4

I have read a lot about financial information being stolen, particularly credit card details, because they are stored or at least entered online or at points of sale. It seems to me that the method could be made secure if it was reversed.

I was told recently by my financial advisor to switch from the Auto-Pay method - where for example the electric utility company has my bank account information and pulls money from my account every month - to the Bill-Pay method, where I instruct my bank to automatically send money out. In that way, the payee does not store my account info, so it cannot be stolen from them. At worst, there is a fake, one-time set of numbers that cannot be reused.

So, why don't credit cards work that way? You make a charge, your bank receives the request and texts your phone to say, "did you authorize this?" And you respond yes or no. If you say no, you can't walk out of the store with the stuff, and the store has nothing on file but a one-time request number. Same for online. At worst they nag you every month to approve your gym membership or whatever, and no one can ever steal your info again.

Am I a super genius or is there something obviously wrong with this scheme (besides, obviously, needing a phone)?

  • I already have text message alerts enabled for one bank to notify me of any transactions. How much of a stretch is it to extend this to mean: "approve this transaction"? – Scott Rowe Feb 23 at 23:00
  • 2
    "At worst, there is a fake, one-time set of numbers that cannot be reused." [citation needed] Some banks will use something akin to cashiers' checks for their billpay service, but others just write a remote check on your account. The latter gives out your account number just as if you had written a check yourself. – Ben Voigt Feb 23 at 23:07
  • FWIW, there are payment methods that work much like this (for example, Paypal subscriptions are automatically processed by the merchant but the consumer can revoke authorization using his Paypal login without ever contacting the merchant) – Ben Voigt Feb 23 at 23:08
  • @BenVoigt Assume that the proper method is used, for the sake of this question. – Scott Rowe Feb 23 at 23:09
  • 2
    @Scott Rowe: Perhaps some people would be ok with the idea of an implanted cell phone, but not everyone would. And what happens when your implanted phone breaks? – jamesqf Feb 25 at 5:49
6

You make a charge, your bank receives the request and texts your phone to say, "did you authorize this?" And you respond yes or no. If you say no, you can't walk out of the store with the stuff, and the store has nothing on file but a one-time request number.

There are payment systems that work exactly this way. I believe the largest is Alipay (primarily in China), but there's probably others. With this system, your phone generates a one-time barcode or QR code, which the merchant scans. Your account gets charged, and that code is never used again.

I believe it also has an alternate mode where the customer scans the merchant's QR code, which then causes them to send money to the merchant, but I'm not certain of that. The biggest problem here, and really the biggest problem in payments in general is "What if communication fails?"

If the merchant reads your card data (or QR code) and can't send it to your bank (or Alipay) to approve it, they have two choices: They can let you leave with the goods anyway, or they can say "Sorry, we can't sell you that right now. Come back tomorrow." In the vast majority of cases, it's better for them to let you leave with the goods, on the assumption that they will be able to successfully charge your card later. After all, most people's cards are good, and if done seamlessly enough, fraudsters won't know that the store is offline to take advantage of it. And if you can't buy what you wanted right then, you may just go to a competitor or give up altogether, and they lose out.

The flip side is that if they have to rely on your phone to send money, instead of them requesting it, they have to deal with bad cell service, customers whose phones are dead, or any other reason that you might be unable to send it right then. And while you sit there waiting for the right app to load on your phone with a single bar, other customers are piling up behind you.

Additionally, there needs to be a way for them to generate a unique enough number that your payment app knows exactly how much to send to which merchant, for which order, or they won't have any way to know that you did, in fact, successfully pay. And if they're offline, they'd have no way to receive that notification, so there's now two points of communication failure that will cause the sale to fail. (This is also why most sales don't trigger text messages for pre-approval confirmation - what if you don't get the text?)

Finally, it's in the card brand's interests to only accept payment requests from verified sources (i.e. merchant processors), and not have publicly exposed endpoints that anyone with an internet connection can DDOS or otherwise disrupt. And it's more profitable to them to eat the costs of fraud (or - better - make the merchant pay) in the name of making payments flow as quickly as possible.

Note: This answer is focused on the retail and quick-serve/fast-food industries. Hotels, sit-down restaurants and bars, gas stations, high-value merchants (like jewelers) etc. all have different requirements that affect what risks they're willing to take.

  • Apparently I am not allowed to upvote for some reason, so I will just say, nice coverage of issues in this answer! Some day we have to come up with a scheme that is reliable enough to work properly. I think we can expect communications to improve to the level of reliability of electric service or cars: pretty darn good. Then it should work. Also, I am more concerned about online purchases I make sitting at home, and companies storing account info about me, so no comms issues there. – Scott Rowe Feb 24 at 0:13
  • New users are not allowed to upvote until they get something like 15 reputation, so you're (as of right now) 1/3 of the way to being able to upvote. – Ed Grimm Feb 24 at 3:03
  • Maybe we could just have electronic cash, like other countries do? – Scott Rowe Feb 24 at 12:33
3

You're putting the cart in front of the horse. I'm going to go out on a limb and assume that the "a lot about financial information being stolen" you've read, no one ever pointed out that fraud amounts to a part of one percent of transaction volume.

Everybody LOVES credit cards, and I mean everybody. Merchants will sometimes be in the news complaining about credit card processing fees. You might even think, YA! this isn't fair.

