Hacker News Reader

Comment by lawnchair_larry | Hacker News Reader

This seems to do a lot more than canceling trials, and I really like the idea.

Unfortunately, you can't even get into the app without providing your phone number and then entering your banking information.

Nope, not happening.

It's not that I don't trust the kid making this app. I mean, I shouldn't trust him, but that's not even the issue. He is using a personal developer account, doesn't seem to have a proper company, is involving third parties for app functionality (including the banking info).

Even with the best of intentions, he's likely to get hacked or bought out, or his third party SDKs are, and there's no way to protect yourself from that.

You would have to be seriously foolish to type your bank username and password into this thing.

Maybe someone can make a virtual bank app, so you can sign up for virtual credit card apps...

View on HN

privacy.com allows you to do this, you can generate virtual credit cards that are one use only, one source only, with spending limits, etc. The only gripe I have is that it's linked to your checking account and not your actual credit card.

It's because they're acting as a 'credit card processor'.

If it was card to card, they'd be eating credit card costs... they currently profit from your usage (interchange fees)

I figured that was the case, but I would seriously consider paying a reasonable annual fee to use my actual other credit cards, not every thing I buy online is cheap.

Privacy only makes money from interchange so it's understandable that they wouldn't forego their revenue model by having to pay the interchange themselves (merchant pays interchange for each transaction). I assume this business model is also why it's not available in the EU, as they regulate Visa/MC by limiting how much interchange they can take.

I've heard a lot about privacy.com for this kind of thing lately (seems similar to bank of america's "shopsafe" feature?), and I have a question: even if your card fails to process, if you've entered a contract to a pay a subscription fee to a service provider, are you not legally bound to pay up? not that most services would bother trying to collect, instead opting to shutter your account -- but, in theory, is the legal liability still there?

Sure, and some companies could send you to collections or something similar, but not many would over a $10/month subscription.

More and more have realised that a $10/month subscription is actually the perfect thing to send to collections.

They sell it off to a collections company, often for $50 or more. That company adds fees, interest, and charges to the bill ($50 for each letter, etc), and finally takes you to court when the amount owed gets to $3000 or so.

The court can't chuck out those extra charges, since they can be seen as a legitimate consequential expense.

I throw in a fake name and address

well see now thats mail fraud

Thats the high risk strategy... After sending 50 letters and court summonses to your fake address, they finally get a court to order your ISP to give the real details, and suddenly you have a $10k claim with the added charge of fraud...

Except a $10/month Netflix subscription is not a lease, it's a prepaid service. They all state very clearly that if, and when, someone doesn't pay those services are no longer rendered.

The gym memberships could be different if the contract is setup to give you your first month free when you sign up for six. But even then most give you some guarantee such as "if you're not satisfied". I think your point is that this type of service creates a cat and mouse game with which there is only a temporary winner.

What I do like about this new "trend" is the abstraction of the end user. Netflix doesn't need to know who I am. If I pay I should be able to consume service. I realize this opens the door to more potential fraud for them, but the reality is the people commiting that fraud today are already using fake names, addresses and email. And if services don't have real information and single use card information when they get breached the value of each record is significantly less. So at the end of the day the inconsequential side effect seems to be a win from a breach cost standpoint.

Love privacy.com, but I can't seem to use it outside the US :(

This is likely due to anti-money-laundering / know-your-client (AML-KYC) US regulations (similar in many other countries).

Can you elaborate? I'm no longer US based, so it's not about me travelling.

Would you be in a country that Revolut operates in? Not exactly the same, but you can get "Virtual Cards" that is different from the physical card attached to your account. You can change this "Virtual Card" after each purchase so the card number changes. Your name is still attached to the card number but if you dispose after use, attempting any additional transaction on it will fail. This will catch these free trial out and other fraudulent activity caused by sharing card details with shady online businesses.

It's weird that the app is still under his personal account especially when he just raised like 5MM from institutional investors: https://twitter.com/jbrowder1/status/1146544737622433792

> is involving third parties for app functionality (including the banking info)

like credit card processing the bank connection is something you want to be done via third parties. it would be a much bigger deal if he was intercepting bank logins and scraping.

In a lot of European banks, single issue virtual credit cards through app already exist.

I once worked at a large company, where half of the IP addresses in use were personally owned by one of the infrastructure guys

Why would they need your bank info at all, when the whole point of this is to not pay for something?

I can see putting in a real credit card for a subscription fee of some kind, but there is no way I'd give out bank info when the entire point of the app is to do exactly the opposite.

So he can see who's charging you

Seems unnecessary. If the point is to not pay after free trials, why not just have a card that declines everything. It is still valid to sign up, but never will actually accept any payment request.

Because they are giving you a real credit card number with real charge capability. What if you use the CC to make an actual purchase?

They go through Plaid, no? Isn't that safe?

if you hit a key on my UI I will know regardless of the intended receiver

I don't think that is true with iframes, which is what plaid uses to allow users to enter their banking information. So plaid still can get all your keypresses but an app that uses plaid does not.

To be clear you have to trust plaid, and you have verify that the web app is actually using an iframe and not just faking the plaid interface. But you are not just trusting a random web app with your banking credentials.

Reply on news.ycombinator.com