Reversing the credit card model to make it secure

Question

I have read a lot about financial information being stolen, particularly credit card details, because they are stored or at least entered online or at points of sale. It seems to me that the method could be made secure if it was reversed.

I was told recently by my financial advisor to switch from the Auto-Pay method - where for example the electric utility company has my bank account information and pulls money from my account every month - to the Bill-Pay method, where I instruct my bank to automatically send money out. In that way, the payee does not store my account info, so it cannot be stolen from them. At worst, there is a fake, one-time set of numbers that cannot be reused.

So, why don't credit cards work that way? You make a charge, your bank receives the request and texts your phone to say, "did you authorize this?" And you respond yes or no. If you say no, you can't walk out of the store with the stuff, and the store has nothing on file but a one-time request number. Same for online. At worst they nag you every month to approve your gym membership or whatever, and no one can ever steal your info again.

Am I a super genius or is there something obviously wrong with this scheme (besides, obviously, needing a phone)?

Answer 1

You make a charge, your bank receives the request and texts your phone to say, "did you authorize this?" And you respond yes or no. If you say no, you can't walk out of the store with the stuff, and the store has nothing on file but a one-time request number.

There are payment systems that work exactly this way. I believe the largest is Alipay (primarily in China), but there's probably others. With this system, your phone generates a one-time barcode or QR code, which the merchant scans. Your account gets charged, and that code is never used again.

I believe it also has an alternate mode where the customer scans the merchant's QR code, which then causes them to send money to the merchant, but I'm not certain of that. The biggest problem here, and really the biggest problem in payments in general is "What if communication fails?"

If the merchant reads your card data (or QR code) and can't send it to your bank (or Alipay) to approve it, they have two choices: They can let you leave with the goods anyway, or they can say "Sorry, we can't sell you that right now. Come back tomorrow." In the vast majority of cases, it's better for them to let you leave with the goods, on the assumption that they will be able to successfully charge your card later. After all, most people's cards are good, and if done seamlessly enough, fraudsters won't know that the store is offline to take advantage of it. And if you can't buy what you wanted right then, you may just go to a competitor or give up altogether, and they lose out.

The flip side is that if they have to rely on your phone to send money, instead of them requesting it, they have to deal with bad cell service, customers whose phones are dead, or any other reason that you might be unable to send it right then. And while you sit there waiting for the right app to load on your phone with a single bar, other customers are piling up behind you.

Additionally, there needs to be a way for them to generate a unique enough number that your payment app knows exactly how much to send to which merchant, for which order, or they won't have any way to know that you did, in fact, successfully pay. And if they're offline, they'd have no way to receive that notification, so there's now two points of communication failure that will cause the sale to fail. (This is also why most sales don't trigger text messages for pre-approval confirmation - what if you don't get the text?)

Finally, it's in the card brand's interests to only accept payment requests from verified sources (i.e. merchant processors), and not have publicly exposed endpoints that anyone with an internet connection can DDOS or otherwise disrupt. And it's more profitable to them to eat the costs of fraud (or - better - make the merchant pay) in the name of making payments flow as quickly as possible.

_{Note: This answer is focused on the retail and quick-serve/fast-food industries. Hotels, sit-down restaurants and bars, gas stations, high-value merchants (like jewelers) etc. all have different requirements that affect what risks they're willing to take.}

Answer 2

You're putting the cart in front of the horse. I'm going to go out on a limb and assume that the "a lot about financial information being stolen" you've read, no one ever pointed out that fraud amounts to a part of one percent of transaction volume.

Everybody LOVES credit cards, and I mean everybody. Merchants will sometimes be in the news complaining about credit card processing fees. You might even think, YA! this isn't fair.

With a credit card, I can buy something without having the cash on me. There have even been studies that lightly prove that in general people spend more than they would have with cash. In fact, I might even spend money I don't have at all. I can spend more than I earned. With no money in the bank I can buy a TV with my credit card. The merchant never notices because the merchant got paid. Visa doesn't notice because Visa got paid. Your bank does notice and starts charging you interest. When you fail to pay, your account gets sold off to a debt collector. When you file bankruptcy your negative is written off as a business expenses which is can be deducted against the bank's (or collection agency's) income.

In order for this system to work, the customer can't also carry the fraud risk. In the US, I carry no fraud risk. In the last 12 months two of my cards have had some degree of fraudulent charges. I call the bank, notify them, they cancel the card and overnight a new one to me. If I was liable for any of the fraudulent charges at a minimum I would not accept a $20,000 limit from my bank, I would knock that down to an amount I'd be willing to risk to fraud. Now my spending capacity is limited to my micro risk tolerance for fraud.

Everyone in the whole chain of the transaction wants me to be able to walk in to a store with way more spending ability than I have liquidity, and that's fine with me. If any of them want to send me a text to two factor authenticate a charge, I'm cutting that card up and cancelling the account. They all make money when I spend money. The issuing banks are all so horny for me to spend on their card that they fight for me with crazy rewards programs and they'll overnight me a replacement card out of fear I might start using a competitor.

With this in mind, I advocate never ever using a checking account attached debit card, ever. I have my banking set up with a hub and spoke model. Most of my accounts can't see my main checking account. I keep a separate checking account that attaches to my paypal and the like. A number of years ago check fraud occurred on my, at the time, only checking account. It involved a dupe of my debit card and a fraudulent check being deposited in to my account with the dupe debit card then used to spend through all of my account funds including the fraudulent check. It took about 6 months for the bank to work through it and was very disruptive to my life. Ever since then I've kept a minimum of two checking accounts at two different banks and I NEVER use my debit card. From this standpoint, yes, your financial adviser is right.

When there's fraud on my American Express, it's American Express's money that disappears. When fraud occurs on your checking account, it's your money that disappears, so don't be frivolous with who gets a hook in to your checking account.

Answer 3

Well, first, one of the highest priorities for the credit card companies is making the transaction as frictionless as possible. That's one of the major selling points to cardholders and merchants: cardholders like credit cards because it makes it easier to buy stuff, and merchants like credit cards because it makes people buy more stuff because it's easier.

And if you're asking why cardholders don't have to authorize every transaction, that's kinda how it works already. When you swipe your card, you're authorizing that specific transaction, you're not handing a blank check to the merchant. If you're saying that the merchant has all they need to pretend you've authorized another transaction, well no, they don't. That's the point of chip cards. If you have a chip transaction (obviously this doesn't apply to online purchases), the chip takes all the transaction details, plus a transaction number, and gives digitally signs all of that. If someone steals your credit card information, and creates a fake transaction with it, they won't be able to digitally sign the fake transaction. If they use the digital signature for the original transaction, they'll be submitting a transaction with a transaction number that's already been used, so it'll be rejected.

So, why don't credit cards work that way? You make a charge, your bank receives the request and texts your phone to say, "did you authorize this?" And you respond yes or no.

How is that any more secure than the terminal asking you "do you authorize this?" when you swipe your card?

Suppose you set up a system where merchants contact people's phones to ask whether the transaction is authorized. Why do it through texts? Why not have an app that receives authorization requests? At which point you've just re-invented the digital wallet.