ExxonMobil Bungles Rewards Card Debut | Hacker News Reader

ExxonMobil Bungles Rewards Card Debut

krebsonsecurity.com

37 pointsel_duderino13 comments

Should they have just used a subdomain in their regular domain? Seems like a series of mini problems. Is the '+' obsolete (you need it for international calls right?) or it the problem the phone using the same button for 0 as well. So people who don't pay attention press 0 instead of '+'.

It just seems like "similar looking domains" and stuff has been a problem for ever and it still is. Will this still be a problem in near and far future?

I don't think you read the article in full.

First regarding the phone number Krebs at least speculates that since he didn't know what button to press for + maybe other callers pressed some button other than 0 (which maps to '+') which he claims all went to businesses callers would not want to have called intentionally.

Second regarding the website, towards the end of the article support for the rewards program claims that the website has not been published yet or is at least not finished.

I wholeheartedly agree with the "similar looking domains" thing. They should just use a subdomain.

If I'm used to visiting "capitalone.com" - and the site to activate a new card is something like "activatecapitalone.com" - that seems sketchy. It should be capitalone.com/activate or activate.capitalone.com -- I tend to simply avoid sketchy sites even if they appear to be from official sources.

The worse case I’ve seen is Amazon’s credit card site — Amazon.mycreditcard.mobi. I realize that it’s run by a third party, but I am sure they could have given it a better domain name.

A + at the beginning of an international telephone number is different... that's the E.123 "international prefix symbol", which is shorthand for "insert your countries international dialing code here" (e.g. 011 if you're calling out from the US).

Cell phones will let you insert a + directly in the beginning of the number (by long-pressing the 0 key), which will let the phone dial the correct number if you're roaming internationally.

In this case, the + is at the end of the number, which is not really a standardized thing. Landline phones won't have a + printed anywhere on them, for example. And you definitely don't want to long-press 0 to actually insert a + at the end of the number, because that's invalid.

Easier to go to the speedpass+ app, if you have set that up. They have your rewards card there already and you just assign a pin #.

I don't have exxon reward card I need one plzz

Wait do they not own the domain? Or they own the domain and the registrar's parked page is full of scams?

I have haad nothing but trouble trying to activate this card

It always amazes me when major companies with oodles of cash (ExxonMobil made $20 billion last year) roll out new marketing initiatives without consulting professionals who help mitigate security and privacy issues for a living. It seems likely that happened in this case because anyone who knows a thing or two about security would strongly advise against instructing customers to visit a parked domain or one that isn’t yet fully under the company’s control.

Why is it amazing? There are no negative consequences, so why bother?

Presumably they want people to participate in this program.

Sounds like the marketing department did its job, and the web guys missed their deadline.

or in my experience...

marketing put some URL on new promotional material without ever bothering to check if it existed or was even available.

a whois on exxonmobilerewardsplus.com doesn't look very reassuring at all.

I think someone scooped them on the domain and now they're stuck with bad promotional material.

Reply on news.ycombinator.com