thought there might be one later. The irony is that I keep seeing the occasional fraudulent charge that they miss. So as far as I can tell they're pretty close to 100% false positives, and probably not many legitimate blocks.

Re:It's happened to me several times...

[clodney]

Unless you have one of those accounts that sends you a notice for every transaction done on the card, how do you know how many transactions are rejected without your knowledge? It sounds like the only ones you would encounter would be the false positives.

Chase one time...

[JJJJust]

One time, I got contacted by Chase about some charges made while I was in Chicago. No declines, no locked card, no phone call... just an e-mail received 3 days after the fact with a couple of buttons to indicate if the charges were legit or not.

Communication!

[duke_cheetah2003]

The article ask us what we'd like them to do. I'd like them to call me if there's a suspicious charge on my card. Ask me about it, make sure it's ok. If I can't be reached, then sure, reverse the charge and shut off my card, but at least make an attempt to contact and verify rather than just assume!

Experiences Differ

[DishpanMan]

While we all have experiences like this, they do differ case by case. My Bank of America card was like this, where I had to call them because they thought me buying gas was fraudulent. Then they allowed someone to purchase $4k in jewellery online and take cash out in Jamaica just a few months later, and I had to call them to stop things. I switched to Capital One and I like it that they send me a text when something suspicions pops up, and I can reply yes or no to it and it activates or deactivates the card instantly. My Citi card has been ok as well, not as many glitches as the BoA card but not as good as Capital One. I like the quick text or email method now since everyone has a smart phone, and it's way better than calling the 800 number and dealing with some idiot in my opinion.

Oh my!

[Anonymous Coward]

You mean to tell me that the creditor, whom is responsible for issuing credit to you, and insuring charges are true and correct wants to verify a charge from an Indian web site? Could it be, and bare with me a minute, that the issuer has experienced maybe a slightly higher amount of fraud coming from India? And could it also be that, since you're only responsible for up to $50 of liability for bad charges, that perhaps the issuer wants to verify suspicious transactions? And could it further be that as soon as the suspicious transaction posted, and they placed your card on hold, that they, gasp, tried to contact you? That's horrible! You should immediately contact Charlie Sheen and cancel your capital one card!

Re:Oh my!

[Anonymous Coward]

It's a credit card, so the OP is responsible for $0 of the losses as long as it's reported promptly. As annoying as this is when it happens, Capital One does a really good job of getting somebody on the line to verify the charge promptly.

This is why I always carry 2 credit cards and one check cards. It's rather unlikely that I'll ever have all 3 of them declined at the same time. Being stuck in a foreign country with no money sucks. I remember almost being stuck in Hong Kong one time because I had left the ATM card that had my money at home and the subway guys wouldn't let me put the cash I had on my card. I was able to overdraw my account and get to Shenzen, but it was kind of close.

Moral of the story, always make sure you have multiple credit cards and an appropriate amount of cash when you go traveling.

Last time I had a credit card stolen

[billstewart]

It was Christmas Eve, somebody lifted the Visa card out of my wife's purse while we were at dinner. They bought coffee at a mall (successful), then tried to buy a TV at a Radio Shack 10 miles away (failed), and we got a phone call from the credit card company. It wasn't my home state (visiting family, and my mom actually did need a new TV :-) Successful detection!

But I've also had a couple of rounds of false alarms, where I've been traveling somewhere and gotten the "Card declined, call us" when I tried to use the card, because their fraud detector triggered on purchases in an unusual city - even though I'd also used that card to buy the airline tickets :-) They should have done better.

The only other times I've had credit cards physically stolen were once when my wife's purse got stolen (we canceled the cards before they got used), and once decades ago, back when credit card verification was handled with little paper books, and I had to go into the Sears store in Oakland and give them 25 signature samples (which felt a lot like I should also be writing "I will not let my credit card get stolen again".) The thief, or somebody they sold the card to, eventually bought about $1300 worth of stuff over a few months, even though I'd reported the theft and I wasn't liable for any of it.

Re:Last time I had a credit card stolen

[bruce_the_loon]

I would hope (probably a false hope) that the CC card company may know that I've bought an airline ticket, but not the details of the flight itself.

Re:Last time I had a credit card stolen

[Anonymous Coward]

I have had in the distant past credit card statements that show the flight origin/destination. It was not a travel rewards credit card. However, I haven't seen that kind of information printed on my statements in the last few years.

Chase is less bad

[WPIDalamar]

Chase sends me a text when a questionable charge comes in. I can text back to approve it.

Still have had false-positives, and still has never prevented fraud, but at least they make it easy.

No Bed of Roses

[Anonymous Coward]

The person who used my cellphone number before I got it had such a deal, apparently, with her bank. Unfortunately, she never notified the bank that she no longer used that number, so I got frequent calls from Chase Bank asking her to respond to credit card activity. At first, I called Chase's response number to alert them to the problem, but after several fails, I simply took to refusing all credit requests made in her name.

I'm sure that her experience was even more annoying than mine was -- and mine went on for months, during which time I found out quite a lot about her personal buying habits.

Re:No Bed of Roses

[Anonymous Coward]

Hmm.. You should try and figure out who she is.. There's probably a lawsuit in there against the bank for leaking personal information, and you can share the bounty.. :)

Re:No Bed of Roses

[Anonymous Coward]

She did not update her phone no. How is that the bank's fault?

Re:No Bed of Roses

[Calydor]

The bank didn't update the phone number when the new owner of it told them. That IS the bank's fault.

Re:No Bed of Roses

[Anonymous Coward]

The bank didn't update the phone number when the new owner of it told them. That IS the bank's fault.

Uhhhhh, no.
The bank cannot change one person's account information when another person (not the account owner) calls and says "that's my number now".
Think about it. I would not be happy if some random person could call my bank and tell them to no longer use the phone number I had given them.
While they're at it, why not change the mailing address, or the email account?

Re:No Bed of Roses

[Anonymous Coward]

Yep that's one of the huge problems with robo-calls and texts -- they can't or won't process human responses.

Re:No Bed of Roses

[Anonymous Coward]

Did you miss the part where GP said "I called Chase's response number to alert them to the problem"?

The bank refused to update a customer's information even when informed such information was outdated and is causing customer's transaction information to be sent to a 3rd party.

Re:No Bed of Roses

[Anonymous Coward]

The bank didn't update the phone number when the new owner of it told them. That IS the bank's fault.

Uhhhhh, no.
The bank cannot change one person's account information when another person (not the account owner) calls and says "that's my number now".
Think about it. I would not be happy if some random person could call my bank and tell them to no longer use the phone number I had given them.
While they're at it, why not change the mailing address, or the email account?

They can't change the information based solely on a call from a 3rd party, but they sure as hell can (1) mark the phone number as suspect, (2) stop sending text to that phone number, and (3) use other contact information, such as home number or address, to contact the customer ASAP to clarify.

I had similar experience with picking up other people's old number and getting text from banks (more than one). I looked up each banks' complain contact from the regulator, and make it clear that if I get another text from them, I will complain to the regulator next. Every one of them contacted me right away and the text stopped immediately.

Not surprisingly, I do not live in the US.

Re:No Bed of Roses

[rickb928]

More true than you know. PII is a big deal. This should have become an internally reported event, since it disclosed purchase details, and risked significant exposure.

Re:No Bed of Roses

[rickb928]

On the first report the bank should have recognized the disclosure and taken action to disable the phone service and contact the cardholder.

Yes, rank incompetence.

Re:No Bed of Roses

[Anonymous Coward]

Capital One just faced a class action for this sort of activity (ceaseless calls about other peoples' cards); it's been settled and the checks were cut, I'm looking at mine now. Maybe it's time to file same against Chase.

So what do I want? Secure payments!

[putaro]

This whole fraud detection stuff is nonsense. It's just been cheaper for the banks to build this hack instead of actually implementing a secure payments system. Come on, credit card number + name + expiration date + security code? All information that doesn't change?

We're at the point where we can make a smart card that does everything with strong crypto. It could even have a USB connection or, possibly, Bluetooth, to let you make secure transactions from your computer.

Re: So what do I want? Secure payments!

[Anonymous Coward]

As someone who works in a buisness that does this sort of thing I van say with authority that fraud detection and prevention happens constantly. Multiple times a second. 1 in every 5 people have had an attempted fraudulent charge stopped by these systems. And credit card fraud isn't the only type of crime these frausters perpetrate. Wire fraud and identity theft are on the rise and are becomming more and more of a problem as the US gets closer to their pin-and-chip deadline.

I don't know why they've stopped issuing new cards. If I took a wild guess, I would say it's because the fraud detection rate is so good that fraud is stopped it before any damage could be done. As a result, the customer is none-the-wiser and continues to buy things they can't afford.

20 months ago is a long time in the land of CC tra

[Anonymous Coward]

I read your tale of woe. Sorry that you lost your transaction, but using a service in another country 20 months ago isn't going to be in your "regular use profile".

I'm not surprised that CapOne wasn't able to reactivate your card, were they willing to send you a new card?

