A simple solution to credit card fraud, part 3: the startup that never was | Hacker News Reader

A simple solution to credit card fraud, part 3: the startup that never was

blog.rongarret.info

41 pointslisper44 comments

I salute you sir. Excellent article, amusingly written - and (pardon the pun) right on the money!

Money transfer is essentially subtracting from a number on one bank's hard disk and adding it to another on a second bank's hard disk. OK, it has to be done transactionally, and you need those numbers to be secure, but really... how hard is that?

I read today that share traders are excited that they can now do trades between Chicago and NY in 8ms instead of 12ms. So why does it take me days to make a simple payment? And why does it cost more than a few micro-cents to do it?

Revolutionising value transfer has the potential to be biggest benefit the internet gives us - but seems destined to be the last one realised.

I make six figures providing online services for schools, and spend roughly half of my effort on payments. Partly resolving problems where the payment processor refuses to accept credit cards (from schools - hardly a high fraud demographic, and we've never had a customer charge-back), partly handling paper checks, partly trying to match ACH payments with customers.

Bitcoin can't happen soon enough.

> (Some people think the trouble starts when you consider a piece of paper to be money in the first place instead of, say, gold, but they are wrong. This is another tangent that I may write about some day, but for now suffice it to say that very few people actually seem to understand what money is or how it works, including many people who work in the banking industry. But I'm getting way ahead of myself.)

So sad and so true.

I wish more people could bear down, learn and realize how the money system works; how the Government controls it and what the banks involvement is.

The work that Stephanie Kelton and crew are doing over at http://neweconomicperspectives.org/ is really great if you're interested.

I think the author is very intelligent and very bad at compelling narratives. Yeah, the story's complicated, but it's not that complicated. I've seen much more complicated stories written much more clearly. I wish they would stop mentioning all these tangents and asides, and just get to the point of why a strong cryptographic system can't be implemented for money, who is stopping it, and exactly how.

It's relatively straightforward to implement a strong cryptographic system (relative to the general complexity of dealing with crypto in general). The hard part is getting it deployed. And the reason I can't just get to the point and tell you why it's not being deployed is that I don't know. It's a mystery to me. Part of the reason for telling my story and casting a wide net is the hope that someone who knows will see it and clue me in.

I'm sorry you don't like my narrative style. I'm trying very hard to stick to the facts and not over-dramatize. There's a reason I'm an engineer by trade and not a journalist.

Oh, I didn't realize that you didn't know the reason. I misunderstood your topic. My complaint was assuming you knew, and were just stringing the reader along installment after installment while diving into details before getting to the meat of the story. Now, knowing that you don't know why all your meetings with banks were cancelled, and knowing that you ultimately don't know why banks don't want to play ball, it makes a lot more sense the way you're telling the story.

And I'm sure your narrative style is much better than if I tried to tell it.

Nope, I'm not trying to be cagey, I'm trying to find a way not to don the tinfoil hat. But thanks for pointing that out, I guess I should be more explicit about that.

You are very much over-dramatizing.

Just describe the user experience. There are plenty of people here who know plenty about cryptography, payments and getting service usage.

Note: here's all you have to tell us related to cryptography: the service is as secure as a mag-stripe.

> Just describe the user experience

http://en.wikipedia.org/wiki/Chip_and_PIN

> There are plenty of people here who know plenty about cryptography, payments and getting service usage

I've explained this to you before: not all of the people who read my blog are engineers.

> Note: here's all you have to tell us related to cryptography: the service is as secure as a mag-stripe.

Apparently I have to explain more than that because that makes no sense whatsoever.

Hm, if it quacks like a troll...

Chip and pin is extremely difficult and expensive to roll out. And doesn't really address any of the shortcomings of the US credit card market. Fraud is essentially a non-issue in card-present situations.

Hardly a troll.

> Chip and pin is extremely difficult and expensive to roll out

You're moving the goal posts. You asked me to describe the user experience. It would be like chip-and-pin.

> Fraud is essentially a non-issue in card-present situations.

That is not true. If it were, they would not ask you to enter your billing zip at gas pumps. (Yes, I know they don't do this everywhere, but it is a very common practice precisely because card-present fraud is a significant problem in some areas.)

> Hardly a troll.

We'll see.

So it's like chip and pin but doesn't require new pos hardware? Is your system easier to use than a card swipe + entering 5 digits?

