logoalt Hacker News

tialaramexyesterday at 10:31 PM1 replyview on HN

This blog doesn't mention the most critical part

Settlement the part where the bank agrees to transfer money from your account (in this case increasing your debt on the card) to the merchant is completely separate from Authorization.

Authorization is the modern EMV ("Chip and pin") authentication, the CVV stuff for online, and any other mechanism by which the bank protects themselves from your fraud and, maybe, as an afterthought protects merchants.

The network is completely OK with Amazon saying here's a card number, we say they're paying us $400. That's just a settlement, goes on your bill. No sophisticated cryptography, nothing even as clever as a 4 digit PIN, or remembering your mother's maiden name, just OK, we trust you. Which means you, as a consumer, need to read your credit card bills and dispute anything you don't recognise or you'll pay.

There is very little incentive for the networks to care if you get ripped off. If you don't dispute it then everybody is happy, and if you do they just claw it back from the merchant and it's not their problem.


Replies

lxgryesterday at 11:09 PM

> if you do they just claw it back from the merchant and it's not their problem.

This is true for non-3DS online payments, but not for in-person payments or when using 3DS online. In those cases, the issuer is usually liable.