I have uncovered flaws in online merchants this way, and notified them. They were usually grateful, especially so since the fraudulent charges failed.
I used them for a purchase, the company then blatantly lied about everything (tweeted that "everyone's order was shipped" 2 weeks before I even got a tracking number).
They asked me for the following:
- Order receipts
- Email communication with the company
- Tracking numbers
- FedEx investigation (consumers can't open these, only the shipper)
I showed them the chat history with FedEx refusing to open a claim, and provided the other information.
They then proceeded to IMPERSONATE ME to FedEx live chat "to prove I was lying." The sent screenshots only showed them asking if a tracking number had been delivered, not any of the actual data around the tracking number.
Needless to say, I've never used them for anything again and post this everywhere I see them mentioned.
Higher tier credit cards often have additional insurance that goes beyond what the chargeback mechanism is designed for, though, but for fraud, you shouldn’t need these.
I think something like 85%+ of banks now offer next day refund of fraudulent charges from debit card charges. But that statistic is kind of meaningless in that, if your bank offers it, there's not a lot of extra protection a CC card grants you unless there's a specific value-add to the card that is meant to retain you as a customer.
And if it's international dispute raised after 14 days you might get no where.
At least for consumer debit cards, that's not the case. Regulation E requires provisional credits (until the investigation and/or chargeback process is complete) in essentially all instances of fraud.
> And if it's international dispute raised after 14 days you might get no where.
Where do you get that number from?
At least in the US, federal law limits liability for lost and stolen cards to $50 (when reported within two business days) or $500 (within 60 days after receiving your statement). For non-lost/stolen cards, which covers all online fraud (due to stolen card numbers, compromised merchants etc.), there is no such time limit, as far as I know.
And these are just the legal caps on consumer liability: Most issuers go far above and beyond that, and extend zero liability for effectively all scenarios, just like for credit cards.
I'm probably entirely wrong!
Because both types are virtual prepaid type cards, some services (e.g. car rental) will not accept such cards.
Of course a few of the largest banks find it worthwhile to add a page to their website where you can generate virtual card numbers, but it's not a huge win for them by any means even when they're liable for stolen cards.
The US has more of a free market approach here, and experience has shown that the conversion rate hit is often much more severe than the reduction in fraud. Consumers will just use the most convenient card, and that turns out to be the one that just lets them buy (almost) everything without additional challenges.
The EU is taking the approach of forcing all issuers to challenge cardholders for most (higher value/risk) transactions. Given that the rules are the same for everyone, cardholders have nowhere to "escape" to – and issuers finally were forced to invest into making their implementations more usable.
I’d suggest, rather than looking for a “detached service” that does this, look at what (probably larger) European banks besides than your own offer their customers built-in.
Thier at-time debit cards were good only for domestic transactions, but this virtual was good for international, & used to come up as Visa Prepaid. I used it for registering domains & amazon international shopping.
The banks here in Denmark har just less competitive and more entrenched than in the US
Payment initiation or confirmation can be an entirely separate layer (such as chip + PIN or 3D Secure).
This is actually the goal of European regulators right now (with some carve-outs for low value and low-risk transactions).
At the moment you need to provide a complete "private key" to each processor, who up the ante to: CC Number + Expiry + Security Code + Name + Address. They all ask for it, so any of them could leak it, or it could be phished.
In the US, debit card interchange is heavily regulated for most issuers (to an extremely low rate of 0.05% plus a flat 0.24$ per transaction, which can be frustrating for microtransactions, but that's a different story).
Some issuers are exempt from this requirement, though – very likely including the one that Privacy/Lithic use. This gives them a very nice arbitrage opportunity which can pay for the product and even return a profit.
In Europe, there is no such exemption, so a proxy card can even theoretically never be profitable (you earn 0.2% but also pay 0.2% per debit transaction, and after network fees, you're in the red).
What would be possible is to offer single-used debit cards that are funded from a bank account via direct debit, which is effectively fee-free (but decidedly not risk-free). Privacy offers that option as well in the US.
But given the direction into which the EU is moving (heavily guided by regulation), which is to effectively mandate 3D Secure for almost all online transactions, it's questionable how much demand for such a product there really will be, going forward.
I've only used this for the sketchiest of vendors though. Chargebacks are pretty easy for the once-a-decade event where I get billed for something incorrectly.
Not just ACH information from a check for the linked account, which is all they should require.
No, despite supposedly being privacy-concerned, they require credentials (or auth token, hopefully) that gain access to everything the login has visibility into. I have multiple accounts at these places, the checking account is a tiny fraction of what's available with creds in hand.
That tab was promptly closed and effort abandoned.