Hacker News Reader

Comment by cj | Hacker News Reader

I’m not sure about “digital wallets”, but the concept of updating credit card details after a new card is issued does exist, and it’s a service offered by credit card companies.

Blog post from Stripe:

https://stripe.com/resources/more/what-is-a-card-account-upd...

View on HN

it's called automatic billing updaters.

Visa: Visa Account Updater (VAU) https://developer.visa.com/capabilities/vau Mastercard: Automatic Billing Updater (ABU)

it worked fine for sometime, but the problem is that now the stolen credentials are being refreshed now as well.

Ideally, the issuer is able to investigate what type of fraud exactly happened on the card, and in case of a suspected compromised card number they can choose to simply not perform account updates or carry over tokens to the new card.

Practically, it's of course not that simple or clear-cut. As most things in payments, this too is a trade-off of cardholder inconvenience, support effort, fraud losses etc.

There are also "network tokens" that allow you to skip this step and instead remain linked to the new credit card when it changes.

Indeed, I suspect that's what went on here. I don't think there even exist 99 providers of what's customary called a digital wallet (e.g. Apple/Google Pay), and there's no definitely no single person that uses 99 of them.

It's bad service from GP's card company though, with network tokens they should be able to see which specific token was abused, and revoke just that one.

I discovered this "quirk" when the local ice rink started charging me for dozens of charges — I was watching them come in. There were two "child2 thechao"s (insert crazy common name); and ... they just picked one and started charging. They didn't want to reverse the charges because the mom of child2 didn't want to pay.

Interesting. I recently cancelled and reordered a card and I have still been able to make purchases via Amazon without ever making an update. In this case I am happy about it because I am lazy but had no idea how it was working. Presume this is what is going on.

Yep. I've been able to use the "wrong" (but still valid) expiration date on my AmEx for a long time. I've had other credit cards where the autopay info was never updated and it just kept working for at least 6 months.

Account Updater functionality isn't necessarily even involved there. In the end whether to accept a transaction is up to the issuer, and quite often they'll keep accepting recurring transactions on otherwise outdated card information.

Funny, the Amex on my Pixel Watch stopped working only a couple weeks after the physical card expiry.

It was quite confusing, because a) I received a replacement physical card several months before the card expiry, so by the time my watch stopped working I'd entirely forgotten about it, b) there's no indication anywhere in the Android/Wear OS of what the expiry date is or that it might be expired and c) there's no indication at the point of sale that the virtual card is expired, simply a generic "Declined" message.

You can run a charge with only the card number if you have sufficient trust. Each additional piece you add reduces liability and transaction fees (add exp, add cvc, add 3ds, ...)

I also noticed that my Google Wallet cards no longer have expiration dates- when a card expires and they issue a new one, the Wallet card works without any intervention on my part

Wallets usually don't store the card information directly anyway, but only a token, which can be re-associated with new underlying card details when the card is replaced.

The token itself does also have an expiry date (it's a mandatory field in most protocols), but that can be updated as well, I believe.

That's very much contrary to my experience just a couple months ago that I detailed in another post: https://news.ycombinator.com/item?id=47981956

Reply on news.ycombinator.com