Hacker News Reader

Comment by lopkeny12ko | Hacker News Reader

This is an important lesson in data and operational security. Don't use your credit card on websites you don't trust, and use virtual cards whenever possible. And 2FA all your online accounts. A few easy steps could have avoided a massive headache.

View on HN

> Don't use your credit card on websites you don't trust

The person in this article bought stuff from Amazon with their credit card and did not have their account compromised. Unless you are arguing against buying stuff on the Internet in general I don't see how you comment has anything to do with the case at hand.

This is mostly typical RCMP overreach and the person should seek legal advice on counter-suing for damages.

>> Don't use your credit card on websites you don't trust

> The person in this article bought stuff from Amazon

Yeah, you shouldn't trust Amazon. They don't do nearly enough to ensure their 3rd party marketplace is safe.

Amazon is one of the largest companies in world. They have a responsibility to be more trustworthy than this, and should be held accountable.

I agree, and I didn't mean to blame the victim here (in case it sounded like that to anyone).

But it is a lesson to the rest of us, about the risk of shopping on Amazon.

I totally agree, and I don't buy from Amazon as a matter of principle, but considering their size, clearly most people don't. And I suspect that's not because they're fine with the risk, but because they're not aware of it. And that's a problem. Amazon is profiting from trust that they're not worthy of.

If the man is taken at his word, his only error was buying from a seller on Amazon.ca. What credit card he used there didn't matter at all.

How about we simply make credit card companies liable for all of these kinds of frauds? Not the merchant, not the consumer, not the marketplace--the credit card company.

If we did that, suddenly all the banks, marketplaces, etc. would have all the nice security things we've been bitching about for years.

They are, that's part of the point of having a credit card - you're spending the bank's money, not yours, and they have better lawyers.

Well, that is why I totally prefer debit card. Credit card basically you just borrowing money from bank for your (usually daily and small) purchases.

Not in my experience. It appears that way to the CC user, but usually comes back to the merchant as a chargeback.

Every time credit cards come up, everybody always tells me that this is their big advantage: that it's trivial to revert these two payments.

So this fraud shouldn't work, and yet it does. How is that possible?

Reversing the payment to Walmart doesn't reverse the shipment, and assuming they don't get arrested or harassed, and the triangle purchaser is none the wiser, so the fraudster gets apparently clean money from the triangle purchase.

Unless he's alerted, which is the case here. He could agree with the woman that they both reverse their payment.

The two websites in question were Amazon and Walmart. If you can’t trust either of those then who can you trust?

Technically it was a 3rd party seller right? Like eBay or a flea market or the back of a truck?

Technically, yes. But Amazon's site doesn't make this clear.

Yes, but you still pay Amazon, and Amazon pays the seller. Using a virtual card wouldn't have helped him here. The other victim wouldn't have been helped by using a virtual card at Walmart.ca either.

A virtual card that expires or is limited would have protected somewhat.

No, because the order would still have gone on Walmart.com with his real name and address

There are no virtual card options

I completely agree about using Virtual Credit Cards generally. However, the majority of Canadian Banks (Especially the Big 6) don't offer virtual credit cards. Even US banks that offer credit cards in Canada don't offer it in here, but they do it the US (Ex. Capital One).

How would this prevent what happened to Timothy Barker?

Unfortunately in this case, the guy getting punished didn't do anything wrong. It's the woman who's Walmart account was hacked who messed up.

Even then, I'd put at least some blame on Walmart. Adding a new shipping address to an existing e-commerce account is an obvious situation where a little extra scrutiny is warranted. At least a 2FA check.

I agree. In my country, many e-commerce platforms require to add of a phone number. Therefore, if you add an address, you must input the code sent to your phone. Another point to note is that, for additional security, some e-commerce platforms even put your account on hold for a few days if you change the aforementioned phone number.

Even Amazon in the past has at least asked me to reenter the card’s CVV when attempting to add a new address.

They claim he used the woman's card, so no that wouldn't have helped

And don't buy anything from Amazon (at the very least only from sellers that use Amazon's fulfillment services, which is easy to gloss over).

Reply on news.ycombinator.com