Not sure the pain of one blown $300 charge is worth the blog post or Slashdot. Or was it the down payment on your kidney transplant?

two-factor authentication style

[behrooz0az]

Interactive confirmation on my phone, A message saying you have 5 minutes to confirm the transaction or it will be revoked. If I'm using my card I'm awake and have my phone with me. I don't care how they do it or what tech they use(irrelevant to this topic). Important thing is it can be done.

Re:two-factor authentication style

[Kazymyr]

Unless the one who stole your card also stole your phone. Which can happen if you keep them close-by. Resulting in 2-factor failure.

Re:two-factor authentication style

[Georules]

It's much more common that your number was swiped or stolen, not the physical card.

Use cash.

[Anonymous Coward]

Use cash.

Seriously. I remember when we could get on a flight, sit down, then have a purser come by and pay in cash for the flight.

OTOH, I let 2 of my credit card companies know where I'll be traveling - they have an online tool for that. Amex seems to figure it out, though I've had 3 different CC refused because they weren't chip-n-pin in Turkey (away from tourist areas). It was embarrassing to take 12 people to a business dinner at a nice restaurant and not be able to pay. Amex, Visa, MC all were refused. I made a stink about this to the MC company and 8 months later, I was part of their early test group. Also got screwed in Amsterdam having to wait in line to get a train ticket from the airport because non-chip-n-pin CCs weren't allowed at the train kiosks. 10 line. Should have just gotten on for free - nobody seems to check for tickets into town.

Also remember traveling around Japan before they started accepting CCards anywhere. Cash was it. It was a hassle to carry the equiv of US$1000 to be able to pay for hotels, but necessary.

Was in Seoul a few years ago - the subway token machines only accepted cash, but a cash machine was available about 50ft away. Got the feeling they didn't want to be accused of tracking riders by name. I dunno.

I still use cash whenever it makes sense for trivial purchases under US$50 - except in transfer airports when I don't have any local currency. That $3 cup of coffee while waiting for a connecting flight just isn't worth it. Also feel bad tipping in USD, but sometimes that is the difference for the bellboy - $0 or US$5.

Re:Use cash.

[Nutria]

Seriously. I remember when we could get on a flight, sit down, then have a purser come by and pay in cash for the flight.

I think you're 80, have Alzheimer's and confuse planes and trains.

Re:Use cash.

[Anonymous Coward]

Seriously. I remember when we could get on a flight, sit down, then have a purser come by and pay in cash for the flight.

I think you're 80, have Alzheimer's and confuse planes and trains.

The poster might be 80, but back in the days when LaGuardia airport was still new that's really how it worked (at least for shuttle flights between DC and NY).

Re:Use cash.

[sunderland56]

Use cash.

Jeff Bezos would like a word with you. Something about screwing with his entire business model.

Re:Use cash.

[Eythian]

Cash sucks, and if you're overseas, keeping it on hand can be tricky.

Not having a chip-and-pin card is the fault of your banks though, they should have got with the program when the rest of the world did.

Also, the one time the Dutch ticket inspectors check is when you decided they're not going to check on this trip. The other time is when you're touristing and have about 20 old tickets in your wallet that you have to sort through to find the right one.

Re:Use cash.

[Anonymous Coward]

Very Fucking Much this.

- It's anonymous (at least as long as "they"[1] don't start tracing DNA)
- It's robust
- It's convenient

What's not to love? I do all my small things with cash. In fact, I boycott my $CORP's canteen since they stopped taking cash.

[1] Yeh, tinfoil and that. To specify "them": surveillance scum and advertising scum (and no, I *do* think there's a "good" surveillance and a "good" advertising, but I likewise think that both of those "industries" jumped the shark long ago and deserve to be pruned by a healthy amount).

Re:Use cash.

[Anonymous Coward]

Can't pay for things on the Internet with cash.

Re:Use cash.

[Anonymous Coward]

Wow how old are you? Purser sounds like a word Terry Pratchett might make up.

Re:Use cash.

[Anonymous Coward]

I thought getting screwed was the reason for going to Amsterdam...

Why no Chip Card Reader at home?

[west]

As EMV chip card readers get cheaper, I keep waiting for banks to offer an on-line verification service where they supply a chip card reader to the card owner, which can then be used to verify on-line transactions. After all, the system is already designed to survive the POS terminal being compromised, so the same should apply to what is effectively a home POS terminal.

Re:Why no Chip Card Reader at home?

[Anonymous Coward]

I've actually got one somewhere in my box of random computer parts. Fleet Bank sent them out when they issued chipped cards circa 2001. Never caught on.

Re:Why no Chip Card Reader at home?

[whoever57]

As EMV chip card readers get cheaper, I keep waiting for banks to offer an on-line verification service where they supply a chip card reader to the card owner, which can then be used to verify on-line transactions

My UK bank does this for payments made through the bank's website. I have a small card reader which my bank sent to me. I insert my debit card, enter the PIN, then, I enter a number that the website gives me into the reader and the reader returns another number which is entered into a box on the payment page. The website doesn't always ask for this type of verification -- only if it is a new payee or I have not sent money to that payee for a while.

Cheques (checks) have almost disappeared in the UK because people just do direct bank-to-bank transfers for payments that would be made via a cheque (check).

Re:Why no Chip Card Reader at home?

[west]

As usual, Europe is way ahead of the curve for this. Widespread adoption (along with the mechanism to allow merchants to use this in the same way as the Visa and MC "verified" service) would pretty much kill card-not-present fraud dead.

Re:Why no Chip Card Reader at home?

[Anonymous Coward]

Hope you are referring to RFID/NFC?

Would be great.. Already available in some laptops, and most tablets and smartphones have it.. Solid-state so less risk of it wearing out.

Just hope they will standardize the protocol/auth...

My take would be:
Device - Phone/Computer etc.

1. Normal public-key exchange to setup a secure channel.
2. Card sends auth-request.
3. Enter PIN / passphrase on device
4. device sends back the PIN / passphrase + the transaction to sign.
5. Card replies back with the signed transaction, plus all transactions since last online transaction. Message encrypted with the bank's public key.
6. Card replies back with the signed transaction. (Cards public key signed by the bank, transaction signed by the card.. This to allow for offline transaction-approval)
6. If online the device sends the message from step 5 to the bank.
8. If online device receives reply from the bank encrypted with the card's public key.
9. device sends the bank's reply to the card.
10. card sends message to device if the transaction was accepted.

For each transaction made a counter should be increased on the card and in each online transaction it could add a larger random-value to the counter... If the bank would ever see several transactions with the same ID or not increasing by one (or the random number) the card could be blocked..
This scheme would allow for bank-extensions within the encrypted blobs sent to/from the bank/card.

Scenario 1: Card is copied. card-holder has made atleast one purchase before the thief - Card blocked.
Scenario 2: Card is copied. thief makes one or more purchase before the card-holder. card-holder makes a purchase. - Card blocked.

To make Scenario 2 more or less invalid make a $0 dummy transaction via your phone straight after visiting a store/ATM. Could be made as easy as just swiping the card over the phone before putting it back in the wallet.....

This would make it possible with secure transactions from almost any computer/phone/store without the risk of card-cloning.. For online transactions from a computer without NFC/RFID/card-reader you would get a transaction-id to input into your phone and then swipe the card. That way the store would not get access to your card-number making it virtually impossible to steal CC's from web-shops.

Re:Why no Chip Card Reader at home?

[sunderland56]

Screw that, I want a card *writer* at home.

Purely for, uh, research. Yeah, that's it, research.

Re:Why no Chip Card Reader at home?

[RubberDogBone]

May never happen in the US. Before the EMV cards rolled out, the main use of smartcards in the US was for satellite TV access cards.

In an effort to stop satellite TV piracy, the Feds made a Big Deal out of making life hell for anyone who bought smartcard readers, which again, would be the same as an EMV card reader. The Feds affirmed that nobody could possibly have ANY legitimate use for smartcard readers so anyone who had them was automatically a satellite TV pirate. People were prosecuted for this, in some cases because they had in fact made things like smartcard-controlled access for their work building or some other actual legitimate purpose. The Feds would hear none of this and simply arrested people left and right.

As a result, I for one will have nothing to do with a smartcard reader. Not in my possession, no way.

Re:Why no Chip Card Reader at home?

[Anonymous Coward]

Some European banks do this. What I wish is that the same chip could be used for public key encrypted email.

Re:Why no Chip Card Reader at home?

[IamTheRealMike]

It's not just Europe. Many parts of the world do this. America is one of the few that's been left behind.

even worse fraud detection:

[doug141]

I rented a huge U-haul on a citibank card. Day of the move, I was buying gas at gas stations every few hundred miles in a line across the US's major interstates. Citibank cut me off after 4 gas stations. Good thing I had a backup.

Re:even worse fraud detection:

[Anonymous Coward]

Same here, with an Amex corporate card. I live in Atlanta and was driving to Dallas. I reserved a room, using the card, in Plano, two weeks before the trip, and on the day of the trip, filled the gas tank every 250 miles (mainly because I had to stop to get out and walk around), and only after entering Louisiana at midnight, did their fraud alert trip.

Re:even worse fraud detection:

[rwa2]

Do you always go to the same brand of gas station, or was it different ones? Something something about when you stop for gas, the merchant puts a hold on your credit account for up to $150 - $250, then a few days later it actually clears for the exact amount you pumped. A lot of gas stations still have signs saying something like that if you charge credit.

