Slashdot Mirror
When Fraud Detection Shuts Down Credit Cards Inappropriately
reifman writes: On Sunday, Capital One declined a $280 travel reservation I charged at India-based ClearTrip.com and immediately shut off my card for all transactions until I contacted them by phone. It wasn't the first time that CapitalOne had shut off my card after a single suspect transaction. But, I'd actually purchased from ClearTrip.com using my CapitalOne card on two prior occasions. It was an example of very poor fraud detection and led me on a tour of their pathetic customer service. The banks want to cut their losses regardless of how it impacts their customers.
Having had my own credit card suspended out of an abundance of caution on a different credit card issuer's part (for legitimate charges), but having recently had some widely known scam charges get accepted, the fraud protection algorithms that the credit companies use certainly seem inscrutable sometimes, and so do the surrounding practices about communicating with customers. How would you like it to work instead?
If you're going to make out of the ordinary purchases for overseas, or travel overseas, you always want to call your bank ahead of time. This is a standard operating procedure, and nothing to complain about on Slashdot.
God spoke to me
I have had serious problems with the aggressively incompetent HSBC 'fraud' detection.
The 'best' was when they claimed the reason they had (again) blocked my card was that a whole batch of cards had been compromised and it wasn't just my card.
Sadly for the liar at HSBC was I'm a tech journalist, so I immediately contacted their PR department who denied any knowledge of the breach.
It was just made up to make me go away.
Dominic Connor,Quant Headhunter
My CC sends me a text message whenever it is used. It's quick (usually arrives before I've signed the slip), it's free, and it doesn't need some stupid app installed with insane permissions. So, *I* can decide which transactions are bogus, instead of some computer algorithm; and when a truly bogus one does appear, I can notify the bank immediately. The bank can then concern themselves with actual proven bogus purchases, instead of thousands of "suspect" ones.
My experience has been actually very good with Chase cards...
They decline the transaction then text you asking to reply "1" for Yes or "2" for No if it was you. Then you just reply "1" and repeat the transaction and it goes through.
Simultaneously they send an email with a green "yes" and a red "no" button that functions similarly.
My pet frog used my card without me knowing. Do you have any idea what it costs to ship special-order flies, worms and a massively tricked-out terrarium from Bangkok?
Frog protection my ass.
If it weren't for deadlines, nothing would be late.
The person who used my cellphone number before I got it had such a deal, apparently, with her bank. Unfortunately, she never notified the bank that she no longer used that number, so I got frequent calls from Chase Bank asking her to respond to credit card activity. At first, I called Chase's response number to alert them to the problem, but after several fails, I simply took to refusing all credit requests made in her name.
I'm sure that her experience was even more annoying than mine was -- and mine went on for months, during which time I found out quite a lot about her personal buying habits.
Use cash.
Seriously. I remember when we could get on a flight, sit down, then have a purser come by and pay in cash for the flight.
OTOH, I let 2 of my credit card companies know where I'll be traveling - they have an online tool for that. Amex seems to figure it out, though I've had 3 different CC refused because they weren't chip-n-pin in Turkey (away from tourist areas). It was embarrassing to take 12 people to a business dinner at a nice restaurant and not be able to pay. Amex, Visa, MC all were refused. I made a stink about this to the MC company and 8 months later, I was part of their early test group. Also got screwed in Amsterdam having to wait in line to get a train ticket from the airport because non-chip-n-pin CCs weren't allowed at the train kiosks. 10 line. Should have just gotten on for free - nobody seems to check for tickets into town.
Also remember traveling around Japan before they started accepting CCards anywhere. Cash was it. It was a hassle to carry the equiv of US$1000 to be able to pay for hotels, but necessary.
Was in Seoul a few years ago - the subway token machines only accepted cash, but a cash machine was available about 50ft away. Got the feeling they didn't want to be accused of tracking riders by name. I dunno.
I still use cash whenever it makes sense for trivial purchases under US$50 - except in transfer airports when I don't have any local currency. That $3 cup of coffee while waiting for a connecting flight just isn't worth it. Also feel bad tipping in USD, but sometimes that is the difference for the bellboy - $0 or US$5.
As EMV chip card readers get cheaper, I keep waiting for banks to offer an on-line verification service where they supply a chip card reader to the card owner, which can then be used to verify on-line transactions. After all, the system is already designed to survive the POS terminal being compromised, so the same should apply to what is effectively a home POS terminal.
I rented a huge U-haul on a citibank card. Day of the move, I was buying gas at gas stations every few hundred miles in a line across the US's major interstates. Citibank cut me off after 4 gas stations. Good thing I had a backup.
I've been happy with my credit union's fraud prevention and detection (which is outsourced to some company). Sometimes I'm 100 miles from home when I spend about $800 on electronics at Fry's or Microcenter. (The datacenter is 100 miles from my house, for now.) The transaction sometimes returns a "call to verify" code. The merchant COULD call, they are supposed to, but most cashiers just say "it didn't go through". This is a training issue on the merchants' side, in my opinion.
At the same time that the cashier is saying "it didn't go through", my phone rings. It's the fraud department calling to verify the purchase. The cashier re-runs the card and it works fine. It seems to mainly happen when buying from an electronics retailer, as I also remember the same thing at Best Buy. I'm fine with that. I know that if a crook gets my card, the bank is watching out.
Occasionally, they'll call about an internet purchase or some other purchase after it happens (fraud detection). It's quick and easy to verify the transaction.
I used to do another type of fraud prevention and detection, not directly related to credit cards, and I know our false positive rate was under 0.1%, probably under 0.01% - we stopped at least a thousand fraudulent instances for every one we declined in error.
In the EU (but not the UK), banks will send you a text for EVERY credit card transaction. If there's a problem, you can contact the bank. It's also free.
Are you really telling me, in this day and age, that we can't have suspect transactions result in a text to your phone that you can then authorise - even before the web page refreshes?
Banking is so in the 1950s of computing that it's laughable. It's done deliberately in some circumstances to profit from charges, fees and the timings of clearing payments. But you can't claim fraud if you haven't taken SIMPLE measures against it.
Like asking the user to confirm suspect transactions using a secondary method (that can be phone for old people without mobile phones, text for those with phones, maybe even the bank's secure app if you so choose). Declining a card transaction because it comes from an unusual place is no longer a metric to decide on the suspicion assigned to a transaction. I've purchased from all over the world, especially in the run-up to Christmas when Amazon, eBay et al only stock the normal boring stuff and I want something a bit different.
In one instance, my Italian relative came over, went to a DIY store with us, paid for the transaction and KNEW BEFORE WE'D HIT THE DOORS that he'd been double-charged on his bank account. A text came through, then another, in a foreign country, before he'd even left the shop. And we were then able to cancel the second transaction.
Why the fuck isn't just this standard practice?