Hacker News Reader

Comment by tyingq | Hacker News Reader

Banks DO NOT pick up the bill for fraud in the US. The end merchant/seller does.

Edit: Downvote all you like. It's the truth. When the chargeback comes, you pay Stripe/Paypal/Etc a fee, and they yank the funds out of your account. Whatever item you shipped is gone.

Edit 2: The liability shift referred to below doesn't apply to online transactions. Card not present fraud is almost 100% on the seller/merchant. And given that the context is Stripe, well..

View on HN

I don't understand why this is being downvoted - it's correct.

It is the case that banks pick up the tab for transactions where the card is present, hence the move to EMV chips. However, merchants have liability for transactions where the card is not present, i.e. every Stripe transaction.

I upvoted, we had ecommerse store and we used authorize.net (it was like 10 years ago), every time we got a chargeback because of fraud - authorize.net deducted money from our bank account.

Online transactions using Visa's 3DSecure/Verified by Visa or MasterCard SecureCode will shift liability to consumer though.

Are you sure about that? The Verified by Visa site says that the liability shift is to the card issuer, not to the consumer:

https://usa.visa.com/run-your-business/small-business-tools/...

Ah yeah, but many issuers push it down to the consumer, basically the same case as when you've given the card PIN away.

I don't think this is true. So many shops these days sell fulls (inc SSN, DOB) at reasonable prices, some including even VBV/MSC passwords; you can filter by non-VBV/MSC as well, making VCV/MSC useless.

And if you really know where to look, the ability to look up someone's SSN will only cost you a buck or two.

I think 3DS may work better in Europe, but here in the U.S., it just doesn't.

It requires the use of a password, and adds additional steps to the checkout process. You can't really make it mandatory on your store, as conversions/sales would crumble. So, you make it optional.

If it's optional, only the most security conscious customers end up using it. Those are the customers with the lowest risk of having their card info stolen, and the most likely to report it quickly if the info is stolen.

So it adds more protection around a tiny fraction of your sales...the sales that were already very unlikely to be fraudulent.

It doesn't make any notable change to "the cost of online fraud in the US is 100% on the merchant/seller".

Why would 3D-Secure work better in Europe than in the United States? I fail to understand that from reading your comment.

Yes, it requires extra authentication (My issuing bank has chosen password as the auth - some others use the bank code boxes for One Time Tokens). All online stores that I routinely buy from in Sweden and in Europe have 3D-Secure turned on. The only exception I've encountered is an airline.

The customers don't get to choose - it's not optional for customers. It's optional for merchants/shops. If they however disable 3D-Secure: They're liable though.

That's not true for card-present transactions.

Before October 2015, issuers ate the fraud, not merchants.

After October 2015, the "liability shift" means issuers won't eat the fraud if it's a chip card and the merchant didn't use the chip reader. Otherwise, they still eat the fraud.

http://www.emv-connection.com/downloads/2015/05/EMF-Liabilit...

That's only for in-person transactions. Fraud from card-not-present transactions that are Stripe's bread and butter still falls on the merchant.

Updated accordingly.

Reply on news.ycombinator.com