So maybe it wasn't your card cutting you off, the vendor just hit their daily hold since you did so much driving in a big truck in one day.

But yes, always good to have a backup for whatever the silly reason.

All of my fraud alerts have been pretty reasonable, though. Usually when I travel I suppose they see that I bought a plane ticket or car rental or UHaul on the card first. They have called us a few times, such as when my wife suddenly made large puchases (e.g. suddenly bought a nice dress at Nordstrom after decades of shopping at off-name stores). They also caught it immediately when someone suddenly started using our CC number to make $100s in mundane purchases in a Target in Chicago thousands of miles away out of the blue.

I secretly think that the banks and credit card agencies sorta enjoy dealing with fraud, though... they must get some sort of insurance knockback or it just makes them feel like they're doing something useful and providing value by dealing with criminals so that us little guys and merchants don't have to and they can justify their 3 - 5% "convenience fees" on every transaction.

Re:even worse fraud detection:

[PPH]

My bank uses a geographic fraud detection technique. So they'd probably flag this sort of activity as well. I just call the service number in advance and tell them I'll be traveling, where and when. I've never had a problem.

Re:even worse fraud detection:

[Anonymous Coward]

This and worse problems can happen to OTR drivers if they don't have a fleet card (or whatever their cc company calls it) and fill up at a non-truckstop. Buying $300-400 in fuel will make the fraud detection go off quite easily.

Re:even worse fraud detection:

[mjwx]

I rented a huge U-haul on a Citibank card. Day of the move, I was buying gas at gas stations every few hundred miles in a line across the US's major interstates. Citibank cut me off after 4 gas stations. Good thing I had a backup.

I've had a Citibank (Australia) card for a few years. I've used it in a variety of places in SE Asia without an issue but I made one withdrawal at an ATM at LAX (this was airside as well) and they immediately suspended my card. It doesn't seem to be that consistent. Especially as I think that the Philippines is a bit more dodgy than the US when it comes to card fraud.

Re:even worse fraud detection:

[Anonymous Coward]

Some of my friends have had the opposite version of this. We drive cars on race tracks. One of my friends' card was declined after 2 days of buying full tanks of gas every 2 hours at the same gas station. In this case, the company assumed someone had swiped the card and was providing gas to all his local friends.

How would you like it to work instead?

[Feral Nerd]

How would you like it to work instead?

I once spent the better part of an evening trying to make a payment via PayPal. After having several payment attempts fail without explanation I first thought that something was wrong with my credit card and called the bank. When the card turned out to be OK I sent PayPal a support request and after a lengthy phone conversation with their support people we finally found out that their fraud detection algorithm had flagged the payment I was trying to make as suspicions because previously I had always made smaller payments in the sub $50 range and now I wanted to buy a piece of audio equipment for a little over $500. That's fair enough, I don't mind fraud detection but I'd like:

1) Descriptive error messages. When the fraud detector fails it should tell me why, exactly why, not just: "There was an error processing your payment.". I should not have to call support to find out what is wrong and when that is unavoidable, first line support should not have to call a second level specialist to find out what the fuck is wrong with the fraud detector.
2) Resolution that does not require a lengthy e-mail exchange or telephone conversations with support staff. When the fraud detector fails there should be a quick and simple to convince it you are not a gangster. At the time PayPal did not have such an option.

I have since stopped using PayPal. Partly it is because of this episode and because PayPal is a bit of a pain to use but mostly it is just due to the amount of phishing mail I get that is targeted at PayPal which is another thing I'd like them to do something about.

Re:How would you like it to work instead?

[rwa2]

Oh, sheesh, I run into crap like this all the time just trying to use my HSA debit card to pay for prescriptions and copays and crap at my health care provider. You think it'd just be a no-brainer, paying healthcare costs with a VISA debit card who's only purpose is to pay healthcare costs. But more than half the time it gets rejected for some stupid reason and I end up calling both my bank and the healthcare administration. Even for routine stuff like fulfilling prescriptions which we've successfully done in the past.

Still beats the hassle of getting them to reimburse FSA claims after the fact, though.

My bank just calls me

[Anonymous Coward]

When one of my cards has a suspicious charge, my bank doesn't block it or lock down the card, they just call me to confirm, usually within a few minutes of the charge being attempted.

This is much more convenient and avoids embarrassing situations when paying for things.

Maybe it's time to switch card providers?

Hmm

[Anonymous Coward]

Nothing wrong with turning down a strange overseas transaction, even if it matches existing legitimate charges, since a lot of banks get calls from angry spouses willing to swear under oath that it is a fraudulent charge.

A more serious problem is allowing crazy activity, such as gas-stations hundreds of miles from where I live, a half hour apart from transactions in my home town. The current algorithms don't seem to do anything against this, at least for many banks (including mine).

Next time it'll be cash

[magusxxx]

I actually had my credit card send me a message because I tipped too much! It was a nicely laid out e-mail that had a column of numbers. And the percentage I added was in bright red. "You paid $12.64 for your meal and tipped $5. Are you sure you wanted to give this much?" YES! Because the waitress was working her ass of during the lunch rush! What's next? "Are you sure you wanted to buy name-brand toilet paper in bulk?"

Re:Next time it'll be cash

[Overzeetop]

Given that this is an area with a large opportunity for fraud (the manually added tip), it's not too surprising. I'd rather have a verification from my bank than find out that someone put an extra zero on the end two weeks later.

Re:Next time it'll be cash

[BradMajors]

I wish my credit card did that. I tipped $5 on about a $20 bar bill. Someone in the bar apparently decided my tip wasn't big enough and instead changed my credit card a tip of $50 on a $20 bill.

Re:Next time it'll be cash

[Anonymous Coward]

Perhaps if it was a $15 or $50 tip on $12.64, but for $5? That just seems stupid. I can see the ability to add a 1 or a 0 to the number but how does one fake a tip of $5? I always leave "generous" tips at low cost restaurants since the standard 15% may very well work out to only $1-3. Thankfully, I have never had anything like this happen.

Re:Next time it'll be cash

[Anonymous Coward]

So you disputed it, right? You kept your copy of the receipt showing a tip of only $5, right? Once you disputed it, the only people who would be out the money would be the restaurant. It wouldn't be you and it wouldn't be the card issuer. I would much rather have to deal with the rare instance of this specific kind of tip fraud when it happens than have to verify the tip at EVERY single restaurant I eat at.

Re:Next time it'll be cash

[Eythian]

You don't get to review before approving it? Here the amount shows on the machine, you select the account, and enter your PIN. There's no circumstance where they can modify the amount without you seeing it. Also, we don't do tips, though I have sometimes (maybe more touristy places) seen the machine ask if I wanted to add one.

Re:Next time it'll be cash

[omnichad]

You don't even need to keep your own copy. If they don't have a signed copy showing that you authorized more, they don't have a chance of winning a dispute.

Its not actually your money...

[myowntrueself]

When you use a credit card you aren't actually spending your own money; you are borrowing money. Its no surprise they are antsy about fraud detection; its they who stand to lose the most.

Re: Its not actually your money...

[Anonymous Coward]

Exactly how can they lose? In Canada with BMO MasterCard, I'm on the hook for *all* charges that appear on the card and *all interest charged* until it is sorted out (check their tos if you disbelieve). I had a charge billed incorrectly recently and tried to reverse it but BMO MC doesn't give a shit. They make money from the merchants - you are just a tool towards that end.

Which is why I never use debit

[Overzeetop]

People are always more careful with their own money. If I haven't paid my CC bill, the CC company is out that money. If it comes out of my bank account, I'm SOL until they get around to figuring it out. It's why I always decline when offered a debit card - WTF would I want *my* money on the line where a fraudulent transaction might occur?

Simultaneous charges in two locations

[Anonymous Coward]

If there is more than one of you on an account, if you have Citibank make sure you know where the other card is. My wife and I got cut off several times because she would be across town and buy something within minutes of me buying something (both charges under $100) . Their fraud detection would block the second one. First time they told us it was a fluke, second time it happened now she uses one card and I use one from another bank.

Changing policy

[ohnocitizen]

On the whole I appreciate when my bank does this. However I've been in another country, cards working fine, only to find out a transaction before I left was deemed suspicious. Cut to a few days later and they decided to stop both of my cards. I'm now in another country with no working access to my funds. At the very least they should have contacted me when the "suspicious" transaction took place, so I could confirm it.

I'd like to reverse the process

[Todd Knarr]

I'd like it if, rather than the merchant charging me and the bank having to figure out if it's legitimate or fraudulent, I send a message to my bank/card-issuer saying "Pay this merchant this much, here's their reference number and here's my TOTP authenticator code.". That should reduce the problem dramatically, and turn the physical card and/or knowledge of the account number into a last-ditch resort when I can't get a data connection, can't get a text message out, can't get a voice call out or don't have my phone with me and the store doesn't have a phone line I can use.

like Amex Blue, circa 1999?

[Anonymous Coward]

As EMV chip card readers get cheaper, I keep waiting for banks to offer an on-line verification service where they supply a chip card reader to the card owner, which can then be used to verify on-line transactions.

