0

Can anyone help me to figure out which way a rental company uses to bypass the credit/debit card limits up to several thousand of euros.

It happened the first time around 5 days after returning a rental car. The credit card has a set credit limit of €0 and disabled overdraft protection. A transaction of almost €3500 went through. I called the credit card company and they told me the rental company used an "old forgotten" unsual way to charge the credit card and they admitted that their security checks should have prevented the transaction and I can charge back the credit card debit payment from my bank account. The reason for the high amount was, that they have made a mistake in the driven kilometers. Around 6 weeks later they have refunded the amount back to me.

After renting another 15-20 cars and around 6 months later now it happened a second time, it's the same company and this time with a transferwise debit card (after they have charged me on their own mistake around €3500 first, I thought I was clever enough to change my card details to a pure debit card).

enter image description here

As you can see on the picture they have tried to charge the card multiple times first without success.

enter image description here

All the failed transactions look like this. The location was online and authorised via manual entry.

One of the transaction has succeeded. The location was now a place and no longer online and the authorisation method changed to unknown AND the transaction went through. My transferwise debit card went to a negative balance.

Can anyone explain to me what this "unknown" authorisation could be and why the location had to change to a place from online? I never visited this place. It looks like a offline pos terminal payment with a signature or pin code.

enter image description here

4
  • 1
    Probably a force authorization; they call the issuing bank and get a code. support.payjunction.com/hc/en-us/articles/…
    – ceejayoz
    Oct 30, 2021 at 19:19
  • @ceejayoz thanks, I believe this is it. Now I'am even more wondered why transferwise would issue such an authorization code that lets me get into 350 € negative balance. Transferwise says on their site, they do not provide overdraft protections or allow negative balances. Oct 30, 2021 at 20:01
  • 1
    Frankly, I'm surprised the rental place let you use a debit card at all. The last time I rented a car, there were six "NO DEBIT CARDS" signs, including one that included "Don't ask why, we just don't".
    – ceejayoz
    Oct 30, 2021 at 21:43
  • @ceejayoz in the EU, for example in Germany AVIS, Europcar, etc. accept debit cards up to mid size class. In the US you wouldn't have a chance to rent a car with a debit card Oct 31, 2021 at 2:19

1 Answer 1

2

This was most likely a "force post", similar to the force authorization (also called voice authorization) which ceejayoz mentioned in a comment, but with even less checking for approval.

In a normal credit or debit card transaction, the merchant sends the card data to their bank electronically, who then sends it to the cardholding bank to say "Is this covered?" If the response is "yes", there will be a six-digit authorization code included along with - you can usually find this printed on a receipt.
In a voice authorization, the merchant calls either their bank (which processes it electronically from there) or the cardholder's bank directly and gets that six-digit code over the phone. Either way, when it comes time to settle the transaction (and actually move the money to the merchant), that six-digit code is provided, as proof that the bank originally said "yes".

A force post skips all that. The merchant simply includes the transaction in their daily settlement, without an authorization code (or occasionally with a made-up one like 123456). Because of the way the settlement system works, by the time the cardholder bank actually looks at this transaction, the money has already been moved. (Of note: there's no technological distinction between how this works and how a voice authorization works, only the difference of whether or not the cardholder's bank was actually contacted or not.)

Back when credit cards were first being issued, before any kind of electronic authorization, this was considered perfectly acceptable, although riskier than actually calling the bank to confirm. But for a long time now, the card brands have discouraged this in various ways. The most relevant way is that you are almost guaranteed to win any chargeback against such a "not authorized" transaction - the merchant took the full risk of the transaction on themselves, so if they don't end up with any money, that's their own problem. Many banks don't allow it any more, or only under special circumstances, but it does still exist.

2
  • Very nice explained. Do you know if force posting without an authorization code violates the mastercard/visa rules after the online transaction was declined? Oct 31, 2021 at 2:33
  • @user3606329 - It doesn't actually violate them, but like I said, it's very discouraged. You can look at section 10.4.5.4 in this document, for example. The summary is "if the bank decides to allow it for a merchant, they need to be really sure that that merchant has a reason they need it, and monitor it, and are paying for it if anything goes wrong."
    – Bobson
    Nov 2, 2021 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.