Hacker News Reader

Your bank is the only one who would be verifying your signature.

When you call to dispute a charge, your credit card company contacts the original merchant. They can either request information from them about the purchase, or just immediately side with you (a chargeback). If they perform a chargeback, the money gets removed from their merchant account and deducted from your bill, and they get hit with a chargeback fee.

One of the reasons merchants collect the signature is to have more data to give to the credit card company during an inquiry, or so they can try to dispute the chargeback. If you claim you never made the purchase, having your signature on a slip helps the merchant with the dispute, as would having you on video signing for it. Credit card companies side with the customer a vast majority of the time, but if the merchant has reasonable proof that you knowingly made the charge (which might include that signed slip), the merchant can win those disputes.

Previously not having a signed credit card slip usually meant the credit card company automatically sided with the customer over the merchant. I doubt dropping this requirement will make it easier for merchants to win chargeback disputes, though.

The card issuer will only reflexively side with the purchaser if it's a small purchase. And if the merchant has definitive evidence it really was you they will win (for some products, like the Priceline thing where you get a hotel but you don't know which until you've paid, having this locked up is absolutely essential).

It's also worth mentioning that card companies will usually side with the card holder initially. The burden of proof is on the merchant in the US.

I bought a flat yesterday. The final stages involved going to a bank and signing about 50 pieces of paper, then signing more with the realtor who also had to arrive at the same time.

I couldn't help noticing that my signatures were very very different on the first few papers I signed compared to the last few.

I think I was suffering from signature fatigue, but despite everybody exchanging passports and IDs, I wonder if I could come back later and "prove" the signatures on some of the papers were not my own - after all they look so different..

Signatures on important documents are often witnessed, and it's more about having some mark on the page that indicates 'yep I agree to this too' in case of dispute.

You can pretty much write your name any way you like; as you say it would come down to an argument of you saying it wasn't you and a reasonable arbiter deciding how likely it is that the pages you're disputing have been added after the fact

The bank's camera could prove you were there, and the GPS in your phone (e.g. Google Maps) could as well. It can work in your advantage or disadvantage depending on the situation.

In the case of credit card signatures, the best they can do is try to match your signature to the one on the back of the card.

And even that "best" attempt is pathetic on the face of it. What, the person behind the counter at 7-11 is now supposed to be an expert in graphoanalysis? "In between cleaning the bathrooms and stocking Coke, you have to verify the authenticity of the signatures on these contracts."

I once got a call(or email to call them I don't remember which) from my bank about a check I had hastily scrawled out. They said it was suspicious looking and they wanted to verify that I had actually written and authorized the check. I'm guessing that means they have some sort of handwriting AI flagging checks that don't match the usual style.

For checks I think banks definitely do this as I've also had a similar call. But I guess it comes down to volume and logistics. When you write a check your bank receives the original or copy of the deposited check. Credit card receipts go to the card processor who then deduct it from your account. I write at most 2 checks/month. I run 10 transaction per day for my card.

Checks have very little metadata to help in identifying fraud. CC transactions have time, location, and behavioural patterns to aid in catching fraud.

I put Xs and squiggles for both checks and credit card bills as my signature and haven't hard a problem yet. Probably varies by bank.

Many banks in the US don’t get the original checks anymore. The deposits are done purely electronically, and the only thing the bank gets is a very low-res image of worse quality than a bad fax. And that’s all they store.

I recently requested a copy of a cancelled check for proof of payment and they sent me a full color pdf of that check.

Hand-written signatures seem to be one of those silly little rituals we all do without knowing why and despite it not actually accomplishing anything. A picture of my name being on a document does not in any way show that I read it or even drew the picture myself, nor does the absence of a picture of my name show that I didn't read it. Yet we all play make-believe.

It's not exactly make believe, it's about transferring crime to one that may be easier to prove (and therefore easier to prosecute) or which has a harsher sentance.

If you didn't have signatures, it would be difficult to prove that someone was trying to steal your money if they paid with your card. They could come up with all kinds of excuses, such as "I thought it was my card", etc, to confuse the process.

With a signature, it doesn't matter if the person signs it mickey mouse, because it's not what is signed it's the act of signing itself which then puts fraud into play. They are signing that they are you, and at that point fraud is much easier to prove, since you can produce a video of them signing that they are you.

Also, the punishment is no longer dependent on how much they took or tried to take, because it's no longer about the taking of the money itself but about the fraudulent actions to do so.

Much of the financial system, particularly the older parts, are set up in the same way.. where security isn't about preventing the money being stolen, money can be easily corrected later (just edit it back into the account), it's about making it easy to catch and prosecute offenders. It's not difficult to rob a bank, you can just walk into a bank, ask for the money and they'll give it to you, it's difficult to do so and keep the money after-ward.

Security is provided by the legal system, not by ever stronger locks. I wonder if there's any way we can learn from that to improve security elsewhere such as online, or whether the international nature of the internet means that that model is broken. (For example see the SWIFT hacks, if they were carried out by NK then the legal system no longer works as a deterrent).

Thank you for the insightful post on the interaction of security and the legal system -- including the question of whether the internet can benefit by that approach.