Was tried back in 1999 http://www.nytimes.com/1999/09/19/business/personal-business-a-credit-card-for-internet-wary-shoppers.html. Died because there was no standard for how onljne websites should securely interface with the reader. I'm fairly sure that EMV still doesn't provide a standard for websites (aka payment processing devices the payment processors don't control) to securely interface over the Internet with a chip reader on a consumer's premises.

Re:So what do I want? Secure payments!

[Anonymous Coward]

This whole fraud detection stuff is nonsense. It's just been cheaper for the banks to build this hack instead of actually implementing a secure payments system. Come on, credit card number + name + expiration date + security code? All information that doesn't change?

Credit cards don't even track the customer's name. Try it sometime. Order something online and put in Bilbo Baggins for your name. The charge will go through just fine.

Stop using CapitalOne

[Anonymous Coward]

They're awful in general, frontline customer service to C-suite. Get an Amex Gold charge and a Chase Sapphire Preferred. Avoid foreign transaction fees and bad customer service.

A Chase rep just picks up the phone when you call for the Sapphire, no phone tree, no entering your phone number. Dial and a human answers. Amazing. They also have a great text based fraud alert/legit charge confirmation system. You get a decline and they send a text immediately. Respond 1 if it's you and your charge goes through.

Amex has the gold standard in customer service. I've never been unhappy with Amex. They're simply the fucking best. Overseas acceptance may not be as high, but that's what the CSP is for.

Also, they both have awesome rewards/transferable points programs.

Get Amex.

[Anonymous Coward]

American Express' fraud detection always impressed me, and they call me right away. If that doesn't work, they fall back to text and email. They never shut off my card (I think their algorithm sets a shut off for transaction larger than X), because i could still buy coffee, lunch, groceries, and gas for my car that day. They did try to call me right after the grocery store transaction though.

I like Amex. They're very proactive and immediately freeze suspicious purchases. The fraud detection only kicked in 3 times the 14 or so years I've been with them, and only had 1 fraudulent purchase. Even then, they immediately sent a replacement card.

One word:

[Anonymous Coward]

CASH!

Captcha: illusion

Re:One word:

[omnichad]

If my cash is stolen, I don't get it back.

Citi is the Worst

[rainmaestro]

There's a gas station 1/4 mile from my home that I buy from 2-3x a month using the same credit card. Once or twice a year one of those purchases would get flagged by Citi and locked my card, even though there was a clear pattern of use.

On top of that, I had an absolutely infuriating experience using a Citi card on a decent-sized Newegg purchase (~$600). I've made about a dozen purchases from there over the past couple years. They declined the charge as potential fraud and sent me a fraud alert. I confirmed it was a legit purchase and re-ran the order about 15 minutes later. Citi declined it again as potential fraud and sent me a second fraud alert.

At that point I called them up and closed every account I had. Will never use Citi again.

I've had/have credit cards with pretty much every major issuer. Chase, Citi, Barclays, BoA, Amex. Chase has by far been the best about not screwing up fraud detection. Citi is the worst. The rest are decent.

my credit union calls me in seconds. Cashiers shou

[raymorris]

I've been happy with my credit union's fraud prevention and detection (which is outsourced to some company). Sometimes I'm 100 miles from home when I spend about $800 on electronics at Fry's or Microcenter. (The datacenter is 100 miles from my house, for now.) The transaction sometimes returns a "call to verify" code. The merchant COULD call, they are supposed to, but most cashiers just say "it didn't go through". This is a training issue on the merchants' side, in my opinion.

At the same time that the cashier is saying "it didn't go through", my phone rings. It's the fraud department calling to verify the purchase. The cashier re-runs the card and it works fine. It seems to mainly happen when buying from an electronics retailer, as I also remember the same thing at Best Buy. I'm fine with that. I know that if a crook gets my card, the bank is watching out.

Occasionally, they'll call about an internet purchase or some other purchase after it happens (fraud detection). It's quick and easy to verify the transaction.

I used to do another type of fraud prevention and detection, not directly related to credit cards, and I know our false positive rate was under 0.1%, probably under 0.01% - we stopped at least a thousand fraudulent instances for every one we declined in error.

Re: So what do I want? Secure payments!

[Anonymous Coward]

thats a pretty good troll there

we don't need to change the card numbers because the fraud detection is just that good

Use An Amex If Possible

[Anonymous Coward]

I have been with Amex for years travelling and buying stuff in countries all over the world without notifying Amex first of travel. Never had a problem...unlike with Chase or Capital One where I have to spell out exact dates and itinerary before travel otherwise my cards will randomly get cut off at the worst possible moments.

Their algorithms are pathetic...

[gweihir]

The problem is, reasonable fraud detection has a competent human in the loop and that costs money. Unless we get strong AI (which is highly doubtful to ever happen), that will not change. If they remove the human, both the false positive and false negative rates surge to unacceptable levels, but the cost is paid by their customers, not by them.

Hence the source of this problem is plain, old-fashioned corporate greed. I suggest you look for a different bank to get your cards from.

To illustrate what good handling of this looks like: I was some time ago issued a new card without cost and without asking for it. The bank told me on request that my card was used with a company that may have gotten hacked and in order to make sure I do not lose its use they took that step. Now, that is what good customer service looks like. Of course, this was not a US bank.

Re:Their algorithms are pathetic...

[Anonymous Coward]

I work in the business of credit card fraud modeling.

The algorithms are better than humans. There is only a limited information available to the card issuers---they do not know your life---just date, time amount merchant and a few other pieces of information.

They need to make statistically sound decisions over large portfolios from limited data. Humans are worse at quantitatively balancing factors than empirically derived models, though they understand more about the real world.

If you were to see streams of card data as they come from various customers, you'd recognize how difficult it is to tell what and what isn't fraud by inspection.

The underlying fraud rate may be 1 of 10000 transactions. With the systems, it can be improved so that they catch 1 fraud for every 20 false positives.

Re:Their algorithms are pathetic...

[gweihir]

I said "competent human", not "human". There is a rather large difference. I also said "human in the loop", not "purely human". I am quite aware that the algorithms alone are better than humans alone and that they are critically needed to filter down the volume, but the combination of both is a lot better and currently the only way to reach a good outcome for the customer. 20 false positives per fraud caught is pretty bad. Please note that I had access to fraud data including full analysis in the past and have done risk analysis in the area.

And do not give me that "they do not know your life" nonsense. That is not even true in countries where strong privacy laws exist. Sure, that context is needed to distinguish between the different fraud cases (including fraud by the customer), but it is available. Just blocking the card immediately and without said review by a competent human being that also looks at what the customer has done in the past is quite expensive. Of course, most of the cost is on the customer side and for the bank it is cheap, especially when they also have cheap customer service and only short-term planning, so customers that leave for a different card provider do not factor into the bonuses of those that make the decisions.

Re:Their algorithms are pathetic...

[germansausage]

How do their algorithms take into account me phoning three days before my trip to Canada to tell them I'm going to Canada, and them still freezing the card as soon as I try to make my first purchase?

Credit Cards

[ledow]

In the EU (but not the UK), banks will send you a text for EVERY credit card transaction. If there's a problem, you can contact the bank. It's also free.

Are you really telling me, in this day and age, that we can't have suspect transactions result in a text to your phone that you can then authorise - even before the web page refreshes?

Banking is so in the 1950s of computing that it's laughable. It's done deliberately in some circumstances to profit from charges, fees and the timings of clearing payments. But you can't claim fraud if you haven't taken SIMPLE measures against it.

Like asking the user to confirm suspect transactions using a secondary method (that can be phone for old people without mobile phones, text for those with phones, maybe even the bank's secure app if you so choose). Declining a card transaction because it comes from an unusual place is no longer a metric to decide on the suspicion assigned to a transaction. I've purchased from all over the world, especially in the run-up to Christmas when Amazon, eBay et al only stock the normal boring stuff and I want something a bit different.

In one instance, my Italian relative came over, went to a DIY store with us, paid for the transaction and KNEW BEFORE WE'D HIT THE DOORS that he'd been double-charged on his bank account. A text came through, then another, in a foreign country, before he'd even left the shop. And we were then able to cancel the second transaction.

Why the fuck isn't just this standard practice?

Re:Credit Cards

[Anonymous Coward]

And what good is a text message to a phone I'm not carrying because I'm traveling internationally on vacation? Maybe that works for you but I don't feel like getting bent over and ass raped by my phone company for having to carry my phone internationally.

Re:Credit Cards

[Anonymous Coward]

As a US credit card holder, I'd rather not have to deal with a text message or an email for every goddamned transaction. I have a login for my bank, and if I want to check a transaction, I can. Don't clutter up my life with more spam.

Also, my bank does a perfectly good job catching fraud. I've never found a fraudulent charge myself, but they've caught them a couple of times. My card stopped working, and when I called, they had put a freeze on the card already. When I verified that the charges were fraudulent, they issued a new card.

THIS WORKS FINE AND DOESN'T REQUIRE CHIPS OR PINS OR CONFIRMATION TEXT MESSAGES.

Get that through your thick, uppity, European skulls!

