Hacker News Reader

Comment by spinlock | Hacker News Reader

Just to explain, people selling stolen cards have a reputation that makes them money. If they have a reputation for selling cards that have already been burned, they can’t sell each card for as much. But, I’d they have a good way to test their cards, they can get a reputation for only selling cards that still work. This lets them sell each card for multiples of what a fraudster with a bad reputation can charge.

View on HN

I have no idea why it works this way these days, online fraud should have been solved a long long time ago with technology. The banks/mastercard/visa have the ability to mandate much better security mechanisms (3D Secure etc., 2FA, generating some secure token for any large purchases etc.) so why aren't these compulsory?

Having worked on the banking side, I’d say it’s because bankers hate technology. You’d be amazed at what some people will do to avoid it. I had one guy retire in 2005. When a new account manager took over his clients, we learned he’d been telling all of them the bank didn’t have email. Just because he didn’t want to adopt it.

The first bank to only authorize purchases with 3DSecure lowers the fraud rate a lot, but people with multiple cards will mostly choose to use other cards, because it's less friction.

Anyway, the merchant eats fraud for card not present transactions. So why would the bank choose to reduce its payment volume in order to reduce fraud it doesn't even have to pay for?

If the merchant says 3D Secure only, it reduces fraud, but also reduces payment volume, because most customers will choose to use a merchant with less friction, especially if their issuing bank doesn't do 3D Secure, or it's broken when they go to purchase.

Reducing fraud is good for merchants, but it the drop in sales may not be worth it. There's a lot of other things merchants can do to reduce fraud that aren't likely to cut into sales as much.

Reply on news.ycombinator.com