Hacker News Reader

Comment by senectus1 | Hacker News Reader

lol the things were called "Dum-Dums"

Parents letting their kids access an amazon account with CC details saved definitely fits that description.

That wouldn't be a problem in the EU. Children are not able to consent to a contract.

That amazon assume that it is the adult authorising the transaction is a decision made by amazon to facilitate purchase. i.e. it is Amazons problem, not the parents.

I'd guess the number of contested transactions are sufficiently low that amazon generally doesn't care to enforce additional authentication to reduce the likelihood of unauthorised purchases.

How is a website owner is supposed to verify that it’s an adult or a kid pressing ‘buy’ button while being logged into an account with adult’s details?

If it's a 4200 dollar purchase, shouldn't there be purchase verification like 3DS?

Consumer protection laws assume that big guys can amortize pains and suck it up. They are just built unfair to counteract the already unfair power gradient between individuals and businesses.

By not considering the ability to click a "buy" button as sufficient authentication?

Amazon do this because it makes it frictionless for the legitimate consumer - but at risk of letting through unauthorised transactions.

What is the alternative? Have a video call with anyone wanting to make an online purchase? What about deepfakes? It’s effectively impossible to determine that the person clicking “Buy” is not an adult, especially if that person is using the account of an adult with permission.

> What is the alternative?

Asking for a CC, password, fingerprint/passkey, authenticator, email confirmation?

If the CC is stored in autofill, as is the password, and the child has access to the device (presumably through biometrics), then none of those prove an adult clicked “Buy.”

Still, there is no need to throw the baby with the bathwater.

If you’re claiming that no security is possible, might as well allow anyone to login on any account.

Alternatives DO exist.

And even then, you are still protected by law if it is a child that makes the purchase.

I'm pretty sure that it is possible click and buy in the EU.

I'm not willing to test in (I don't buy from Amazon) but almost all the time when ordering online from Denmark, I have to authorize the transaction with the second factor — phone app or TOTP key etc.

This applies even when I'm a repeat customer.

It depends on the payment method, but for Amazon for me that means either using the Dutch Ideal system which means I have to use my bank's authenticator (which takes my debit card and asks for a PIN) or my bank's app (PIN plus unlocking my smartphone) to approve the transaction, or to get asked for my credit card's 3dsecure password and (often) a confirmation code sent by text (again requiring unlocking my smartphone).

There is no way to just click 'buy' and have it delivered. Only AliExpress does that for me. Perhaps this is possible in the EU with Amazon Prime? All Dutch online shops use Ideal, so accidentally ordering something there is just not possible unless you give your kid access to your smartphone and PIN.

It is and I would love to know when exactly that is the case. Normally all my online payments require 2FA, but some companies can apparently just transfer my money automatically. I'm guessing they need some kind of agreement with the bank, as otherwise 2FA would be pointless.

Exactly this. Some vendors such as Amazon have agreements with SWIFT providers to bypass 2FA.

This comes with extra liability but this is part of their risk and costs.

Nobody is saying it isn't. Parent was saying the burden is on Amazon because they're allowing this to happen without further verification - so in the EU Amazon wouldn't be able to enforce a "you bought it, you're stuck with it".

It is, yeah. But it’s not legally binding if a child misuses that mechanism.

Yes it is, at least in France. I do it all the time with Amazon

I do not think unauthorised transactions are much of an issue, and as an other commented asked: what would be the alternative? Come on now.

The solution (that many people do not want to hear) is very simple: supervise your kid, be a parent.

Edit: I love getting down-voted for saying "be a parent". Laughable. We are on HN and you do not know how to prevent this from occurring? Read the other comments, there are lots of suggestions. You have absolutely no excuse.

Or just log out of your accounts when your not using them. Seriously, I do believe that I'm the only person I know who uses the Logout functionality of websites.

Or let your kids use a different user account on the computer.

There are so many ways to prevent this, we would probably be here all day if we started listing them. There is a thread with such ways.

> That wouldn't be a problem in the EU. Children are not able to consent to a contract

Same in the US. However I can think of a couple of things that might counter that in some countries.

1. In many countries there is an exception to the rule that minors cannot consent to a contract when the contract is for necessities, such as food, clothing, or shelter.

Lollipops are food so someone could at least try to argue they are necessities.

2. One might argue that the contract is between Amazon and the account holder, not Amazon and the person who placed the order.

That's how things work in many other situations where a child can run up a large bill on a parent's account.

For example if your child was playing with your thermostat in the middle of winter and changed the settings so that it was using your emergency backup resistance heating instead of your much more efficient heat pump and this resulted in a huge electric bill I doubt you'd have much success arguing that because the electric company does not have a valid contract with the kid you don't have to pay.

That would not work in EU. Every EULA has a clause that you are required to secure your device. So as parent you would have two options:

- get a police a record that your identity was stolen, rat out your children for identity theft, and maybe risk they get criminal record.

- claim you had control over your device, and they ordered that under your supervision, but argue some dark paterns from amazon.

> That would not work in EU. Every EULA has a clause that you are required to secure your device

In the EU, an EULA does not override statutory rights - especially in cases involving minors, lack of legal capacity or unauthorised transactions.

> rat out your children for identity theft, and maybe risk they get criminal record.

A child cannot commit identity theft because they lack the criminal capacity.

It's a rabbit hole, but I agree mainly because 3DS would have been triggered in the EU.

https://docs.stripe.com/payments/3d-secure

Not necessarily. I do not have 2FA when ordering from Amazon in France.

Interesting. There are exemptions, but not usually for that amount.

Are your purchases in the thousands getting through?

https://docs.stripe.com/payments/3d-secure/strong-customer-a...

Ah. I never purchased on Amazon for thousands. Maximum was probably a tad under 1000€, and these are so rare and years ago that I would not swear that an extra confirmation was not needed (but nor 3DS but at best the CVV)

For a few hundred I was not checked (that one I am sure)

Reply on news.ycombinator.com