Hacker News Reader

This happened to me in a different way: I was giving recurring payments to a .org. I kind of knew how much I wanted to give, but instead of a lump sum I figured I would do recurring for a year. It would give them a little more and seemed to make the guy at my door happy.

Now with this organization, you can donate via the website but to cancel a recurring donation requires a phone call. I called a couple of times to try to cancel but didn't reach anybody. I admit- I wasn't too concerned (a good organization overall), but I was a little pissed nevertheless.

My credit card was skimmed, and I had it cut off. I figured this would solve my problem with the donations as well. Nope.

About two years later my wife (who actually handles the bills in the family) asked me if I wanted to continue those payments. I was pretty shocked- and persisted with the phone calls until I reached somebody to cancel.

Surprise!

I consider the "signing up can be done on the web, but canceling requires a human" to be a dark pattern.

> I consider the "signing up can be done on the web, but canceling requires a human" to be a dark pattern.

And illegal in California as of last year. Hopefully them forcing companies to allow online cancellations will mean it's available for the rest of us too.

https://www.cnet.com/news/companies-must-let-customers-cance...

It's been illegal in Illinois for a couple years as well.

Yes, this is the correct fix (well, not the part where everybody else has to rely on California but the rule that if you can sign up by method X you can cancel that way too)

My ex-employer was surprised that when they were obliged by law to stop routing everybody though a retention call center customer satisfaction improved. Too much of their own Kool Aid had been drunk, they'd persuaded themselves that customers wanted to be reminded of the benefits and offered other deals by a human so much that they'd hate even having the option to just press "Cancel" on the web site and leave that way.

It's an old Joel Spoelsky lesson, if you make leaving a pleasant experience that customer may come back some day. If not you're never going to see them again.

Several years ago, that dark pattern caused me to cancel my online NY Times subscription shortly after I started it, because the discovery of that process annoyed me so much.

WSJ online uses this dark pattern, or did when I cancelled roughly a year ago. I won't ever subscribe again, purely because of this nonsense.

I changed my WSJ billing address to California momentarily to be eligible for online cancellation. Worked like a charm :)

>I consider the "signing up can be done on the web, but canceling requires a human" to be a dark pattern.

The existence of this pattern is the sole reason why I'm using PayPal.

One thing I did to spot these dark patterns is have two credit cards.

The first is used for re-occuring bills (Netflix, Phone, internet etc).

The second is for everyday spending (Amazon, groceries, sundries etc). The second has an extremely low threshhold for alerts and emails about pretty much every transaction.

If something were to set itself to autopay, I'd notice very quickly since card 1 pings me, and card 2 only should have <10 merchants per month for easy auditing.

(Paying in cash for entertainment expenses also makes auditing easier. Having every cup of coffee or burrito clogging your statement makes it hard to spot double charges and other small frauds)

I dislike (dark patterns) and fear (bad implementations) subscriptions so much - I've put off implementing any kind of subscription for a SaaS product I built.

I've just decided to let the customer pre-pay for up to the limit I'm willing to guarantee that I'll keep running the service, even at a loss (two years at the moment). I figure if the service isn't worth a user's time to click once to re-subscribe every few years, then I probably shouldn't be taking their money.

I admit this might be a bit naive from a business perspective :)

For what it's worth, we've seen that situation from the other side as well. A customer who subscribes with us wants to update their payment details, but in fact creates a new account with a different ID, new card, etc. They don't do anything to close down their old account, we have no way to know that john.smith@example.com is the same as j.smith.1980@example.com and we don't even see their card details, and so of course our system will charge both of them as if they were two different customers.

Sometimes customers do get confused by the automatic update mechanisms for card details, but most of the time it seems to be a useful facility that saves hassle for our subscribers and avoids unintended cancellations. I do think the card companies should be much more transparent with both cardholders and merchants about how their systems actually work, though. We've had occasions where something unexpected has happened, a customer has contacted us to ask what is going on, and all we could do was contact our card payment service to ask them because we had no idea either.

What you're saying sounds like you're able to bill a card without being required to verify who you're billing. Surely there's a law against that?

In both cases we're talking about a customer who has deliberately signed up and provided us with their contact and payment details. It just happens to be the same customer twice, but providing different details so we can't automatically determine that they're the same person.

In an ideal world, perhaps we would verify exactly who each customer is for legal purposes, but in reality there's no good way to do that, so we accept a fraud risk that is small in practice in return for streamlining the process for both ourselves and our customers. There are systems that will shift that liability if you go through additional authorisation checks at purchase time (and in Europe, use of these systems will become mandatory in most cases later this year) but it is not clear that these are actually helpful, in that they may do more harm than good.

As for having a law against anything, I don't see how this is much different to when I buy my shopping from a grocery store and all I need to provide for payment is my card and PIN (and not even the PIN for most low-value transactions these days). Or of course I can pay completely anonymously using cash.

> In both cases we're talking about a customer who has deliberately signed up and provided us with their contact and payment details. It just happens to be the same customer twice, but providing different details so we can't automatically determine that they're the same person.

Isn't a user required to enter their name and address information for you to be able to charge the card? Doesn't that have to match the card?

> I don't see how this is much different to when I buy my shopping from a grocery store and all I need to provide for payment is my card and PIN (and not even the PIN for most low-value transactions these days).

Your card provides name and address information. PIN provides "security" (for some definitions of security...).

> Or of course I can pay completely anonymously using cash.

If a user is somehow paying for services with cash online... doesn't that rather necessitate that they can't enroll in automatic billing? So, how does that have anything to do with the topic at hand: automatically billing against cards which are no longer valid.

