Hacker News Reader

Comment by Xirdus | Hacker News Reader

The problem with 3D Secure is that the merchant can unilaterally decide not to use it, which defeats the whole purpose of 3D Secure.

View on HN

> the merchant can unilaterally decide not to use it

If they do so, they are telling the card issuer that they are happy to be on the hook for chargebacks/fraud. It's not an decision without consequences

Comparing to fraud 3DS reduces sales turn over by a lot, and this is the reason why for the most part it is not required in the US, too much friction during check out hurts business.

Are they, though? Does the end customer get more post-transaction protections when not using 3D Secure? That doesn't sound right. I'd think the merchant is on the hook exactly as much either way.

> Does the end customer get more post-transaction protections when not using 3D Secure?

That's not quite how it works. The merchant gets less protections, because they are opting to allow potentially fraudulent transactions.

The difference is whether Visa eats the cost of dealing with the fraudulent transaction

I tend to associate ignoring 3D Secure with Stripe. In the name of "less friction" of course.

non-3DS payments are trivial to chargeback, at least in the EU

In America all payments are trivial to chargeback anyways.

We ought to have liability shifting. A long time ago there was a liability shift where if a merchant uses the magnetic stripe on a card equipped with a chip, then the merchant is unconditionally liable in case of a chargeback. We just needed merchants to be liable when the bank supported 3DSecure but the merchant chose not to use it.

They are everywhere. Default liability for online payments is and has always been with the merchant; only 3DS and some wallets can shift it to the issuer.

Reply on news.ycombinator.com