Hacker News Reader

Comment by tdfx | Hacker News Reader

(1) Don't use debit cards. You're much better protected as a consumer when you use a credit card. http://www.bbb.org/blog/2013/11/do-debit-cards-and-credit-ca...

(2) Use BillGuard https://www.billguard.com/

(3) Review your transactions every week or so via a personal finance tool (I use https://www.mint.com/)

I don't particularly care if my payment credentials are compromised as it's highly unlikely a fraudulent charge would go unnoticed by me just using the advice above. It's quick, easy to set up, and stuff you really ought to be tracking anyway.

View on HN

Or use cash and forget about all this other stuff ;)

Oh the irony of how using cash is safer these days. You expose yourself to an internet full of thieves using plastic, but with cash it's only to the handful of people you actually cross paths with.

Only if you get the cash via bank teller though. Skimmers make using ATMs risky as well.

It's safer than Bitcoin, but still many times less safe than any sane credit card with a no fraud liability policy.

Unless your job pays you in cold hard cash, you have to go to the ATM. And you expose yourself to getting mugged, or have a the debit card skimmed. You could physically walk into the bank and get whatever-you-spend-per-month-in-stores in cash. So that might be an approach. But now you have to carry a fat wallet with you and manages lots of pocket change. Also not purchase much online.

Except I really like the free trips I get every year from accumulating travel reward points. Not to mention in my experience (personal and through acquaintances) Visa refunds fraudulent transactions immediately and with little to no hassle.

Depends on where you shop, but some places will give you cash discounts of 3-5%, which is more than most CC rewards pay. Admittedly it's not as widespread.

Most merchant agreements forbid this, IIRC. Credit card companies have a vested interest in the goods being the same price whether cash or credit.

It was more complicated, I believe. The marked and advertised price had to be what credit card users would pay, but they could have a cash discount at the register or checkout.

Starting in early 2013, as a result of a settlement of a class action by merchants, they no longer have to charge credit card users the advertised and marked price. They can advertise and mark the cash price, and charge a credit card surcharge of up 4% or the processing fees for that transaction (whichever is smaller).

Some states have laws that limit surcharging. There is a list in this Visa article about the post settlement rules: http://usa.visa.com/personal/get-help/checkout-fees.jsp

They used to - it used to be enough for a merchant to lose 'rights' to process credit cards - but the federal regulations of a couple years ago put a stop to it.

Some states previously used to also restrict the ability of merchant agreements to do that, though usually only in specific industries. E.g. in Texas, liquor stores (but nobody else) have been able to offer cash discounts for ages. Now anyone can.

Not saying that's untrue, but when you think of it, it's pretty amazing that card companies can legally do this. Testament to the efficacy of K Street I suppose.

From what I remember, you can charge a single flat fee for using a credit card, but no percentages. At the time, I thought that 'sliding scale' flat fees (e.g. < $100 is $0.15, > $100 is $1.50) were too close to percentages per the agreement.

Or understand that your card most likely has a zero fraud liability policy, meaning that if it gets stolen, the fraudulent charges simply go away.

If you use cash and it gets stolen, your money is just gone.

But don't forget about it in your pocket and then do the laundry ...

Losing or having a credit card compromised is pretty low on my list of real hassles.

Agreed on debit cards. Another way to vet charges is to use something that notifies your phone whenever you make a purchase. Simple bank does this, maybe others too.

Bump for Simple. Anytime an auth occurs, I get a push notification on my phone. Its so simple from a UX standpoint, not sure why other financial services firms (Discover, Amex, etc) don't push something like it out.

I can confirm that Amex has this. If you login on the website, you can also get emails / text for each transaction, set thresholds, etc. I've been using this feature for a while now. They also send you weekly statements on your transactions and how much your account has changed from the previous week, etc.

The Amex app on iPhone sends push notifications for changes.

Chase also supports this via SMS, email, or push notification.

Thanks! I was unaware of this feature!

As others pointed out, AMEX has supported this for a while - I get texted almost instantly with any transactions on my card. I believe their mobile app also supports notifications, but I prefer SMS for this.

I only wish my bank (Wells Fargo) supported SMS alerts for transactions - if there's one thing I don't mind getting frequent notifications about, it would be this.

Billguard asks for my online bank username and password, it's a deal breaker for me. Do you really trust them? https://medium.com/@hyphenated/mint-com-and-billguard-are-ly...

Billguard uses Yodlee as a backend, so at the very least I do trust that Billguard only has read-only access. I'm less certain how Yodlee functions -- whether they just scrape data and have full access, or whether they get some sort of read-only token from the financial institution.

I am not familiar with Yodlee, but I recently discovered that many banks support OFX [1], which is a format for exchanging financial information.

GnuCash has a list of OFX credentials for major banks. [2] In fact, there are tons of OFX open source libraries out there - I had luck with this one recently in Python. [3]

[1] http://en.wikipedia.org/wiki/Open_Financial_Exchange

[2] http://wiki.gnucash.org/wiki/OFX_Direct_Connect_Bank_Setting...

[3] https://github.com/captin411/ofxclient

Thanks for the references. After some research, I decided to go with YNAB http://www.youneedabudget.com/ it has a desktop and mobile apps and uses your dropbox for syncing data.

BillGuard indeed has only access to data in a read-only fashion. Yodlee does have a mix of web scrappers as well as data feeds for certain financial institutions. They power different features for banks such as bill payment and others but companies like BillGuard don't have access to these APIs.

On its end, Yodlee is heavily regulated. Like a bank and sometimes even more: http://www.yodlee.com/yodlee-security/

Stealing the key should be impossible, it should be on an HSM (which performs the cryptographic operations for you instead of giving you a key)

That's only one part of the article though.

And for those that can't get credit cards...? I mean, I agree with you that that's definitely the safest way, but lets not forget that there are a significant portion of the population that have bad or no credit and are stuck with Debit cards at best. What of them?

While I don't know as much about it as perhaps I should, the reloadable-prepaid market is very large. American Express offers a popular card in this model.

I wonder if they have the same fraud protections as a proper credit card. I doubt it, but I'd gladly be proven wrong!

Reply on news.ycombinator.com