Hacker News Reader

Comment by snarf21 | Hacker News Reader

Exactly, some of this is semantics. To me, a skimmer duplicated card isn't identity theft. Taking my identifying information and opening new credit is.

Again, this whole industry needs to change. We could cut massive amounts of the estimated $200B loss in the US with just simple things like mandatory chip+pin, 2FA or CCV for online purchases, your credit is always frozen and only unfrozen for a 24 hour period at your specific request (requiring MFA). It is so silly when I have to type in my 5 digit zip at the gas pump (something someone could easily find online or by asking for ID) even though my card has a chip.

View on HN

Low trust versus high trust society is the thing you need to understand here. You live in a high trust society which means that, in general, it is more efficient to optimise for conversion rate than to deny valid but incompetent or "unable to provide all the details" consumers.

While that might be true to a degree, chances are that what is really going on here is that it is more profitable to externalize the costs of insufficient authentication to unsuspecting people. While both result in higher profits, one does so by actually increasing the value that is being created while the other does so by making a third party pay, possibly even more than the increase in profit, so one of them is more efficient for society, while the other is just more efficient for the company but might still even be less efficient for society overall.

I understand, but in practice the fraud liability when it comes to identifying parties between two huge companies is very, very clearly laid out.

As in, weeks or months or years of discussion.

Not talking about credit cards thougn which are kind of a special case, where yes, totally merchant gets screwed.

I understand what you are saying but that just means that the consumer pays for that in any case (in higher prices or interest rates or ...). Using your verbiage, I would like it to be even "higher" trust so that I don't have to pay for fraud that seems almost trivial to prevent.

It is not trivial to prevent at all. You need to spend money and fraud prevention effort at every trust point.

All of this costs literal salaries of people who say "no computer says no" at every point. Those people also suffer risk of physical assault.

In the electronic space you need to pay for "social media consultants" and look after twitter and facebook and such. You would be surprised how incredibly expensive the things you seem to take for granted are, to a large organisation which pays proper wages to people.

Practically speaking if your personal details have been disclosed by some douchebag fucking company it is very difficult to distinguish you as a caller from some random internet asshole impersonating you.

Not attacking you but you've lost me. How does switching to chip+pin at the gas pump instead of zip code cost "salaries of people" or "risk of physical assault"? There might be a cost to upgrade the panels to read the chip but they need upgraded anyway with electro-mechanical locks to prevent skimmers anyway. There are also savings in police, courts, incarceration, etc. This won't stop all obviously, but there is a subset of criminals who perform CC fraud because it is so easy and hard to get caught.

Chip and pin switch is the best case. Think about all your other accounts. Gas, power, water, fines, etc.

Also i don't know have ever been involved in an "it upgrade" project and what it means to have the gas pumps now do different things. I want life to not be like that, but I think you would find its a bit harder than you are imagining.

> Think about all your other accounts. Gas, power, water, fines, etc.

The way those work in the rest of the world is basically by giro. You control your bank account, and the only possible transaction is you sending out money to other bank accounts. If I provide you a service I need to get paid, I send you a bill, either in paper form (that you can read with your smartphone) or electronically. You look it over and make the decision to pay or not.

The system is not perfect and fraud still exists (mostly in the form of trying to pass a fake bill as a real one), but fraud is much less prevalent than in the US system.

If I provide you a service I need to get paid, I send you a bill, either in paper form (that you can read with your smartphone) or electronically. You look it over and make the decision to pay or not.

The problem is that that someone else can claim to be me at my address to you (the impersonator), you send the bill to me (the authentic). I look this bill over and decide not to pay because I didn't request these services. Now we have a dispute, all due a third-party who impersonated me.

Unfortunately, this is also exploitable by me to later claim I didn't purchase the service from you, which I might do to avoid paying.

There's currently no easy way for you, as the service provider, to authenticate the request without an out-of-band opt-in (mailing a contract to the same place you'd send the bill to confirm that the services would be paid for), which would delay the delivery of said services. By the time the third-party has received the services and you've sent the bill to the authentic party, the impersonating party is long gone, and the authentic party is left holding the bag as the less powerful party in the exchange/dispute.

