15

Why don't most banks have a system where, when you charge something on your credit or debit card, you then have to log into the bank and approve the transfer of funds? Alternatively, why don't they offer 2-step verification via sms for all transactions? Why don't they have settings that you could customize that would require you to approve the transfer only above certain thresholds or in certain locations or if the business is on a personal blacklist or isn't on a personal whitelist? Why don't we use one-time-use keys generated on banking websites instead of CC numbers for transactions? It just seems really strange to me that money can be withdrawn from bank accounts simply by knowing the CC number (semi-private), CVV (semi-private), CC expiration (semi-private), name (public), and address (public).

The answer I am expecting here is that it would be slightly inconvenient to do these things, but I see no downside for the bank or the customer if the customer is not required to opt-in. This answer would not make sense unless these measures are forced upon customers.

Improve this question
8
  • 10
    Welcome to Money.SE. This question is probably not a good fit for the site, as the answers are like to be opinion and speculation. My own answer would be a rhetorical "what's in it for them? Why would they want to do this?"
    – JTP - Apologise to Monica ♦
    May 25, 2016 at 18:18
  • 3
    In the United States, laws regulating credit disputes are far more consumer friendly than debit card disputes, and put more after the fact tools in your pocket to repudiate a charge. If this is your concern, do not choose a debit card, ever.
    – user662852
    May 25, 2016 at 22:22
  • 8
    Because, I assume, you live in a country that hasn't implemented those things yet. In the UK, I expect to see independent verification of credit and debit card "cardholder not present" transactions (though not via SMS) and a one-time key (coupled with two other challenge-response questions) to access my bank accounts on line. There is no "opt in" either. It's all mandatory. (Note, "cardholder present" transactions are verified by a PIN, not by a random scribble that may or may not be my signature).
    – alephzero
    May 25, 2016 at 22:31
  • 3
    "money can be withdrawn from bank accounts simply by" - since we're talking about card payments, there's a very important item you've missed off your list - you need a merchant account with the card scheme. And if you're naughty - even a tiny bit naughty - they will come down on you like a ton of bricks.
    – AakashM
    May 26, 2016 at 9:13
  • 8
    Why don't we? In The Netherlands, we do. See also 3-D Secure for a similar system by Visa and Mastercard.
    – gerrit
    May 26, 2016 at 11:28

7 Answers 7

Reset to default
35

quid has expressed some of the disadvantages with this approach, but there is another. Vendors will not want to give you any goods you buy with your credit card until they are sure they will get the money. With your suggested approach buying something with a credit card now looks like:

  1. Vendor runs the credit card and have you punch in your PIN.
  2. Vendor waits while the SMS is sent to your phone.
  3. Vendor wonders why the SMS is taking so long. Wait again while you try to get better cell reception
  4. Vendor waits again while you type in the response code and it gets to the bank.
  5. Vendor apologizes to the customers behind you that this is taking so long.

No vendor is going to stand for this for even moderate sized transactions, so in reality they will just decline your card if you have this facility enabled.

Improve this answer
6
  • 10
    Having worked retail in the US, no one will apologize to the customers behind them. The vendor will receive all the pent-up frustration.
    – CKM
    May 25, 2016 at 20:00
  • 9
    security at the expense of usability comes at an expense> Usually security itself (passwords R hard to remember!) but in this context, permeability perhaps.
    – Mindwin Remember Monica
    May 25, 2016 at 20:00
  • 6
    This is a great argument against requiring confirmation of card-present transactions. It doesn't really apply to mail-order (including phone and online) transactions. And the (relatively new, in USA) chips provide a way of telling the difference without just taking the merchant's word for it.
    – Ben Voigt
    May 25, 2016 at 21:29
  • 3
    I just had to wait 30 mins at a sporting goods store because there was a problem with the new chip stuff. There was not a happy employee or customer anywhere near that checkout line (for some reason once the chip process starts, your apparently can't stop it). I could not imagen if that was the norm.
    – coteyr
    May 26, 2016 at 3:25
  • 2
    30 minutes? I would have left the store 27 minutes ago.
    – Stig Hemmer
    May 26, 2016 at 9:13
23

Credit card fraud is an extremely (to stress, EXTREMELY) small proportion of total credit card transactions. The card issuing entities all offer zero fraud liability, even on debit cards. There are millions of transactions every day and fraud loss just isn't worth developing, and supporting, an additional authentication layer that faces the consumer.