Re: Credit Cards

[Anonymous Coward]

It takes good regulation that's why. Something the US government and citizens seem to have been brainwashed into thinking it's not required. In Australia we have had very good regulations on banks and have some of the lowest fees on credit cards in the world and very very good internet banking and fraud detection. I got a phone call the other week straight after a large transfer online from afraid person checking it was me. Great stuff.

Text message confirmation for overseas online transactions seems to be a standard MasterCard uses for me so not sure why the USA banks don't use it.

humor in advertising

[Anonymous Coward]

I find it very amusing that the advertisement at the top of this page is for Capitol One credit cards. Seems they know when they are
being talked about, but not when to go hide.

How it should work.

[gaiageek]

- Immediate call if a charge is suspect. I had this happen recently making a big purchase at Home Depot. Card got declined; I was confused. Then my phone rang with the card issuer on the line. Confirmed my identity (smart, phone could've been stolen) and that the charge was legit. Re-ran the transaction and it went through. Catch: For this to work smoothly, the call really needs to come in within 60 seconds, otherwise I would probably try another card for fear of holding up the line.

- Instant notification for ALL charges. Notification by text message and additionally email. If your card is compromised, the thief will often try a small charge as a test to see if the card is still valid. This happened to me recently: I had email notifications setup for charges made, but the bank only sent the notifications for charges over $10, so i didn't see the first fraudulent charge and only found out later when they called me about a $300 charge at nikestore.com in the Netherlands (US-based card). Each text message should be appended with a message like "If you did not make this transaction, reply 'NO' to this message." A reply would freeze the account until you can call in.

- App-based 2-tier authorization - You make a charge and a notification pops up on your phone with the details requiring you to confirm the transaction before it gets approved. I'm wary about this one because it would require having your phone and a working connection at all times, and it could leave you screwed if that isn't the case.

Been there, done that

[JustAnotherOldGuy]

Yes, CapitalOne will turn off a card at the drop of a hat. Sometimes that's a good thing, sometimes not.

I make regular trips to Cambodia and the first few times I did something like pay for a meal or a hotel room they (CapitalOne) froze the card. Okay, I get it, they're erring on the side of safety, and frankly I appreciate that. Better safe than sorry, right?

Soooooooo, the next few trips I called them in advance and told them that I'd be going to Cambodia, I'm gonna use my card there, yada yada yada. And they still froze the card.

Lather, rinse, repeat. To make a long story short, EVERY time I go to Cambodia and use my CapitalOne card I expect it will be frozen within an hour or so. And I'm always right. ALWAYS. And I always fire up Skype, call them, explain the situation, and they unfreeze it, usually for the duration of the trip (2 to 4 weeks).

But without fail, the next time I go to Cambodia (after notifying them I'm going) and use the card, *BAM*, it's frozen again.

Honestly, I appreciate them erring on the side of caution, but NOT after I've pre-called them and warned them that there will be foreign transactions on the card, specifying the city and the date range.

I mean seriously, CapitalOne, get your shit together. Days in advance I tell you where I'm going and when, and you still can't get it right.

It's even worse as an international merchant :-(

[Anonymous Brave Guy]

I had my card suspended because i sent $2.50 over paypal to a kid in the UK for some software.

I'll see you that and raise you how it looks from a UK merchant's side. Running a simple on-line service with a small monthly subscription fee and a fair proportion of international customers, we literally lose more subscriptions because of unexplained card failures than all other causes put together, including active cancellation by a subscriber's own choice.

Worse, as far as we can tell, there is absolutely nothing we can do about it. The system simply doesn't work reliably and there is no useful information whatsoever provided to the merchant when the card fails. About the best you can do as a merchant is contact your customers after the failed charge, try to convince them that their card being declined is neither an indication of fraud on your part nor something they should be embarrassed about themselves, and hope they are willing to sit on the phone being told how important their call is for a few minutes while they wait to speak to their card issuer and confirm it's a valid transaction. Unsurprisingly, relatively few customers will actually do this, even those who have otherwise been active customers apparently happy with the service.

The card industry's incompetence is a tax on trade, and the sooner it dies its long overdue death and payment methods fit for this century take over, the better off literally everyone involved else will be.

Yup same happened to Me

[Anonymous Coward]

Well, used trivago app to get hotel reservation in the next state over, only trivago sent me to a span based website that got the best deal for that hotel, hot.es.
  Tried to use it, and my card was shut off.

I have this problem many times

[Georules]

Every few years, I buy from newegg.com. Every time my CC company flags and declines it and I have to call to clear it.

I rarely travel, perhaps a flight every few years. My card gets swiped at the airport check-in and the next day I see 10,000 in flight charges. I call and tell them they are fraudulent charges. I have to fight with them for weeks to get the charges removed.

I personally would like an app where charges over $500 require a 2-stage authorization. Just ping me and I'll be the final call, they can't decide what's fraudulent or not on their own.

Wells Fargo does the same thing...

[Anonymous Coward]

I was just trying to pay for my son's tuition. I'd payed before using the exact same card without problems. This time, they declined the charge citing the same BS fraud trigger...no explanation for why it was accepted in the past without issue but this time it was blocked. I hate dealing with WF Customer Service, they're just working from a script, and spend more time verifying who I am than actually resolving any issues.

Capital one is actually one of the better ones...

[140Mandak262Jamuna]

I always make it a point to let Capital One know before I use the credit card in India. They send me texts when the card is used.

Last year I told them I was traveling to Europe and India for two weeks. Found out in London that all their retailers use credit cards with pin numbers. American credit cards without pin numbers are authorized by the discretion of the retailer. Apparently if I use the card and deny making the charges, the merchant is in the hole in UK. Not sure if this is true, this what the pizzaria near Trafalgar Square told me. Anyway there were tons of fraudulent charges from London, mostly airline tickets bought from London to African destinations. Capital reversed ALL the charges from London. Had to call back and tell them the bonafide ones, I didn't want the legitimate businesses to suffer.

So far all the experience I had with credit card companies (Citi, Capital One) or debit cards (Schwab) were uniformly good.

The only minor negative experience was when Citi left a fraud alert phone message that let the cat out of the bag about a surprise Las Vegas trip I had planned for my wife.

Re:my credit union calls me in seconds. Cashiers s

[TWX]

And I've had times where I was trying to pay for something basically essential and the card got rejected and I had to call. In my case it was buying automobile tires, on a Sunday because that's when the tires gave out and only a few tire places are open on Sundays, in my own city, and they decided to reject it.

I think that the fraud-detection algorithms need improvement.

Possible solution

[Stonan]

I got a prepaid, reloadable MC thru my bank (BMO). Since it can only be reloaded thru online banking and my purchases happen right after loading they might not be looked at as suspicious. The only time it was 'suspended' was when someone in another country tried to charge $1200 with a balance of 58 cents.

Happens to me all the time.

[theNetImp]

I live in Japan, but all my finances are US based. This happens to me a few times a year, and it's annoying because 1) the bank knows I'm in Japan, 2) I shop at the same 10 places. I'll get blocked for iTunes purchases even though I habitually buy stuff from iTunes. The whole thing is retarded. I could see if I suddenly made a purchase in India or Spain, but seriously WTF? At least now the bank I use allows me to clear it with the "app" so I just need to ask the cashier nicely to wait 2 minutes while I deal with the bank's stupidity....

How would you like it to work instead?

[Fnord666]

How would you like it to work instead?

I would like it to approve 100% of the transactions that I do and decline 100% of the fraudulent transactions that someone else tries to do with my cards. Why would you want anything else?

They want to save in insurance

[Anonymous Coward]

... nothing more.

They simply do not care about false positives, as long as they reduce the number of missed real fraud incidents.

Because: the less fraud goes through (has to be compensated), the lower their insurance rate is.

Simple as that.

Re:They want to save in insurance

[poeggi]

ack!

Summary of discussion

[quantaman]

Group A: Fraud protection sucks because of a single anecdote I have where the facts I present make the credit card company sound really uncaring and incompetent!

Group B: The plural of anecdotes is not data! Fraud protection is a really hard problem and generally works really well. Oh no, I don't actually have data.

Group C: First post!

CapitalOne Website Instructions

[Tokolosh]

1. Sign in to capitalone360.com.
2. Click on the 'My Accounts' tab.
3. Click '360 Checking' under the "Checking and Savings" section.
4. Go to the 'Debit Card' tab.
5. Click 'let us know' under the "Travel Plans" section.
6. Enter your Departing Date, Returning Date and locations for international travel.
7. Click 'Submit.'

Don't use 'em

[cascadingstylesheet]

I just don't use credit cards anymore.

'course, the bankruptcy helped with that decision ...

Re:Don't use 'em

[antdude]

So, cash?

Re:Don't use 'em

[cascadingstylesheet]

Debit card.

If you are not happy

[Anonymous Coward]

If you are not happy with the credit card, there are lots of other companies who want to give you a credit card. Just get another card. Easy peasy.

Re:my credit union calls me in seconds. Cashiers s

[Anonymous Coward]

And I've had times where I was trying to pay for something basically essential and the card got rejected and I had to call. In my case it was buying automobile tires, on a Sunday because that's when the tires gave out and only a few tire places are open on Sundays, in my own city, and they decided to reject it.

I think that the fraud-detection algorithms need improvement.

That's all fine, but you'd improve them to what point? Do you know what the rate of false positives is for your processor?