It's not a question of trust it's a question of where the legal liability falls.

> it is more efficient to optimise for conversion rate than to deny valid but incompetent or "unable to provide all the details" consumers.

And that's not a big problem even that it is not nice. The problem is when your company lends money to someone that says it's me. And it becomes my problem. Why?

The company wants a lot of conversions, so it has a low entrance cost. Then that company should pay for that problem, not unrelated third parties.

> Low trust versus high trust society is the thing you need to understand here.

For me, that's just one of the reasons.

Sweden, for example, is a high trust society. But companies are trying to play fair because they are going to be punished otherwise. Isn't that fair?

But, of course, in a society with a lot of corruption, and cheating, and low trust. Companies are going to defend themselves more. As they risk will get more fraudulent transactions that real ones.

The zip code at gas pumps is not just a poor security measure, it also blocks international travellers like me from obtaining any fuel sometimes!!!

Just make a note of the zip code of some random address in the neighbourhood. A hotel or even the airport will do. At least that has worked for me. The system doesn't seem to care that that zip code has nothing to do with my Norwegian issued American Express corporate credit card.

12345 is a valid zip code, it has a single address associated with it - General Electric in Schenectady, NY.

10101 and 01010 are also valid zip codes.

(00000 usually works too even though it's not a valid zip code)

I'm not positive, but I think zip verification fails open on foreign cards.

Here's an arbitrary one I know exists: 85310. Try it next time and see if it works.

I like to use '90210'

When I was a teenager in the 90s I worked at a chain store that had the policy of asking customers for their zip code at checkout to collect data on who was shopping. People sometimes would get really mad (and I mean really mad) that I was asking them, and since it was before the internet went mainstream people had not been conditioned to give out personal information yet/were unfamiliar with big data/weren't getting anything in return for their zip code. So in order to confuse the system (and avoid upsetting anyone - I am conflict avoidant) I would solely use 90210 as the zip code of all our shoppers, despite being on the other side of the country from Beverly Hills. I conspired to get my coworkers to do the same. A quarter of a century later I still feel minor gratification that I stuck it to the man.

I'm partial to giving my address as 1060 West Addison St., Chicago, IL 60613.

That Wrigley Field, for those not from Chicago.

Wrigley Field is the home of the Chicago Cubs, a Major League Baseball team, for those unfamiliar with American sports.

When a store offers the option of entering a phone number instead of using a physical "loyalty card", I've found that XXX-867-5309 nearly always works, where XXX is your local area code (for me, it's 206).

My wife and I went on vacation and didn't have the proper "club card" for the store. 867-5309 worked as a phone number, and was issued to a "Jenny".

I wouldn't be surprised if 90210 is outrageously over represented...

Or 02134.

No it doesn't. Usually gas pumps are set to accept 00000 for foreign cards and sometimes there's instructions for Canadians cards to substitute the letters for 0s. (ABC123=000123) Even if the pump blocks foreign cards altogether (and it usually won't), you can always use your card to pay inside.

I was travelling through the states a few weeks ago with a few friends. Neither zeros nor substitution ever worked for any of us.

I tried researching this last time it came up. Yeah, if you're from Canada you can run it through that formula (sucks if you didn't look that up before you left home). Nobody in the thread had luck with 00000 or something similar. I didn't really see clear instructions for other countries. It sucks if you need gas outside of business hours.

I had the reverse situation as an American traveling to Iceland when no chip+pin cards were available to me. I picked up the rental car with an almost empty tank. They point me around the corner--the gas station is automated. I start driving the 50km to reykjavik and cross my fingers.

Later in the trip I get into a similar situation of an automated gas station in a desolate area. I waited until a local came by, offered them cash to use their credit card. They seemed suspicious like it was some sort of scam (I dont blame them), but thankfully that worked out.

Yeah I had a similar problem in Canada. Got to the airport, tried to buy a bus ticket to get downtown from the automated kiosk. It asked for the pin on my credit card, which it doesn't have of course.

I was stuck. I eventually found a shop inside that would sell me a bus ticket if I bought something else.