> it's like chip and pin

The user experience would be similar, yes.

> doesn't require new pos hardware

There are lots of ways it could be deployed. Some would require new POS hardware, others don't. But unlike chip-and-pin it wouldn't have to be custom hardware. It could be a smart phone or a tablet.

Deploying new hardware is difficult and expensive.

> Fraud is essentially a non issue in card present situations... That is not true. If it were, they would not ask you to enter your billing zip at gas pumps

Compare: Electronic interference is essentially a non issue on aircraft... That is not true. If it were, they would not ask you to turn off your Kindle at takeoff.

Just because an industry does something doesn't mean it isn't cargo culting.

They tell you to turn your Kindle off because federal regulations require it. If the free market were at work and they actually had a choice, they almost certainly would not require it because an airline that didn't require it would obtain a competitive advantage over one that did. Likewise, if there were no economic benefit to asking you to enter your billing zip, a gas station that didn't require it would have a competitive advantage over one that did, and soon no one would require it. In a free market, the only way an inconvenience can survive is if it provides some economic benefit.

Free market, democracy. Federal regulations and banking regulations. That's my point, actually.

All the problems are the integration with "real money", i.e., the account where you get your salary, the accont where your company pays salaries from, the card/whatever that you buy stuff with, and the card/whatever that you get cash from.

For that, you'd need to interchange payments with your system and bank accounts.

1) Gov't regulates financial institutions, and there are good reasons for it - otherwise Ponzi schemes and 'bankers' stealing deposits are a real pain and causes the public to ask for regulation. So they will want (force) you to submit to regulation if you want to do anything serious; or you may try to do "only information" and have another, licenced institution (a large bank) hold the actual money - this is what many finance startups do, but then they depend fully on the bank(s).

2) Gov't and banks don't like anonymous transactions, and there are good reasons for it - money laundering, tax evasion, organized crime and stolen money are very real issues. A basic principle is 'know your customer', i.e., don't do any [above $X] business with anyone you can't identify; and don't allow your customers to front payments on behalf of others, unless they identify all those others to you in each transaction. And it's often simpler/cheaper to disallow 'on behalf' deals at all than to integrate your customer/transaction data with the bank's systems. For example, see MtGox AML limits for money withdrawal - if you want to handle "real money", then that would apply for all transactions, not just withdrawals.

3) There are a bunch of consumer protection laws that may hurt you. For example, if a customer's account is hacked and money transferred, above a certain limit you (not the customer) will be liable for the loss. And there are other cases as well. So you (as the organizer) really, really want a money system where payments are (a) traceable, (b) revocable if legally required and (c) can't easily go to any other untraceable, irrevocable systems. Banks do so. The alternative is to charge huge fees to cover the risks to you.

4) Payment systems (ACH/etc) require huge collaterals or guarantees from participants - and there are good reasons for it, as you don't want to receive a gazillion payments, give the money to your customers, and then have the payer institution say that they're insolvent and won't cover the bill for the payment-messages that they sent. Technical and legal barriers to joining are also quite high.

Good summary. 1, 2 and 4 are really about trust - if we trusted some institution implicitly, they could run the perfect online bank for the world. The first real banks got started in the 19th century when Quakers started them, because people (even from other denominations) trusted Quakers not to rip them off. Maybe the Dali Lama needs to start an internet bank for the world.

And point 2... as a society, we have a very important decision to make. Do we trust our governments to control our money - and that of the terrorists, child pornographers and media prirates? The right to control our own money is disappearing as cash is slowly supplanted by cards, and I expect swift action against bitcoin if it gains traction.

This story is getting even more bizarre. You pitched a start up idea to a Wells Fargo branch manager?? That makes no sense at all. The insinuation that bank higher-ups were actually evaluating your idea and killing it is presumptuous. Unsupported ideas have very short lifespans. Do you realize that Dwolla is trying to do similar things but it takes dozens of employees, millions of dollars and an indirect route to get there (same with PayPal)?

I guess I'll keep reading because the inanity of it all has me hooked but pray tell part 4 gives some sort of short description of the user experience for this supposedly simple solution (that sounds anything but simple so far).

> You pitched a start up idea to a Wells Fargo branch manager?

Sure, why not? Had to start somewhere.