The "algorithm" is not exactly magic. Your transaction is run against a bunch of fairly straight forward rules that differ from bank to bank. It's much simpler than email spam filtering, and there will always be false positives.

If you don't like it, switch banks.

The card co doesn't know...

[Anonymous Coward]

The credit card companies in Visa and MC networks get messages from Visa or MC, not from the merchant directly. Thus while Visa or MC get info about what was purchased, all the banks see is amount and where the charge is from. This makes it hard to do some kinds of fraud detection. The closed loop networks (Discover, Amex) get more information and so have an easier time of it.
Sometimes Chase can get more information if the acquirer (the outfit the merchant contacts with the card info) is actually owned by them. Sometimes
it is, as they own at least one large acquirer. When this happens it is possible to tell what is being purchased and get fraud detection working better. Other
banks are in the same boat; there are a good many acquirers and anyone in that business will see possible advantages in being able to know more about
what a transaction is.

As for multi factor authentication, there are ways to do it with the old network but the push to using EMV cards limits the situations where that can
be done. Recall EMV was designed for places like Europe when their phone system was really crappy and could not be used for routine transactions
(unlike the US situation where the phones could and can be used to contact the issuer.) With that kind of hookup of course internet purchases were
very very rare, so e-commerce never got considered in EMV. So there's this bulky complex protocol designed to allow authentication directly to
the CARD, but unless the transaction is face to face at a brick and mortar merchant, it's fairly useless. There is meanwhile a lot of effort to find some
way to use cell phones for remote auth, with the disadvantage that cell phones are remotely hackable in principle, and once any platform becomes very
successful, it can be expected it will be attacked. Also to the extent phones replace cards, card companies risk having their customer base preempted
by outsider companies. These might lose their shirts to fraud too, but it will take a while before that happens and the card companies still get hurt
then.

1% problems

[Anonymous Coward]

Translation: Hi, I'm rich, so I'm travelling abroad, and I experience problems none of you know about.

Re:1% problems

[germansausage]

You don't have to be rich or be traveling abroad to experience this. I put down a deposit for renting a fishing cabin for 2 days on a lake 200 miles upcountry. The same day I was trying to buy gas at home with a credit card and the transaction got flagged and i had to call the card company before the gas purchase could be completed.

Capital One really sucks in this regard.

[Anonymous Coward]

I just cancelled my GM card that I had for 14 years because of precisely this. It is currently issued by Capital One but was previously issued by HSBC. I can't count how many times I have been inconvenienced by them randomly declining small transactions at places I actually frequent. The last straw was at a fast casual restaurant that did not accept Discover (which would have been my backup). I called and verified my both with my phone number which is linked to the account and with the last 4-digits of my social and mom's maiden name. This should have been an easy unlock and proceed but instead they transferred me to their security department, kept me on hold for ten minutes (keep in mind that I am standing in line at a cash register with people behind me), and asked me to reconfirm everything. I did as much as I could but by this point my mild annoyance had become a barely controlled rage. It didn't help that the offshore security support dude was mumbling and speaking way too low . I told him that I just wanted them to allow me to purchase my $6 lunch. The last straw came when he told me that he would need to ask me a few more questions. I snapped and yelled him that I wanted the card cancelled. I have had a Discover card for at least as long and if I were to say that I have been inconvenienced twice over that same time frame it is probably too high. What Discover does if they suspect fraud is that they send me an email to confirm the last few charges. According to the reply I got from the morons at Capital One, they occasionally need to verify charges. Apparently, by randomly declining charges. Bzzt, one of you is doing it wrong. To close, I also got dinged by this same card when I was travelling. I travelled to Canada a few years back. I called both cards and informed them that I would be travelling to Canada for two weeks. During the trip, we were driving and I needed to stop and get gas. My cash reserves were low, we were in a rural area, and the morons DECLINED, THE, FUCKING, CARD. Thankfully, we did have enough cash on hand to make it to our destination,

Re:Capital one is actually one of the better ones.

[Anonymous Coward]

My experience has been the opposite. I think that they were bad enough that I recently cancelled my capital one card over it. I didn't cancel it over decline of use in a foreign country, I cancelled it because I was frequently getting declined for smaller transactions at places that I have visited before. I have generally found Discover to be quite a bit better about dealing with potential fraud than Capital One is. Discover's big problem is that outside of the US they are pretty much useless.

Re:my credit union calls me in seconds. Cashiers s

[Anonymous Coward]

Not all card fraud is online. If pickpockets/muggers get your wallet, they will of course buy new wheels in "your own city".

Android App

[JustNiz]

I REALLY wish that Capital One could understand and cater to their UK customers that now live in a different country.
Even their Android phone app wont work unless you have a UK cellphone number. WTF?

Re:my credit union calls me in seconds. Cashiers s

[ILongForDarkness]

Also the bank is on the hook for the fraud so they rightly so will be as tight as they can get away with without losing customers. This is why I always have at least $200 in my pocket at all times. Might not be enough for tires but can generally get me food, a place to stay and a ride home should anything go wrong.

Just get another card already

[sirwired]

It's not as if there is only some tiny selection of credit cards available... If CapOne does this to you repeatedly, why haven't you defected to another card yet? Voting with your wallet is a lot more effective than whining on Slashdot.

and what do you do without cell phone service?

[Anonymous Coward]

There are lots of places in the world where cellphone service is non-trivially obtainable for a vacationer. Sure, I could pay the extortionate "international service" rates offered by AT&T (and let's not talk about "just get a local SIM" in a place where they don't speak a lot of English, or where you're not familiar with even how to go about doing this, etc, and I'd have to call my card issuer and tell them my new number.)

No accident

[Wolvey]

I was traveling through Europe for a month and of course I notified my bank ahead of time where and when I would be traveling. About halfway through the trip they shut down my credit card for "suspicious activity" (hostel, food, train tickets, all purchased in the locations I specified to them). Fortunately I had my debit card, so I used that to get me through the rest of the trip. When I got my next bank statements, they had charged a 1%+ exchange fee per transaction to the debit card I had been forced to use, while the credit card they shut down had no exchange fee. Wonder how many billions they rake in a year off that scam.

It's not you, it's the merchant.

[Above]

Remember that the algorithms not only look for patterns with your card, but patterns from merchants as well. It's quite likely the algorithm didn't get your spending habits wrong, but found a series of fraudulent charges from the merchant and marked them all as bad.

If you frequently buy internationally you need a bank that offers text or app based purchase verification. When a purchase is made with your card that looks questionable, they push an alert to your cell phone. Ack it and they now have a two-factor authorization for that purchase, and will generally allow it. If you travel overseas, particularly to high fraud countries, it is well worth calling or online chatting your bank and letting them know the countries in your itinerary, they will make adjustments.

I wanna bitch too

[redmid17]

My regional bank didn't bat an eye when I studied abroad and failed to mention that I was travelling for an extended period. I checked with my parents and they hadn't said anything either (same bank but no account access). 7 months of transactions, ATM withdrawals, and other activity across 7 different countries nearly 4000 miles away from triggered nary a warning.

Fast forward another 6 months and several out of state trips and "large" purchases, I drove down to Florida for spring break. As I went to pay for lunch for my roommate and I, I found out it was declined. Luckily he covered and I called the bank. They decided to cancel my debit card -- on a college student eligible only type of account -- without warning and told me to show up at a branch to get a new one, despite being a thousand miles away from the nearest branch and with less than $20 in cash in my pocket. It took an awful lot of cajoling, not backing down, and pleading cash poverty before I even got to a manager who could "uncancel the card" until I got back to a state with a branch, despite being told for an hour that it wasn't possible to do. When I got home, I found my new debit card but kept using the old one until it was deactivated. It never was, and when I lost that card I activated the "new" card and it worked perfectly.

Why credit cards?

[Anonymous Coward]

Europe has a banking system, with card tied to the accounts, protected by PINs. A shop needs a machine to read them and a contract with its own bank (25 EUR/month, including the hardware, if rented), transaction cost is about 0,07 EUR, regardless of the amount paid. Money is transferred from one account to another basically instantaneously. Credit cards on the other hand, traditionally completely without online verification, and with transaction fees in the range if 0,5...2%. Why would anyone want that?

That said, I do have a credit card (mastercard) to pay a US-based online gaming company. Monthly recurring payments of the same low amount. Then, one day, transactions started to fail. Called my bank. They said have no idea why it doesn't work. The masterard server in the US is rejecting the payment, and they have no access to the server. Calling mastercard in the US (and requesting an English speaking person) still just redirects the call back to the bank. No-one with any decisive powers is reachable. Luckily it wasn't for anything important, but basically, such a card is completely useless for any real use.

Re:It's even worse as an international merchant :-

[caferace]

Running a simple on-line service with a small monthly subscription fee and a fair proportion of international customers, we literally lose more subscriptions because of unexplained card failures than all other causes put together ...

This one is easy, as I do something similar. Peoples cards expire, and they don't update their user data if they've been subscribed for a while.