To be clear, the downside is cost. Cost to develop, cost to implement, cost to maintain, cost to support. All of this to stop something that millions of people have yet to even experience.

Improve this answer
12
  • 2
    And yet, there's a card that advertises how great there app is, every time you misplace the card, just click and put it on hold. As if this happens to all of us every day.
    – JTP - Apologise to Monica ♦
    May 25, 2016 at 18:24
  • 13
    @JoeTaxpayer marketers are always milking the great motivator of fear.
    – quid
    May 25, 2016 at 18:26
  • 5
    @JoeTaxpayer: The ability to disable a card from an app is orders of magnitude easier (and cheaper) than implementing 2 step authentication for charges.
    – NotMe
    May 25, 2016 at 21:17
  • 2
    @SnakeDoc Americans will get used to EMV in no time. Meanwhile Europe is already moving on to contactless for small transactions, where you don't let go of the card.
    – pjc50
    May 26, 2016 at 11:26
  • 1
    @SnakeDoc: the chip thing has been standard in much of Europe for 5+ years now, and hasn’t caused an epidemic of card-loss. I’m horribly absent-minded, and have left my card in ATMs more than once, but I’ve never left my card in a chip machine — the transaction is short; your attention stays on the machine and card the whole time, without any real opportunity for distraction; and the notice that it’s done is usually given by a message saying “TAKE CARD” or similar, unlike with an ATM where it’s easy to (unconsciously) feel the transaction is over once you take the cash.
    – Peter LeFanu Lumsdaine
    May 26, 2016 at 11:39
5

Actually in Finland on some bank + debit/credit card + online retailer combinations you type in your card details as you normally do, but after clicking "Buy" you get directed to your own bank's website which asks you to authenticate yourself with online banking credentials. It also displays the amount of money and to which account it is being paid to. After authentication you get directed back to the retailer's website.

Cannot say why banks in US haven't implemented this.

Improve this answer
5
  • 2
    They have. The Visa version is called "verified by Visa". It only works with some merchants, though, so maybe it is optional for the merchant to enable.
    – Martin Argerami
    May 26, 2016 at 11:07
  • 1
    Yes, it's a supposedly enhanced verification system and it requires merchant integration, although it costs them more if they don't use it. It's possible to disable it on your card by asking the issuer (I have done this).
    – pjc50
    May 26, 2016 at 11:27
  • 1
    The technology behind this is called 3-D Secure. The feature is often called that when talking about cards in general without specifying if it's VISA, MasterCard or something else.
    – simbabque
    May 26, 2016 at 13:31
  • 4
    Speaking as someone who once enabled "Verified by Visa" I can tell you it can be very frustrating, and since so few support it, it is more like a random "gotcha" inconvenience than a security measure.
    – barbecue
    May 26, 2016 at 21:45
  • 3-D Secure is good for merchants because it reduces chargeback risk, but it is pretty useless for cardholders.
    – Navin
    May 27, 2016 at 5:07
4

The other answers touch on why having two-factor auth or some other additional system is not worth it compared to simple reactive systems (cancelling lost cards, reversing fraudulent charges etc), but it should also be noted that this goal can be achieved with a method similar to what you describe.

My bank (TD Canada Trust) has an app (I'm on android) that gives you a notification immediately after your card is charged (even test charges like at the gas station). It's really simple, does not slow down authorization, and makes fraud detection super easy. (I'm sure some other banks have similar apps).