I've had some success using the first 5 digits of a 6-digit Indian postal code.

A commenter below already mentions the difference between high-trust and low-trust society. I'm from a country which has a notoriously low-trust society. Opening a credit card or bank account is notoriously hard. It's so hard that a large portion of the society is left out of the system.

The problem with chip-pin, 2FA ...etc is that people would still be vulnerable to fraud. Except in those cases, banks can wash off their hands.

I lost my credit card recently and someone misused it. my bank reverted the transactions immediately. I know they got my back. It's the merchant or the merchant's bank that usually absorbs the cost. It's also a conscious decision the merchant makes to not check an id card for every single purchase. It's a risk they are willing to take and they probably take an insurance to cover for it. They are rewarded with reduced friction in transacting with them and hopefully better revenues as a result. I think it's a system that works good enough. Would I prefer something more secure like Apple Pay - 100%! But I'd take this over being checked for my ID card for any purchase over very trivial amounts.

Now, you may argue that it would never happen with chip-pin...etc. That's not true at all. There are people who can't remember the pin well and would choose to use cash or write the pin in a paper and keep it in their wallet. Exposing themselves to more risk and no protection from the card company either - "hey someone knew your pin so you are responsible for it".

I agree the system has to protect both sides and that may not always pan out completely. I'm genuinely curious what you think would work better. All systems have drawbacks. Some of them may be systemic but those are harder to abuse than a waiter writing down your CC # and selling that to people who encode them on magstripes.

I think with chip+pin it is at least a lot harder to be vulnerable. More and more credit card companies also have an app that you can easily report your card missing/stolen almost instantly. Also, if you have trouble with a 4 digit # of your choosing, then you should stick with cash which is still open to theft but not digital duplication.

If you are really interested, read this ArsTechnica article [1]. Interesting tidbit [2]. This makes it far superior to even chip+pin. You have to enable TouchId to use Apple Pay - there's the 2FA which doesn't requiring writing it down. It never sends the real cc number - no way for the waiter to even see it. It's a shame it's not catching up. Even in a tech-savvy city like SF it's adoption is abysmal.

[1] https://arstechnica.com/gadgets/2014/10/how-mobile-payments-...

[2] On top of that, Apple has introduced tokenization into its payment system. Like Google Wallet's Virtual Card, this obfuscates the user's actual credit card number, but it does so using a security standard developed by various standards groups and big-name card networks like Visa. It all happens without having to go through another bank as an intermediary supplier of a virtual card.

* To me, skimmer duplicated card isn't identity theft.*

No? I kind of think of identity theft as any fraud where someone pretends to be someone else to the detriment of the someone else, who needs to deal with the consecquences of whatever the someone did.

Some banks offer virtual credit card numbers for one time use. It works great online.

There are phone payment methods like Apple Pay and whatever Google uses that protect your identity. The burden should be on the providers of these services to secure themselves.

None of this works for you as a person if your easily look up-able information can be used to apply for credit.

In a high trust society you are extremely vulnerable to this stuff. Low trust societies do not have this problem in the same way.

The major problem really is that high trust society credit etc are optimising for sign up rate. Any kind of serious personal authentication mechanism will seriously impact conversion rate, which is the giant dashboard they have on the wall. There are whole teams of people whose job it is to make sign ups and conversions better. The fraud team is much smaller and as long as it doesn't impact the top line numbers too much they will be ignored.

ok... i think the point is that it should be mandated by law to have chip+pin(+maybe contactless)+CCV with credit cards, and also two factor authentication for most online transaction. Whether the current business model does not provide these assurances is inconsequential: it can be imposed as a customer protection law.

It is to be discussed whether the increase in the cost of the service would be worth it though.

They are good buffers. They are basically prepaid cards that can be refilled. Not sure about any assurances for fraud(probably none) but what is taken can be minimized.

it's not silly, it's infuriating. I can't pay at the pump with my card, because I don't have a US ZIP (I do have a perfectly secret PIN that I can use everywhere in Europe, but US doesn't seem to care about that)

Reply on news.ycombinator.com