Re:my credit union calls me in seconds. Cashiers s

[aitikin]

I've been happy with my credit union's fraud prevention and detection (which is outsourced to some company). Sometimes I'm 100 miles from home when I spend about $800 on electronics at Fry's or Microcenter. (The datacenter is 100 miles from my house, for now.) The transaction sometimes returns a "call to verify" code. The merchant COULD call, they are supposed to, but most cashiers just say "it didn't go through". This is a training issue on the merchants' side, in my opinion.

Actually, you're wrong. The merchant can call all they want, but the credit card companies will NOT permit the charge to go through until you approve the card. Voice of experience here, I have called it in time and time again, for the past 7-8 years (at least), we'll get nothing out of it until the card holder provides this is a valid charge. In fact, if it's a "Card not present" transaction, the merchant is not supposed to run the card again for 24 hours (according to their card member agreement). Most do it anyway, but they're running the risk of it being challenged.

Source, I work for a company that literally does a million dollars in credit card transactions (probably 99% of them "card not present") a day. I work with a verification department that THOROUGHLY investigates everything and often requires more than the credit card companies to ensure we're properly verified.

Re:my credit union calls me in seconds. Cashiers s

[aitikin]

Also the bank is on the hook for the fraud so they rightly so will be as tight as they can get away with without losing customers. This is why I always have at least $200 in my pocket at all times. Might not be enough for tires but can generally get me food, a place to stay and a ride home should anything go wrong.

Unless it's a card not present transaction, in which case the merchant is entirely on the hook unless they can somehow prove it was the cardholder making the charge (good luck with that).

Get a new company

[Anonymous Coward]

I have never had anything like that happen in the 20 years I've been using credit cards. I have a Discover card, an American Express ( Costco membership, pretty much only use it there unless the vendor doesn't take Discover ), and my credit union ATM card / VISA.

Re:It's even worse as an international merchant :-

[Anonymous Brave Guy]

Peoples cards expire, and they don't update their user data if they've been subscribed for a while.

Sadly, it's definitely not that simple. I'm already excluding all other identified forms of card failure, including expiry. And actually, that particular issue isn't such a big problem these days anyway, as there are mechanisms to avoid routine card expiry or change of address details breaking existing subscriptions now that most of the major card schemes participate in.

What I'm talking about here is literally just some neutral "payment refused" code, and that's it. We've queried the high rate of failures with our own payment service, and they are (or at least say they are) in the dark as we are. We also know of a few other small businesses with a similar story, so it's not something special about us or probably about the payment service we're using.

Our hunch is that because we're in the UK and we see a dramatically higher proportion of such failures from customers abroad compared to back home, the charge from a different country is considered a big signal of potential fraud by some customers' card issuers, and since we see a way dramatically higher proportion of failures around the second or third month of a subscription the lack of CVC on repeat transactions is enough to tip us over someone's threshold.

Indian company isn't very reputable.

[Anonymous Coward]

They were right to decline it.

Get a better card

[andymadigan]

I've been annoyed by this many times. The solution is to get a card from a better bank. Cap One is awful for many, many reasons (former customer).

First time, HSBC started refusing charges while I was three hours from home. Took them hours to call me and re-enable the card.

Fidelity's FIA-issued Amex is the absolute worst. I had an online purchase declined, called them (they don't call you when it happens) and was then told their computers were down and they couldn't fix it. I've been told the same thing at least 2 other times in the last six months (when I've called over other declines, including one less than a thousand feet from my home).

Citibank is the only card I've had where the system is reasonable. When the card has been declined (once for a web purchase, the other buying an iPhone at a store). The automated system calls me immediately, and it's pretty simple to get it to allow the transaction on retry. Ideally you'd have the option of confirming the purchase via an app. Touch ID on a confirmed phone should be more secure than an IVR call.

The Citibank system works fine for now though, there's really no excuse for other banks to not use a similar system. I've actually stopped using my Fidelity card because their fraud system is so paranoid.

Re:my credit union calls me in seconds. Cashiers s

[TWX]

Obviously. On the other hand, if I have a rather long history of auto part and auto-services transactions, and if the transaction is for $400 worth of tires, rather than $2000 worth of wheels plus tires, one would think that the likelihood of it being a fraudulent transaction is very small.

"my" credit card

[Anonymous Coward]

Count how many people that comment believe a card is theirs. The reality is that the documentation clearly states it is not your card. The fraud and burden that goes along with the entire system should be on the issuer of the cards. It's their system, not the consumers. Hell, they send blank checks that could be used for mail fraud on a regular basis. The reality is that as long as they can keep pinning the responsibility on the consumer, without changing the system that allows fraud, they will. A little security theater goes along way, for idiots. An inconvenience to the consumer is just that.

you're insane?

[raymorris]

It's been said that insanity is doing the same thing iver and over again, expecting different results.

If said that a response of "call to verify" did not actually mean what it says, that would have been perfectly believable.

However, you went on to say that you've been calling each time for 7-8 years, and with a million dollars of transactions per day, and it never doesbany good for your type of charges. (So around a hundred "call to verify" per day).

  You've called tens of thousands of times with the same result, because they don't approve your Viagre site charges under that code. You keep calling, failing to understand that they're not going to approve your charges.

So if I take what you said 100% at face value, you're whacko. It's also possible that you're not actually insane, you just created some of those "facts" without thinking about the fact that if your story were true, it would mean you're a moron.

Re:you're insane?

[aitikin]

We communicate with banks to verify transactions and that makes us insane? I don't follow your logic, but good job trolling. Call to verify failures are the bank's fraud department (often enough being overzealous) trying to prevent fraud. As such, the merchant is not going to be able to verify, contrary to your previous statement.

Re:my credit union calls me in seconds. Cashiers s

[RubberDogBone]

Same exact thing happens with my credit union, once at a car repair place and again when I was buying an expensive electronic device at a store. I don't mind, because the same CU verification service also called me when someone had in fact stolen my debit card (the only time this has ever happened to me in decades, knock on wood) and used it to buy gift cards at a department store I never shop at in a part of the area I never visit.

Their detection algorithms saw it, called me, and when I told the computer NOT MY CHARGES, the card was locked down instantly after only about $100 had been spent. And I got that money back after filing an affidavit. I made a point to write a letter to the CU thanking the anonymous programmers who coded the fraud detection program, because it damn well works brilliantly.

It works SO well in fact the replacement debit card they issued would not allow me to reuse my old pin, even on a whole new card number. Nobody at the CU was aware reuse wasn't allowed so I got to teach them, in a way, just how well their own fraud detection was working. Very happy customer.

Contrast that with American Express, who didn't like the looks of a charge I made at a printing company buying some print for work, to be reimbursed later. Amex called me, and when I did verify the charge was legitimate, they said fine but instantly crushed my credit limit and caused the card to be maxed out, where it had plenty of credit before. This Amex card had a fixed credit limit as opposed to the traditional cards that get paid off every month. I was traveling at the time and lost the use of that card which caused a huge mess of trying to pay for things like dinner, hotel, etc. Amex also crushed the credit limit on another card I had with them.

They were unyielding and refused to reverse the changes even after I told them there was no fraud taking place. Total assholes.

Victim of your own invention

[McBullseye]

Around a decade ago I was working as a project DBA for a very large US bank. Given a certain level of trust I ended up assigned to almost all of the InfoSec related projects including fraud detection. So, I was responsible for writing all of the database back end for this system which included a web based front end that allowed the analysts to enter their own rules as to how to flag transactions. I was pretty proud of the work.

Fast forward a decade. That bank was deeply involved in the mortgage crisis and is now owned by yet another bank. I work remotely for my current US employer from Brazil. But, I still have the old employee banking account from all those years ago. Roughly once or twice a month my own code flags my transactions as fraudulent and locks my card. The irony isn't lost on me. I consider it somewhat like an early teen, rebellious against the hand that feeds.

Re:So what do I want? Secure payments!

[Anonymous Coward]

How about tokenized 2-factor authentication? Apple Pay works this way. Eventually, we will see more models come to market that take this into account. And the old way will fall out of use eventually...

How would i like it to work?

[Anonymous Coward]

I would like to have anti-monopoly laws in place to keep banks from taking over the entire country & reducing my choices to BofA & Chase.

Re:my credit union calls me in seconds. Cashiers s

[omnichad]

That's also the kind of place someone might buy rims, which are easy to resell if bought fraudulently. And the credit card company only gets the transaction amount - which is a high number from a business you (probably) don't regularly do business.

Algorithmically, it would be hard to tell if that's legitimate or not and it's just a quick phone call to get the transaction through.

Re:It's even worse as an international merchant :-

[Anonymous Coward]

Have you talked to your bank about this? there are methods to make your merchant account "more trusted" though they aren't free. On the other hand, how many of these are crooks using your stolen credit card reliability verification service? completely online? Sounds like the perfect way to validate a stolen credit card number.

Similar for me

[Ted Stoner]

I recently tried to make a small online from from a UK-based site. It was for 7 UK pounds. They declined the transaction. We called and they too were suspicious with the activity to a foreign country. Fair enough. But I had made identical 7 pound purchases from the same company earlier in the year. It can't be that difficult to check against previous transactions?

