Hacker News Reader

Comment by poopypoopington | Hacker News Reader

To play devil's advocate – who cares? We've had magnetic strips for decades and they work fine. Yes, they're insecure but anti-fraud measures taken by the bank can mitigate that. If this helps more stores accept payments without having a painful transition isn't that worth it? I use Apple Pay most places but I don't mind having to use a strip once in a while or if others do.

View on HN

Think about who is paying for that fraud. Prior to EMV liability shift, Banks paid for the fraud. After Liability Shift, merchants are paying for fraud using magstripe.

Merchants don't want to be responsible for the fraud, so they are incentivized to get rid of the mag stripe.

I really doubt that banks will pass on the savings onto the consumer of fraud mitigation once EMV is fully implemented.

Who cares? Just taking the profits away from criminals would be good enough.

Force them. The EU has successfully capped interchange fees in 4-party schemes.

Depends on the transaction, but merchants can absolutely be liable for fraud before the EMV shift...

Also the rate of mag fraud is still pretty low, more Online Fraud which was ALWAYS liable to the merchant and did not see to do much ti incentivize any changes there.

Causing 90% of your customers pain to save less than 1% on fraud is likely going to cost merchants more than just paying for the fraud, which is also the math online merchants used. Online merchants that have huge fraud prevention lost more customers than the fraud....

Hell I remember one time a online merchant wanted me to submit more info after the sale for anti-fraud... I cancelled the order and bought from someone else

In both of those cases, consumers are paying for fraud.

>painful transition

How painful could it possibly be to go and buy a new card reader? Why doesn't the payments provider offer them as part of the service? They are not so expensive.

The reader may be cheap, but the things its integrated with aren't. If it costs $20k to replace a gas pump and you have a half dozen pumps, the cost of replacing them might be comparable to the value of the gas station. A grocery store point of sale system is even more expensive, around $40k a pop. Maybe you're lucky and the manufacturer of your current setup has made it in such a way that the card reader can be swapped out without replacing the entire thing, but that's a big if.

It's not like this is an investment that will lead to more customers or new revenue, this is a big expense just to stay afloat. Getting financing for such an expenditure is extremely difficult. At least in a mixed ecosystem you might be able to recoup some of the cost selling your old equipment, but no one's going to buy it if it's going to stop working soon.

It is weird that a lot of folks in the thread ignore the very real costs of transition. If there was a nationwide subsidy system for retailers from merchants and banks for fraud reduction en masse, then the transition would be smoother. But since there isn’t it’s partially an iterated prisoner’s dilemma.

>the manufacturer of your current setup has made it in such a way that the card reader can be swapped out without replacing the entire thing, but that's a big if.

This seems to be universal in Australia. Even the mega store self serve integrated systems have a separate machine mounted on for processing card payments.

Visa and MC put Australia in the Asia-Pacific region, and the regional rules and fees have been gradually changed (2004ish onwards) to favour chip payments. There still had to be an extravagant amount of re-work for ATMs and compromises to suit some of the major players in Oz, whose quirks dictate the norms for the rest of the market.

Even if the machine is physically separated, it still needs to be integrated. At the very least, you need a way of telling the machine what is owed and a method for the machine to communicate back that the amount has been payed, and it can't be easily spoofed. Nowadays there is a lot more customer specific integration as well (deals, rebates, signing people up for mailing lists, etc). There are about a dozen different communication standards for POS systems, and some POS systems support more than one, but there are also boatloads of proprietary communications protocols floating around. Presumably you're replacing the POS system with one from the same manufacturer, so the communication protocol is likely to be supported, but that doesn't mean any custom software you have on your system will run as is.

And even if you can hotswap a POS system, they're still expensive. A machine plus software is about $4000 per lane, and that's when you're not a captive market. Even small retailers typically have enough lanes that this is a significant expense. People in this thread are giving prices for Square readers which 1) are not at all sufficient for most businesses and 2) are sold at a loss while Square makes its money on transaction fees and subscription services (the same is true for the rest of the Square clones). It's like comparing a home projector to a movie theater projector.

The fatter margins in card processing in the US can pay for more fraud than in other countries where regulators have limited card processing interchange fees (e.g. 3% is common in the US, 0.3% is regulated in the EU)

> but anti-fraud measures taken by the bank can mitigate that.

Not really. Anti-fraud measures by the banks usually amount to taking the hit themselves, unless they actually catch the culprit. And that's only in the case of actual fraud. In other instances, the banks' algorithm screws up and blocks your card for a legitimate transaction. Then there's the hassle of replacing your card.

In the U.S., the bank where I have my checking account can print cards in the branch, but many more make you wait for the ever-worsening postal service to deliver you a new one.

Yes, they're insecure but anti-fraud measures taken by the bank can mitigate that

But the bank doesn't pay me for my inconvenience in noticing and reporting the fraud, and then the time to move my recurring payments to a new card.

I wish contactless payments worked with my card more places, especially gas stations.

Anti-fraud measures for inherently insecure mag stripe are really tilted in favour of the big operators who can afford a well-skilled fraud shop or a provider who’ll happily charge millions per year in licence fees. The difference in fraud-to-total-dollars-transacted between a big player vs something like a credit union can be 20x, especially if there’s a major counterfeiting campaign. And it’s generally considered a social good not to make things easy for organised crime.

Reply on news.ycombinator.com