Improve this answer
5
  • 1
    Most large banks allow to get emails right at the moment of charging (without even an app). I use that at Chase and BoA; in a restaurant for example I see the email with the charge before the server even comes back to the table. It's free.
    – Aganju
    May 26, 2016 at 3:14
  • @Adam: are you talking about a credit card? My biggest beef with my TD Visa card is that I have to wait three days to see each transaction.
    – Martin Argerami
    May 26, 2016 at 10:54
  • 1
    @Martin Argerami Yes, it tracks both my credit and debit cards. And yeah I always find it annoying that credit charges take forever to show up on the website, even though you can see the amount right away by looking at the remaining limit.
    – Adam Martin
    May 26, 2016 at 10:57
  • So, you don't get an "immediate notification" on your credit card transactions, do you? Because that's how it reads in your answer.
    – Martin Argerami
    May 26, 2016 at 11:05
  • 1
    No I do! Just on the extra app (TD myspend), not the website or the main TD app.
    – Adam Martin
    May 26, 2016 at 11:06
1

Credit cards and debit cards make up the bulk of the transactions in the US. Visa and Mastercard take a percentage of each credit card transaction. For the most part, this fee it built into the price of what you buy. That is, you don't generally pay extra at the grocery store if you use a credit card (gasoline purchases are a notable exception here.)

If you were getting something like 2% of a third of all the retail transactions in the US, you'd probably not want to rock the boat too much either. Since there is little fraud relative to the amount of money they are taking in, and it can often be detected using statistical analysis, they don't really stand to gain that much by reducing it through these methods. Sure they can reduce the losses on the insurance they provide to the credit card consumer but they risk slowing down the money machine. These companies want avoid doing something like reducing fraud by 0.5% revenues but causing purchases with the cards drop by 1%. More security will be implemented as we can see with the (slow) introduction of chip cards in the US but only at a pace that will prevent disruption of the money machine. EMV will likely cause a large drop in CC fraud at brick-and-mortar stores but won't stop it online. You will likely see some sort of system like you describe rolled out for that eventually.

Improve this answer
1

This is a question with a flawed premise. Credit cards do have two-factor authentication on transactions they consider more at risk to be fraudulent. I've had several times when I bought something relatively expensive and unusual for me, where the CC either initially declined and sent me a text asking to confirm immediately (after which they would approve the charges), or approved but sent me a text right away asking to confirm (after which they'd automatically dispute if I told them to). The first is legitimately what you are asking for; the second is presumably for less risky but still some risk transactions).

Ultimately, the reason they don't allow it for every transaction is that not enough people would make use of it to be worth their time to implement it. Particularly given it slows down the transaction significantly (and look at the complaints at the ~10-15 seconds extra EMV authentication takes, imagine that as a minute or more), I think you'd get a single digit percentage of people using that service.

Improve this answer
2
  • And at least as concerns my bank, card-not-present transactions are more likely to trip this protection.
    – GalacticCowboy
    May 27, 2016 at 15:54
  • Indeed; most banks have their own fraud models, and that is certainly one element in most.
    – Joe
    May 27, 2016 at 16:10
0

A few years ago I had a US bank credit card that was serviced (all support, website, transaction issues) handled by FIA Card Services (part of Bank of America).

I could create one-use credit card numbers, or time-limited (for example, 3 months) numbers.

I could also create ("permanent)) extra card numbers.

All of these could have a max charge value (IIRC, even a fixed value), so you could have a separate card number, with a limit, just for a subscription service or gym membership.

The Bank issuing the card cancelled the entire card offering, so I lost these features. Maybe FIA still provides these features on cards they service.

As a note to pjc50 (can't comment in this SE yet), Japan has had contactless cards for >10 years, but during use they tend to place them in a special tray (with the sensor underneath) during the transaction.

Improve this answer
3
  • One-time card numbers still exist for BoA/FIA issued cards. They call it "ShopSafe" and it is under the "Information & Services" tab.
    – Navin
    May 27, 2016 at 5:09
  • How well does this work on a smart phone, as it is a lot harder to copy a number from one tab to anther...
    – Ian
    May 27, 2016 at 14:49
  • 1
    @Navin, thanks for the update & detail, I forgot the name of this feature.
    – Jake Peters
    May 27, 2016 at 16:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .