Hacker News Reader

Comment by pavlov | Hacker News Reader

I moved back to Finland after years in the USA, and found out that credit cards from Finnish banks now require a 2FA system for online payments. It works fine. The online purchase enters a short flow with my bank, they send a request to the bank’s app on my phone, I approve it there and the purchase flow returns to the vendor’s site.

Everything about banking in the USA was seemingly decades behind my experiences in Northern Europe, so it may take a while for American banks to figure out credit card 2FA… (They still regularly use paper checks in America. Bank transfers don’t exist. Many operations require a visit to a bank branch, of which there are absurdly many. I’m surprised they didn’t have mechanical calculators.)

View on HN

> Everything about banking in the USA was seemingly decades behind my experiences in Northern Europe, so it may take a while for American banks to figure out credit card 2FA…

Having worked closely with multiple banks' credit card departments, this assertion is incorrect. American banks (and merchants) choose to not implement more security for card-not-present transactions because it meaningfully dents conversion rates for online commerce. Same goes for credit card PINs which are extremely common in Europe but rarely seen in the US. Most merchants and banks are okay with a non-zero level of fraud because stricter fraud prevention methods negatively impact user experience.

Here's an article going into more depth about the tradeoffs involved: https://bam.kalzumeus.com/archive/optimal-amount-of-fraud/

You claim that the assertion is false but you've only looked at one aspect for why the parent might think the US banking system is behind.

To put another one out there, there's no universal and practical way to electronically transfer money from one person to another. The only options are cash, checks, wire transfers and ACH. Wire transfers are expensive and ACH is difficult to use.

In the SEPA area you can transfer money to anybody else within about a day for the cost of a local transfer (usually free) with nothing but an IBAN (which can be freely-given, unlike a US bank account number).

Plus, the US has been behind for a long time for card-present transactions as well. Only in the past few years have chips started to see widespread use.

> To put another one out there, there's no universal and practical way to electronically transfer money from one person to another. The only options are cash, checks, wire transfers and ACH. Wire transfers are expensive and ACH is difficult to use.

The FedNow system, scheduled to roll out next year, is designed to fulfill this purpose.

https://www.federalreserve.gov/paymentsystems/fednow_about.h...

I've heard and it's a huge step forward but it's coming 15 years after SEPA.

This is only true for retail banking, not business banking.

The rule of thumb about the US financial system is that it goes out of its way to facilitate commerce between consumers and businesses (debit cards, credit cards), where intermediaries can take a cut of each transaction and the liability for fraud is clearly defined (merchants are generally liable for fraud and consumers have recourse in the form of chargebacks).

Conversely, retail to retail customer transactions have higher likelihood of fraud, a costly chargeback or reversal process and hardly make any money for the banks.

Similar system in Norway - where there's common 2fa Id system where banks are identity provider, and mechanism for 2fa is app, sim app (deprecated) or otp token:

https://www.bankid.no/en/company/

It's also used as a general digital ID provider.

The Indian Banks also require the same. The central bank forced them to adopt this. Any txn over certain amount (I think Rs 500, $5) needs a one time code, sent to user's phone, valid for like 10 minutes. Merchants always get a token of validation from bank, not the actual credit card number.

Any domestic transaction requires OTP. Any international transaction by default requires OTP.

Any transactions using Indian Banks need OTP over certain amount, indian website or not.

Any transactions using non-indian banks or cards go through without asking any OTP.

I agree with your sentiment, but we don't "regularly" use paper checks in the US. Many stores simply do not accept them anymore, and I can remember just a few times in the past few years where someone in front of me at a checkout was using a paper check --- because it happens so rarely that it is memorable.

Edit: And bank transfers do exist, I don't know how you can get away with just flat out asserting they don't. That's ridiculous. Wire transfers are very old but still supported for a fee, and ACH transfers are ubiquitous. They aren't as quick and easy as in Europe, but they certainly do exist. Zelle is also a pretty recent cross-bank platform for transfers that has made things much easier.

How would you pay a plumber who came at short notice to unblock a drain?

Or, say, the fees paid for your child's karate class?

Or a 'cash' gift for a teenage nephew?

Those are/were cases where cheques were used in Britain, but the first and second are now often a portable chip debit/credit card reader, or else an electronic transfer. The third could still be a cheque, or could be an electronic bank transfer.

(No-one has paid by cheque in a shop since about 2011, when the system to protect against fraud in this case was removed.)

> How would you pay a plumber who came at short notice to unblock a drain? > Or, say, the fees paid for your child's karate class?

I forgot a third development, which is thanks to Stripe and other mobile-friendly payment processors. All you need is a smartphone, and they send you a mini card reader that plugs into your phone. I see them all the time at farmers markets and even paid for a tow truck using one once.

> Or a 'cash' gift for a teenage nephew?

Kids these days use Venmo or rarely paypal. I don't like them and my family uses Zelle to send money to each other from our different banks. Same when we do collections at work for an employee's retirement gift, the organizer just sent their mobile and asked everyone to send money through Zelle. People even pay their landlords with Zelle now.

> I forgot a third development, which is thanks to Stripe and other mobile-friendly payment processors. All you need is a smartphone, and they send you a mini card reader that plugs into your phone.

Did you mean Square? They were one of the first (if not the first) payment processors, iirc, to make it easy for merchants to offer card-swipe to customers, via the mobile phone attachment you mentioned.

Wait for the bill in the post

Here in the US, when you hire a plumber/electrician/etc the large polished companies will all take a card payment (or offer financing), and the small independent one-man operations will sometime take card, but often offer a discount for paying check or cash.

How do I make an ACH transfer to a third person (i.e. not my own account in another bank)? Can I send you money using ACH with an account number you provide?

If it's possible, this functionality must be extremely well hidden.

Wire transfers aren't the same as European-style bank transfers because they're slow, expensive and seem to have weird manual validation steps.

Zelle is a proprietary kludge that has very low transfer limits, and most people don't seem to know it exists. I certainly wasn't able to pay my Manhattan rent using Zelle, so it's not a replacement for bank transfers either.

This also applies in the Netherlands, I approve them through the app.

What do people without smartphones or cell phones do?

Amex offer to email me with a OTP. I guess those without email probably don’t have much to worry about given that they’re unlikely to be doing much online shopping.

SMS tokens are on their way out as they don't satisfy the security requirements.

In this case you need to log in to your bank website and accept the transaction.

Many banks offer simple device for 2FA. It'a good idea to have it as a backup anyway for those situations when you cant access you phone for any reason. https://www.nordea.fi/en/personal/our-services/online-mobile...

I believe all banks implemented SMS and an APP, and some banks also have hardware OTP tokens

It's part of the mandatory security requirements coming with the EU directive regarding PSD 2.

> they send a request to the bank’s app on my phone

I'm glad US banks don't require me to install proprietary apps on my phone.

You might be unsurprised to know that alternatives exist. Generally SMS/email auth or hardware token auth. (Less secure and more unwieldy respectively, but there are still surprisingly many dumbphone users with a lot of money.)

it doesn't have to be an app, it can be SMS

I get this occasionally with purchases via my US American Express card, but it requires merchant participation: https://www.americanexpress.com/us/security-center/safekey/

I've gotten the same thing from Capital One

Reply on news.ycombinator.com