Hacker News Reader

Comment by Aurornis | Hacker News Reader

> The online function shall apply to physical payment cards and accompanying PIN code when purchasing essential goods such as food, medicine and fuel.

Is this a typo where they meant to say “the offline function”?

If I’m reading this right, the goal is to allow food, fuel, and medicine purchases with card + PIN in offline mode.

Seems like a reasonable goal. I wonder what the technical details will look like. Will there be a periodically updated list of cancelled cards/accounts distributed to endpoints? Even a hashed list of all cards cancelled before their expiration date within a country is a reasonable amount of data for modern storage systems.

Or would they simply rely on the ability to track down account owners by their originally registered contact info in the event that someone gets an invalid transaction through during an offline period?

View on HN

> I wonder what the technical details will look like

It’s already a thing, the EMVCo standard predates ubiquitous internet connectivity. Mass transit systems typically use it, airlines used to for in-flight purchases before the advent of reliable WiFi.

https://en.m.wikipedia.org/wiki/EMV#Offline_data_authenticat...

It is somewhat common to maintain a denylist of known fraudulent cards, but as you note the main mitigation is on the bank to track the card down. One of the key things you need to figure out with an offline payment system - and what I imagine is needed here - is a consensus on who has the liability for offline transactions and what the dollar limits are.

The card itself knows its balance and is authorised to approve transactions up to a limit fully offline.

The UK already does this in some shops for low value items for NFC payments. You can tell the offline transactions because they immediately say 'approved' rather than taking a few seconds.

If it turns out the card approved something 'wrongly', for example because you had previously reported the card lost to the bank, then the bank refunds the transaction and claims the value back from the merchant. That's why many merchants have their terminals set to require online payments.

Your card doesn't know the balance, it doesn't work like that.

Offline transactions mostly died off when the limit in the UK for contactless was raised to £100. At £20/30 (the original limits) issuers/merchants risk accept some payments not being valid (and the total limit before you had to chip and pin was fairly low top).

And worth saying, the merchant has some control on the terminal but mostly the decision of offline/online is down to the issuer and configured on the card.

Out of interest is this both debit and credit cards, or just debit?

Some debit cards don't allow offline transactions, usually when the cardholder isn't allowed to be in debt.

In the olden days, you'd get a Visa Electron or Solo debit card in the UK if you were under 18 or had a poor credit history.

Visa Electron and Solo were online authorisation-only card brands (also known as "immediate authorisation").

If you didn't have enough money in your account, the transaction would be declined. Visa Electron cards didn't have embossed numbers on the front, so couldn't be used with the old-fashioned card imprinters.

Visa Electron and Solo have been discontinued now, so people with poor credit can get a Visa Debit or MasterCard debit card, but with offline authorisation disabled.

That does mean those cards can't work in some places (e.g. on aeroplanes or trains).

Credit Cards generally always support offline authorisation.

Mostly identical. Credit cards will probably have different risk rules though - after all it's their money not yours :)

It's incredible how the banks refuse to lose here; they will screw over the merchants before taking on any liability in this matter.

When you set up the POS you can choose whether to allow offline auth or not. It makes transactions a little faster, but you’re the one who takes the hit if the card bounces later. Just comes down to whether you value speed over the extra risk.

I assume it's a typo or equivalent mistake.

EMV (chip cards) can have a small amount of local smarts, so it is typical for example to insist on going online for a large transaction or if the card has performed too many offline transactions since last going online. The card maker decides these rules, so the bank gets to ensure the cards it issues to customers meet whatever requirements it has decided upon, balancing fraud risk against problems with loss of connectivity or services being down.

So I doubt they'd bother doing some sort of ad hoc revocation technique.

Reply on news.ycombinator.com