Second article in one day mentioning how bad credit card fraud can be to handle, especially for smaller sites.
I wonder if there might be an opportunity there? Or if the solutions have to be so custom that it'd be impossible to work out.
I wonder if there might be an opportunity there? Or if the solutions have to be so custom that it'd be impossible to work out.
Mastercard and Amex have equivalent services, and these are all widely implemented by websites and card issuers in Europe and other countries.
I suppose they are not so widely deployed in the USA or Japan, but at the very least, you'd protect yourself against fraud involving cards issued in countries that do use it.
My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers.
That's terrifying, really. They shouldn't have any way of getting that data out of the hashed password.
A PIN can be required for "cardholder present" transactions in most of the world. Some combination of card issuer, transaction processor and merchant decide at what value transactions may proceed without a PIN — e.g. a train company's actual loss from a fraudulent ride is very small, so they might not want the delay of asking for a PIN on a ticket machine. Similarly for McDonalds. But if you're buying a TV, you will need to use a PIN.
It's almost 100% of transactions in much of Europe, over 80% in Africa and South America, lower in the old Soviet Union and Asia: https://www.emvco.com/about_emvco.aspx?id=202
Unless the customer is using contactless payment card?
Newer payment terminals can support device-based customer verification for contactless transactions, called CDCVM. The transaction limit doesn't apply if CDCVM is used. This is the mechanism used by Apple Pay, where you verify your identity using your fingerprint via Touch ID.