My other problem with our Visa-providing bank is that they allowed us to set up several alerts so we can be notified of suspicious activity. Unfortunately the first one occurred while I was driving in a foreign country. My wife called in while we drove, as we were both panicking that we would lose access to our card (and be unable to do mundane things like buy gasoline to reach our destination). Here the issue is my wife is the primary credit card holder. I am secondary only. The bank was annoyed that the alerts were set up to go to my email and cell phone rather than hers. I work with security stuff all of the time. My wife is somewhat technically illiterate. I need to see the alerts more than she does. They should let us decide who sees the alerts and recognize this situation too.

Absolutely NOT...

[Anonymous Coward]

I do not want to have to call my bank before I travel. Period. That’s unacceptable.

Fraud protection indeed

[Anonymous Coward]

I've had the OP's experience with my card getting falsely tagged for fraudulent use, but my biggest irritant was something much worse.

Somebody used my number to place an order from Zappos.com...which they had delivered to my address. Seriously, I got an order that I didn't make with someone else's name on it. Naturally, I called the fraud protection line to notify them. They were completely not interested. They just wanted me to use regular channels to indicate that my card had been used fraudulently; they did not record the guy's name.

A year later, the fraud department called me in regard to this fraudulent purchase (and others made around the same time). They aggressively questioned me as though I had really made the purchases myself. I cannot believe how incompetent they are.

Lose your rewards

[Anonymous Coward]

I had CapOne cancel my card/account on some alleged $11 transaction that they detected. They sent me a new card and zeroed out my rather large rewards balance. I had to waste quite a bit of time getting my balance restored and I have to wonder if that is half of the game. I don't let my rewards balance grow very large anymore as it does appear they can take it if they want.

Get a better bank

[guruevi]

Sorry to say, but if your bank has poor customer service, fire it and get another card elsewhere. I hate to say it but Bank of America for all their past policy flaws has great customer service on their credit cards, I can handle most things including disputes online, they call me in case of suspicious transactions etc.

For my other checking, savings, loans and credit I have used local credit unions. They are likewise great at personalized customer service.

Another issue - on a slight tangent...

[martinfb]

My CC has the chip inside for readers that read those SIM-like chips. This is actually an inconvenience, as it is much simpler to simply swipe my card and put it away (then continue with remaining transaction actions) rather than have to insert it into the reader and wait wait wait until prompted to remove the card, then put it away and continue with remaining transaction tasks (YES to amt, add email addy for receipt, sign the pad, ...). CC companies have more to fix besides how to detect fraud. I think they can start by putting truly qualified people in job positions that actually figure this stuff out! HEY! YOU! Mr CEO. GET IT TOGETHER OR GET THE HELL OUT! How about a little meaningful work for that huge salary!

USAA

[blahprath]

USAA -- if you qualify for their insurance/credit card -- has excellent fraud detection. They've successfully caught fraud a couple times, and have you verify after the fact via text if they suspect fraud instead of locking you out.

I had this happen with Blizzard and EA

[WillAffleckUW]

Used my credit card to buy WOD, renew my annual subscription, and a gift sub for my son on the same day and they denied the charge, even though I had plenty of credit.

Same happened with EA when on the same day I bought 2 expansions for the The Sims.

Yes, I tend to do those ON THE SAME DAY WHEN A BIG DISCOUNT IS ANNOUNCED. Wonder why?

Find a new lender

[Anonymous Coward]

Find a new lender as there are many other options with much better fraud technology or levels.

Praising for Costco's American Express

[Anonymous Coward]

I have used Costco's American Express Card all over Europe and Asia for many years. I have never notified them of my travel plans. I have never had a single transaction declined, including a very expense watch in Hong Kong. I do carry extra cards, just in case.

Re:It's even worse as an international merchant :-

[Anonymous Brave Guy]

Thanks for the ideas, but yes, we've pretty much exhausted the sensible options, at least with the current card payment service we use. We do wonder whether that service might itself be part of the problem -- if having a programmer-friendly system so taking card payments on-line make it easier to take payments, naturally it also makes it easier to take fraudulent payments, and I wonder whether these new services' own "reputations" within the industry affect their custoemrs' fraud ratings on whatever systems check these things.

As for the crooks angle, of course there is always the problem with services being used to validate illegally obtained credentials, but in this case it is likely that every one of those users was legitimate. We're in a niche market, and the access patterns of the users in question are far too consistent with normal use and unlike anything someone just testing out a card would be likely to hit by accident -- we're talking dozens if not hundreds of page views looking up specialised information in specific, logical orders here. Also, while we see quite a few failures in month 2, in a frustrating proportion of the cases that mysteriously fail it's a subscriber who's had many months of continued membership and/or been known in our field and/or been in touch with us personally at some point, i.e., a good customer who was probably very happy to continue subscribing (but might not get around to doing it again for a while if the failed payment means hassle to stay signed up).

PayPal

[Anonymous Coward]

I went to put my main Capital One card as the credit backstop on my PayPal account. I found that the card had been assigned to another account. I found that my wife had used the convenience card I gave her (which has the same account number as mine) to back her PayPal account. We worked through getting it removed from her PayPal account. Then, when I tried to add it to my account it was blocked. The representative said the account was now "banned for life", that was their "rule", and there was nothing I could do about it. This was the same person who had just helped me remove the card from the other account. No fraud was reported at any time. I reported the problem to their customer service a few times, but never got through to anyone who could actually do anything.

I'm not going to get an extra credit card just for PayPal. Then I would have to watch an extra credit card bill. I'm not going to trust PayPal with a bank account number, because they might get several hundred dollars into me with their silly "rules" before I could cut them off. I talked to a former PayPal security employee, and he told me there was probably no way to get off their "no fly list". I'd be glad to have some place to go show them some ID, and the physical card, but good luck with that.

I still use the same card all the time. No problems with it. Capital One never sent a decline to PayPal. I can't use PayPall at all. They keep nagging me to add a credit card to the account. I can't add the one I have. PayPal is useless to me. And they remind me about it with more emails every week.

Stop bitching

[Anonymous Coward]

Stop bitching. If they let someone else commit fraudulent transactions, you'd bitch about that.

You are supposed to call your bank before leaving the country or going across country. It's just how it is to protect your money. You probably bought a pack of cigarettes or something outside of your local area and failed to answer the safety call (or it was after hours).

I've had many occasions in the past 10 years in which my bank successfully prevented credit card fraud on my account. I've also triggered suspicious transactions myself. Like once I blew a grand at a strip club. Would have spent a lot more on that alcohol powered fantasy bender.....

So stop yer bitchin

ALWAYS travel with multiple credit cards and cash

[Anonymous Coward]

so you're not without funds when something like this happens.

I worked for a cruise line for 5 years providing tech support for their entertainment department. They flew me all over the place to meet up with ships and/or would hitch a ride on one ship to meet up with another. I'd fly an average of 85,000 miles a year. Yes my company credit card had been compromised many times (physically swiped at a store on there side of the planet from where I was at the time, with my card in my possession). Yes the credit card company flagged transactions I legitimately made as being fraud until I called them.

Did I ever let it stop me from doing my work or enjoying myself while I had time off?

No.

You just have to be prepared for this sort of stuff to happen. It's part of this thing called "life", and you are only a victim if you allow yourself to be thought of as one in a situation like this.

-Jeff

IN NEED OF HELP THEN CONTACT

[Anonymous Coward]

Gabriel Houston Certified ATM HACKERS of the Email Address: (
houstonorgatmhackers@gmail.com). It’s at it again! Cool way to have
Financial Freedom!!! Are you tired of living a poor life, and then here is
the opportunity you have been waiting for. Get the New ATM Blank Card that
can hack any ATM Machine and withdraw money from any account. You have to
be smart to make use of this programmed card; you and I know that it’s
illegal. It has a special feature, that makes the machine unable to detect
the card, and its transaction is untraceable. You can use it anywhere in
the world. With this card you can withdraw nothing less than $3,500 in a
day. So to get the hacker contact via email address:
houstonorgatmhackers@gmail.com

williams david Certified ATM HACKERS

[Anonymous Coward]

williams davidwilliams david Certified ATM HACKERS of the Email Address LUCKYTECHATMHACKERS@GMAIL.COM). It’s at it again! Cool way to have
Financial Freedom!!! Are you tired of living a poor life, and then here is
the opportunity you have been waiting for. Get the New ATM Blank Card that
can hack any ATM Machine and withdraw money from any account. You have to
be smart to make use of this programmed card; you and I know that it’s
illegal. It has a special feature, that makes the machine unable to detect
the card, and its transaction is untraceable. You can use it anywhere in
the world. With this card you can withdraw nothing less than $3,500 in a
day. So to get the hacker contact via email address:
LUCKYTECHATMHACKERS@GMAIL.COM] of the Email Address LUCKYTECHATMHACKERS@GMAIL.COM). It’s at it again! Cool way to have
Financial Freedom!!! Are you tired of living a poor life, and then here is
the opportunity you have been waiting for. Get the New ATM Blank Card that
can hack any ATM Machine and withdraw money from any account. You have to
be smart to make use of this programmed card; you and I know that it’s
illegal. It has a special feature, that makes the machine unable to detect
the card, and its transaction is untraceable. You can use it anywhere in
the world. With this card you can withdraw nothing less than $3,500 in a
day. So to get the hacker contact via email address:
LUCKYTECHATMHACKERS@GMAIL.COM]