Hacker News Reader

Comment by kstrauser | Hacker News Reader

In the dark old days before Apple Pay, where it was common in America to hand your credit/debit card to some rando at a restaurant and have them disappear with it for a few minutes, about once a year my bank would call me to ask if I'd been using my card in some far-off locale:

"Hi! Are you in Tijuana?"

"Not since 1993. Why? What's up?"

"So you didn't just try to buy gasoline at a PEMEX there?"

"Nope, I'm in San Francisco as speak."

"OK, thanks! We'll get a new card out in the mail to you."

That's a pretty low bar for identity theft, but I think it's defensible.

View on HN

I’ve been using debit and credit cards since long before the ‘dark old days’ ended (1992? 1993? Long before debit cards were a common thing), and I still hand my card to anyone who needs it to do their job. I’ve had identity theft happen a grand total of never.

Anecdotes are worthless.

I think tap-to-pay terminals that the server carries now eliminate more of this. but occasionally I have to give my card over.

On the other hand, stolen credit cards were kept by the restaurant and they got a reward.

Nowadays I don't think there is ANY checking of whose card is being used.

That you know of

Credit cards never generally required identity verification (especially not for the cost of a restaurant dinner; anti-fraud measures might kick in for larger purchases, though), that was always a "feature". (Credit card companies want people to spend money and have always prioritized that over fraud detection.) Even the whole "I'm going to write Check ID on the card signature line" thing was never officially recognized by credit card providers, and explicitly was against the Terms of Service of most of them. The signature line was never meant to be an anti-fraud tool, it was your acknowledgement that you had read your Card's Terms of Service and accepted that contract, a holdover from the days before software invented shrinkwrapped/clickwrapped/SaaS contract acceptance and contracts still generally needed an explicit signature of acceptance. (That's the reason signature lines are just now disappearing, the Credit Card industry is finally following the software industry on "any and all possible uses of our services is acceptance of all of our contracts"; nothing to do with how much more NFC and EMV chips are secure against fraud.)

>tap-to-pay terminals

Becoming marginally more popular in the US but still the exception.

You must have been going to some very shady restaurants. I still hand off my credit card to a rando. I did it today. I did it last weekend. I've never had this problem.

This exact thing happened to me once at the hotel bar in the Santa Clara Convention Center / Hyatt Regency Santa Clara.

Not especially, I don't think. It's incredibly common according to everything I see online.

I guess I'm just lucky.

"everything I see online" is probably disproportionately outliers. I use a credit card hundreds of times a year in many places around the world and at least cursorily keep my eye on charges in my statements and fraudulent charges are rare--like maybe every few years at most.

Yeah I agree. Not only do I hand off my card, literally everyone I know does so. None have ever had problems. I'm not saying that such fraud never happens, because it obviously does happen. But I don't think it's so overwhelmingly common as is being claimed here.

This source[0] is hardly unbiased, so take this with a heavy dose of "citation needed", but it claims:

> 62 million Americans had fraudulent charges on their credit or debit cards last year alone, with unauthorized purchases exceeding $6.2 billion annually.

However, that jibes with other numbers I've seen.

https://www.security.org/digital-safety/credit-card-fraud-re...

That jives with the number of unauthorized transactions I've had on my cards. 62/260 million adults = about a quarter of adults each year. On average I probably average a fraudulent transaction in a quarter of the years.

> On average I probably average a fraudulent transaction in a quarter of the years.

I’ve had one fraudulent charge in my entire lifetime. Once a quarter seems insane. Are you putting your card info into random websites or something?

He meant once every 4 years not once every quarter.

In my lifetime, I had my card details stolen once (in Washington DC). It was an American Express. They caught it immediately and shipped me a new card before I even noticed.

It was basically “we caught some shady shit, here is your new card number, which will be delivered today”. It is one of the reasons I like Amex. They are johnny-on-the-spot when they get a sniff of fraud.