Somewhat related to "money can be easily corrected later", digital system designers increasingly accept their system will get cracked into and the main issue is how to recover from that (at least operationally).

Even more important than the legal context, is the business case. Fraud for modern financial institutions is like deaths caused by self-driving cars.

+ It is a trade-off between costs of the fraud detection system versus money lost through fraud.

+ It is a trade-off between time it takes to do proper fraud detection versus losses by slower payment processes.

I don't know about papers in this direction. Would be a fun read. A bit like the effect of voluntary disclosure of evaded taxes like in this working paper: https://www.econstor.eu/bitstream/10419/110841/1/cesifo_wp53.... Is the net effect beneficial or does it lead to more tax evasion?

If it was you that wrote it, then it has some legal weight. It doesn't indicate that you read something, but that's not the point; it indicates that you're agreeing to be bound by whatever was written.

There's inherent difficulty in proving that it was actually you, but that gets handled as its own problem. Someone forging your signature could get you dragged into court for breach of contract.

The problem is that the person receiving your signature usually has no way to verify that the signature belongs to the person authorized to whatever it is you signed for.

It's worse than that these days because you normally put your signature on a totally-broken too-small stylus pad that doesn't look as good as your worst ever pen-on-paper signature. Even if I made my best effort at most POS machines, it couldn't be used to prove anything.

I've made that remark, actually, that "These things are too illegible to be used to prove anything". At least once, the clerk (or bank teller - I forget which) corrected me, saying that they actually have been successfully used to prove something. (I didn't get details...)

>Banks are really in the best position to verify signatures on checks that they get. They could potentially access a huge database of authentic signatures from previously cashed checks and do some sort of AI pattern-matching against the signatures they get before cashing them. But do they? I don't know. But I very much doubt it.

I know for a fact that Bank of America does this. I've been stopped on multiple occasions there after trying to cash a rent check from my girlfriend that I filled out and signed for her. It's kind of annoying but I'm glad theyre doing it.

It has more to do with chargebacks than verifying at the time of the sale, as far as I know. If I claim I don't recognize a transaction, the business can defend themselves a little if they have my signature recorded for that transaction.

You mean the signature that was scrawled with a finger tip on a 4” touch screen? Yeah, that’s going to match what I wrote on the back of my credit card exactly.

I think it is for just this reason that MC is ending the signature requirement. They’re ain’t defendin’ shit if they think they’ll convince anyone that the 100 pixel-wide smear was done by me and not someone else.

It doesn't matter if it matches the back of your card, it matters if you can say you didn't sign it under threat of perjury.

Why is saying "I didn't buy that item" under threat of perjury not the same?

> Why is saying "I didn't buy that item" under threat of perjury not the same?

People forget buying things. Our legal system has a higher bar for falsely disputing a signature.

I once had someone at a gas station try to verify my signature against the card. I have always signed things with arbitrary (though lately, consistant) scribbles.

They tried to claim that it couldn't possibly be my card because they didn't match. After a few minutes of back and forth with the cashier I realized that I had already paid for my chips and smokes, so I just grabbed my stuff and left.

It was incredibly frustrating.

>I think I've had that happen exactly once in my life.

I haven't signed my cards in years. I know they technically say they are not valid unless signed, however it's not a problem around here: on the other hand, many stores will not sell anything with only signature validation any more (PIN+signature was never a thing here, and with PIN your card is not in the interests of cashiers).

I tend to keep my cards loose in my pocket - this results in the signature strip only lasting about 6 months. Literally no one has ever given me any grief (in the US).

> I think I've had that happen exactly once in my life.

Heck, back when you had to hand over your card for the cashier to swipe it, I'd write "check id" on the card's signature line, and I had maybe three people total ever ask me for my ID.

> I'd write "check id" on the card's signature line

That's actually a violation of the cardholder agreement, FYI.

So is leaving it blank, but from many years working retail I can attest this is the defacto state of most credit cards. For what it's worth I have "Please verify ID :)" written next to my signature on mine.

A store I worked at rejected any transaction over $1,000 with “See ID”.

Verification better than signature rejected because REASONS.

Brought to you by the same geniuses behind "security by mother's maiden name" and VbV/3dS

Yes - reason being it’s not a signature and chargebacks happened.

This was a long time ago btw.

But only recently - it was common advice in the 90s to try to get people to use photo ID

It was against the agreement then, too (but commonly advised anyway). It is probably against merchant agreements to accept a card that is unsigned as well.

I did the same, and it worked maybe 5 times :)

What's the thread model here? You lost your card/it was stolen, but you haven't noticed and canceled it yet? Isn't it more likely that your card data is scraped up in a data breach or something, in which case your card is still in your wallet? Even if it was very recently lost/stolen, you're not liable for illegitimate charges as long as you report them promptly, so wouldn't it be better to just keep track of your cards?

I still do that on all my cards. About once every few months, I run across someone who does actually, check and then I thank them for asking.

> The problem is that the person receiving your signature usually has no way to verify that the signature belongs to the person authorized to whatever it is you signed for

And that's why most of the rest of the world uses pin numbers instead of this signature farce

Or, you know, ask for some ID. "but it violates the card agreement" card companies can go take a hike