Isn't a user required to enter their name and address information for you to be able to charge the card? Doesn't that have to match the card?

No and no.

There is a certain amount of basic checking of some parts of an address that can optionally be done. It's nothing like as comprehensive as you seem to be expecting, though.

Your card provides name and address information.

Not necessarily, at least not that the merchant can see in full. Again, just because the card issuer has such information, that doesn't mean the merchant necessarily does.

If a user is somehow paying for services with cash online... doesn't that rather necessitate that they can't enroll in automatic billing? So, how does that have anything to do with the topic at hand: automatically billing against cards which are no longer valid.

The point was that you don't necessarily have to know someone's identity definitively to trade with them lawfully.

I had my credit card number stolen and the thief used it to subscribe to Netflix. 16 times. That's right, they created 16 Netflix accounts in one day using the same credit card details. Apparently a basic sanity check like "Are we already billing this card?" is not implemented at all, and Netflix support admitted as much.

I think it's in the merchants' interest to proceed with lackluster sanity checks, knowing that some erroneous charges will make it through. It's got to be a multimillion dollar business collecting fees from the unaware, the scammed, and the dead.

> ...and the dead.

Canceling my dad's cable service was peculiarly cathartic. They wanted to talk to him, not me: "he's dead." They stumbled over points in the script where they're supposed to flip the cancellation into a bigger subscription: "no, he's still dead." They awkwardly prodded about survivors: "none of your business; if anybody wants your service they don't want it under the name of a dead man, will you cancel the service now?" This would have been quite painful if I didn't get so much glee from saying "no" to salespeople...

> Apparently a basic sanity check like "Are we already billing this card?" is not implemented at all

They most likely don’t store your actual card number.

is there technology around this? i mean i can imagine an API where the CC# itself is only necessary in the first transaction with a new vendor, during which the vendor makes a (signed) request for a vendor-specific token to use for future payments, and can forget the CC# immediately; future payment requests use the same signature chain and the vendor-specific token... making it easy to invalidate any/all of these tokens if the data is compromised, or if the end-user wants to invalidate a specific recurring payment, etc.

i'm in fantasy land, right?

This is exactly how Stripe works. Except you don't even need the credit card info at all, even initially – Stripe handles that.

Now that's currently only online, but they're releasing a point of sale product soon too. But even with that, you connect to their card reader and receive a token that you can use.

This is how every payment provider/processor I've ever worked with works, going back more than a decade.

In fact Stripe and Braintree (and I'm sure others) have systems where the implementing service doesn't get the credit card number at all- the payment information is sent directly to the processor from the client and the implementing service only gets a vault token.

At Netflix’s size with a need for payment processing redundancy I imagine they would store and vault it.

They do this based on decades of near unanimous feedback and in many cases anger so cardholders do not have to change all their billing setups just to block txns to new merchants going forward.

I started being charged $17 a month for Amazon Prime. I contacted Amazon and confirmed I didn't have, and had never had Prime. It was a fraudulent third party.

I think the scam must rake in huge sums of money, given that it could slip by for months unnoticed.

EDIT: Amazon confirmed my card was never used to purchase Prime for me or anybody else. The scammers were just charging my card $17, and hiding the charge under the name 'Prime Subscription'.

It's also super easy to get suckered into signing up for Amazon Prime. It's happened to me a couple times.

How did the third party benefit?

They got $17.

They (third party) received all the benefits of prime without having to pay for it.

No, Amazon confirmed my card wasn't even being used for Prime at all. They just charged my card with the name 'Amazon Prime', and were withdrawing money from it.

Affiliate fraud maybe

They were stealing actual money on labeling it as a “Prime Subscription” to avoid detection and direct the issue initially, when detected, at Amazon, which probably averages getting them a few extra billing cycles each time they pull the scam.

>EDIT: Amazon confirmed my card was never used to purchase Prime for me or anybody else. The scammers were just charging my card $17, and hiding the charge under the name 'Prime Subscription'.

They were probably just trying to confirm the card is active. Stuff like gas stations and vending machines can set off alerts since they're common vectors. (Ex: my issuer called me immediately after I first got a card and bought gas for it, because someone who previously didn't buy gas doing so in an area far from home was a common fraud pattern)

If the small charge works they can try bigger items.

I just went through this with Chase. Their criteria is six prior recurring payments for a given merchant to allow payments to continue on the old number from that merchant.

Not just in case of a compromise - many issuers will let things go through to the old # when it expires and a new card is sent out.

This can create unforseen problems that aren't fraud related as well.

For example, I had to replace my iPhone at one point, and update my 2FA codes. (Even if you back up your iPhone reguarly, 2FA codes in Google Authenticator are not backed up)

Unfortunately, I'd lost my recovery code for one service provider. They wanted the last 4 of my CC a one of the points of data in their verification process.

Then told me it was incorrect.

Luckily, the CC issuer (who sadly, for security reasons I'd rather not name) had some excellent customer service.

They realized that they had been billing the previous card number since it was a known re-occurring payment, and were able to work with me to retrieve the last four digits of the old card number via an old statement, enabling access to my account.

I've since moved over all my reoccuring payments to that issuer. (And made a document outlining which merchants have which cards on autopay so I can update them when cards are re-issued + backed up my 2FA recovery codes in a secure, offsite, physical location)

That has become a pet peeve of mine. When the answer to "Can you give us the last four of the CC you used for your last purchase with us?" is "Well, that was a few years ago. I shredded that card when it expired as I always do. This is not information that I have and frankly it isn't even information that you should still have under PII laws."

2FA codes are backed up when you do iTunes backup. That's how I transferred to a new iPhone.