With a credit card, I can buy something without having the cash on me. There have even been studies that lightly prove that in general people spend more than they would have with cash. In fact, I might even spend money I don't have at all. I can spend more than I earned. With no money in the bank I can buy a TV with my credit card. The merchant never notices because the merchant got paid. Visa doesn't notice because Visa got paid. Your bank does notice and starts charging you interest. When you fail to pay, your account gets sold off to a debt collector. When you file bankruptcy your negative is written off as a business expenses which is can be deducted against the bank's (or collection agency's) income.

In order for this system to work, the customer can't also carry the fraud risk. In the US, I carry no fraud risk. In the last 12 months two of my cards have had some degree of fraudulent charges. I call the bank, notify them, they cancel the card and overnight a new one to me. If I was liable for any of the fraudulent charges at a minimum I would not accept a $20,000 limit from my bank, I would knock that down to an amount I'd be willing to risk to fraud. Now my spending capacity is limited to my micro risk tolerance for fraud.

Everyone in the whole chain of the transaction wants me to be able to walk in to a store with way more spending ability than I have liquidity, and that's fine with me. If any of them want to send me a text to two factor authenticate a charge, I'm cutting that card up and cancelling the account. They all make money when I spend money. The issuing banks are all so horny for me to spend on their card that they fight for me with crazy rewards programs and they'll overnight me a replacement card out of fear I might start using a competitor.

With this in mind, I advocate never ever using a checking account attached debit card, ever. I have my banking set up with a hub and spoke model. Most of my accounts can't see my main checking account. I keep a separate checking account that attaches to my paypal and the like. A number of years ago check fraud occurred on my, at the time, only checking account. It involved a dupe of my debit card and a fraudulent check being deposited in to my account with the dupe debit card then used to spend through all of my account funds including the fraudulent check. It took about 6 months for the bank to work through it and was very disruptive to my life. Ever since then I've kept a minimum of two checking accounts at two different banks and I NEVER use my debit card. From this standpoint, yes, your financial adviser is right.

When there's fraud on my American Express, it's American Express's money that disappears. When fraud occurs on your checking account, it's your money that disappears, so don't be frivolous with who gets a hook in to your checking account.

  • As I said, I have already taken the advice to safeguard my checking account. I actually have two banks, two savings accounts, two checking accounts, two credit cards... And more money stored away with no access to it at all. My car is old, and I don't spend more than I have. But you have missed the point of what I am saying. I only want to change the credit card process to one where I approve money going out, not hand out the keys so people can go in. It seems simple enough to me. – Scott Rowe Feb 25 at 0:07
  • 1
    @ScottRowe, I haven't missed the point of what you're asking. The payment process system has evolved to limit friction, and that evolution wasn't an accident. Your solution to flip the recipient of account information would add friction to the process and not benefit the entities who actually carry the fraud risk, if anything it would add risk to the consumer as the consumer is now a specific authorizing party to the transaction. – quid Feb 25 at 0:31
  • We all suffer due to crime. Make it impossible. – Scott Rowe Feb 26 at 13:01
  • 1
    Crime will never not exist. Your solution doesn't make crime impossible, it makes a specific type of crime that exists today somewhat more difficult. – quid Feb 26 at 18:27
  • One thing at a time. So, let us start with this particular thing. – Scott Rowe Feb 27 at 0:27
1

Well, first, one of the highest priorities for the credit card companies is making the transaction as frictionless as possible. That's one of the major selling points to cardholders and merchants: cardholders like credit cards because it makes it easier to buy stuff, and merchants like credit cards because it makes people buy more stuff because it's easier.

And if you're asking why cardholders don't have to authorize every transaction, that's kinda how it works already. When you swipe your card, you're authorizing that specific transaction, you're not handing a blank check to the merchant. If you're saying that the merchant has all they need to pretend you've authorized another transaction, well no, they don't. That's the point of chip cards. If you have a chip transaction (obviously this doesn't apply to online purchases), the chip takes all the transaction details, plus a transaction number, and gives digitally signs all of that. If someone steals your credit card information, and creates a fake transaction with it, they won't be able to digitally sign the fake transaction. If they use the digital signature for the original transaction, they'll be submitting a transaction with a transaction number that's already been used, so it'll be rejected.

So, why don't credit cards work that way? You make a charge, your bank receives the request and texts your phone to say, "did you authorize this?" And you respond yes or no.

How is that any more secure than the terminal asking you "do you authorize this?" when you swipe your card?

Suppose you set up a system where merchants contact people's phones to ask whether the transaction is authorized. Why do it through texts? Why not have an app that receives authorization requests? At which point you've just re-invented the digital wallet.

  • 1
    How is that any more secure than the terminal asking you "do you authorize this?" when you swipe your card? Suppose a thief steals my (physical) card but not my phone, and goes to buy something. If the terminal asks the question, the thief will simply say yes and the transaction goes through. If the question goes to my phone, I will respond with no. – Nate Eldredge Feb 25 at 1:03
  • 1
    @NateEldredge: If you're using a digital wallet as the answer suggests, there doesn't need to exist a physical card to risk being stolen. – Ben Voigt Feb 25 at 1:23
  • Someone stole the 'swipe' from my card at a gas pump and made 3 more charges that day. They didn't even need to steal my card. They could even steal the card info from one of the countless vendors or facilitators who store it or process it. If I have to say Yes, then stolen data is useless to a thief. I am all about making crime pointless, impossible, not worth bothering to do. When real life is easier and more rewarding than crime, criminals would have to be insane to do it. Then we can catch them for being insane. – Scott Rowe Feb 26 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.