> The insinuation that bank higher-ups were actually evaluating your idea and killing it is presumptuous.

I don't know what happened at Wells, but I do know for a fact that senior management (and in two cases the CEO) was not only evaluating the idea, but actually signed off on it later. Just because I started naive doesn't mean I stayed that way.

> Do you realize that Dwolla is trying to do similar things

Of course. So? Lots of companies are trying to do similar things. None of them (except Paypal) existed when I started.

> but it takes dozens of employees, millions of dollars and an indirect route to get there

Yes, of course I realize this. And your point would be...?

After reading parts 1 and 3, I think posting this in parts is just going to maximize misunderstandings (whether accidental or deliberate). It's just one cliffhanger after another. Maybe you should just wait until the whole thing is written.

I appreciate the constructive suggestion, but it's hard enough to write this in installments because I have a very diverse audience, and I don't really know who is tuning in. So getting feedback and mid-course corrections in the form of comments really helps me figure out what to focus on next. I don't think it would be possible for me to write this all at once.

I wonder if the author ever tried reconnecting with some of the early banks they talked to. Stripe works with Wells Fargo. When you open an account with Stripe they actually open bank and merchant accounts under your company's name with Wells Fargo. I found this out when WF called me one day about my merchant account and I had no idea what they were talking about.

It seems that WF is now open to working with startups and opening accounts in other people's names (without notifying them).

Simple and Dwolla are also backed by banks. But I guess the reason why every bank rejected them is coming in part N.

Nope. I don't know why all the banks said no. It's a mystery to me. That's one reason it's so hard to write about.

No bank is going to move on one unfunded guy's weak story.

I was not unfunded, I just wasn't funded by VCs. And I was not one guy.

I never went back, no. It seemed unlikely to be fruitful. But this is good to know. Maybe I was just ahead of my time. If anyone knows who at Wells handles this sort of thing I would really appreciate a pointer.

Is FundersClub (https://thefundersclub.com/) anything like what you were trying to build with Founders Forge? I'm not sure how they move their money around, but the idea of creating a platform for investors to be able to more easily and intelligently invest in startups seems to be very similar.

Yep, looks very similar. Damn, they stole my idea! ;-)

Moving money is one of the easiest parts. Money movement is not nearly as broken as the OP would have you believe.

Please enlighten me: what is this easy unbroken way of moving money to which you allude?

Wires, ACH, credit cards, cash, checks, etc. If there are specific situations where you feel the options are poor and are actually holding back the situation, would love to hear them. The only one I can think of that is truly poorly served is micropayments but I'm not really sure that's much of an opportunity anyway.

I'm planning a whole post about the myriad problems with all of these. But in the meantime you can read this:

http://blog.rongarret.info/2010/11/personal-banking-nightmar...

That's really a very rare circumstance, is getting rarer and pretty much always gets resolved. Wires have gotten much easier to perform (which is actually kind of scary).

On the contrary, over half the wires we get, and we get a lot as we have clients all over the world, are held up in some way.

> First, what you have just read is a very abbreviated version of the actual plan. In the interests of not turning this story into War And Peace I have left out a lot of detail.

You've written five thousand words thus far...

But were you using Lisp to build the system?

Of course :-)

FWIW Bitcoin solves the problem of moving money around.

Maybe. I think the jury is still out on that. But remember that this effort started in 2008. Bitcoin didn't exist then. Also remember that my target launch audience was U.S. companies and their investors. To serve that market I had to be able to move U.S. dollars around, not just any old currency.

Part of your point seems to be that this problem won't be solved because the financial institutions don't care. My point is you can solve it right now with Bitcoin. I realize Bitcoin wasn't around, but it is now.

FWIW, to move $100,000 USD through Bitcoin right now would cost you about 6%,

    100000 USD * (1 BTC / 33.6 USD) = 2976 BTC
    2976 BTC * (31.8 USD / 1 BTC) = 94636 USD

Or simply, (33.6 - 31.8) / 33.6 = 5.3%

But I'm sure you know this already!

Those numbers from http://mtgoxlive.com/orders

Yes, I know this. It makes no financial sense to pay 6% just to move dollars (unless you're a drug dealer, but that was not my target market). That's double what credit cards cost. My target was 0.1%.

And replaces it with the problem of converting between real money and Bitcoin.

Reply on news.ycombinator.com