I had my corporate card get cloned by the Wendys at Seatac airport, about 10 years ago. Do you consider that to be a sketchy restaurant? Why are you victim blaming?

I had not used the card in several weeks. Coffee and a breakfast sandwich at Wendys was the only purchase I made that day. ~4 hours later my card was declined when checking in to my hotel in LA. Called their security department, they wanted to know whether I had authorized a $4000 purchase at a Best Buy in Dallas.

I don't know how to define sketchy. I believe you. I just don't know how to account for the difference in experience.

> In the dark old days before Apple Pay, where it was common in America to hand your credit/debit card to some rando at a restaurant

I don't think I've ever seen anyone use a phone to pay at a restaurant. I think I generally see 95%+ pay with cards, the same way that "was" common. The rest is cash. Maybe I'm just not paying attention? I don't know.

I've been using my credit card at restaurants for 30 years. I've used it probably 5000 times, and I've only had the number stolen once (from a grocery store).

Where are these low-trust areas of the US? I want to visit and check it out.

Mine was cloned at a very high-end restaurant in Austin, TX.

Handing your credit card to pay is still such a foreign concept to me

Back when computers were actually expensive and wireless networking technology wasn’t as good/common, they would take your card to the back office and run it on the single, hardwired card terminal.

Nowadays it’s less of an issue as those terminals cost peanuts and WiFi is ubiquitous so they have many of them and can just bring one to your table.

When there was only a single terminal it was common in Europe to just... walk to the counter and pay for the meal card in hand. No other way to type in your PIN

Not universally true. I had a couple of cards without a chip because, reasons. I still was walking to the counter myself, because giving somebody my card feels weird.

I was having lunch at a hotel bar in Vegas a number of years back. A Brit, I think, was paying for his meal and he was like "why are they taking my card???" So I explained. In my experience in the UK, they don't want to even touch your card.

I've been using a debit card since the Dubya administration and I have never had someone use my card after I ate at a restaurant. I assume you live in a big metro area?

In Texas about a decade ago there was a criminal enterprise out of Houston that was putting swimmers on gas station pumps all over the state. Little towns, big towns, country gas stations. My now wife got hit that way.

Swimming at a gas station pump would be uncomfortably lethal.

I wonder how well you would have to be able to swim to overcome the density/buoyancy difference if swimming in a pool of gasoline?

It's a pretty drastic density difference. I think an Olympic swimmer would have a hard time staying above the surface.

It depends how long you can hold your breath. I imagine many people would be overwhelmed by the fumes before they got very far.

Gasoline fight!

Ah, 12 hours later I log back in to see skimmers got autocorrected to swimmers.

I am, but some of these events were when I was traveling through smaller Midwest towns. There doesn't seem to be a pattern to it.

In any case, it hasn't happened again since I started using tap to pay whenever possible.

Reminds me of the carbon copies (actual carbon copies) some local car renter made. They wrote your risk on the carbon copy as a "reservation", carbon copied your CC onto it and stored it in a safe. Pretty much a list of ready-to-use cards if you got hold of them.

Remember when credit cards required your signature on the back?

My mom used to tell me to write CHECK ID in the signature block. Someone only ever asked me once. It's probably been like 10 years since I've signed the back of a new card. An older woman at an antique shop actually checked for a signature and made me sign it in front of her.

The fact that a signature is, to date, a legally binding form of identification is baffling to me to be honest. More and more is digital these days, but still.

(my "signature" is just a squiggle based on my initials and I can't reproduce it consistently)

It's not legally binding if you didn't sign it, but that won't stop someone from trying to claim that you did.

I was telling my lawyer a couple of weeks ago that I wasn't even sure I could do it consistently any longer and actually practiced a bit before going to the office. She basically said "Do the best you can" :-)

If you look at the credit card agreement, a card isn’t (or at least wasn’t) authorized for use unless it had an actual signature. “Check ID” and such are cute, but really only mean that the card is unsigned and thus invalid.

Reply on news.ycombinator.com