<story><title>A simple solution to credit card fraud, and why you won&apos;t see it any time soon</title><url>http://blog.rongarret.info/2013/02/a-simple-solution-to-credit-card-fraud.html</url></story><parent_chain><item><author>jarrett</author><text>To expand upon the author&apos;s idea, the problem is not just that credit card data is reusable, but that &lt;i&gt;possession of credit card data amounts to permission to charge any arbitrary amount to it&lt;/i&gt;. Not &lt;i&gt;legal&lt;/i&gt; permission, mind you, but permission in the sense that the infrastructure lets you do it, and you have to sort out the consequences through social/legal channels after the fact.&lt;p&gt;Not only should future payment systems be based on cryptography, but they should also require an &lt;i&gt;affirmative step on the part of the payer&lt;/i&gt; to initiate a given transaction of a given amount. In other words, it shouldn&apos;t be a matter of handing over your card number, or even a one-use cryptographic token, and letting the merchant fill in the details. You should have to explicitly &lt;i&gt;send&lt;/i&gt; an amount of money that you specify. Then, of course, a smart merchant would verify that the amount is correct before fulfilling her end of the bargain.&lt;p&gt;In other words, the process should be that the payer &lt;i&gt;gives&lt;/i&gt; money to the payee, not that the payee &lt;i&gt;takes&lt;/i&gt; money from the payer.&lt;p&gt;Unfortunately, as the author points out, progress on this front has been almost nonexistent with respect to the established credit card networks. We may have to hope/work for a totally new system to replace it. (Perhaps Bitcoin, or something inspired by it.)</text></item></parent_chain><comment><author>bradleyland</author><text>&amp;#62; possession of credit card data amounts to permission to charge any arbitrary amount to it&lt;p&gt;The word you&apos;re looking for is &quot;capability&quot;, not permission. Permission requires consent, which is something you give separately from the actual card number.&lt;p&gt;A minor point, but I think it changes the tone of that statement.&lt;p&gt;&amp;#62; possession of credit card data amounts to the capability to charge any arbitrary amount to it&lt;p&gt;I&apos;m not sure anyone is ignorant of this fact though, and yet everyone seems OK with it.&lt;p&gt;&amp;#62; Not only should future payment systems be based on cryptography, but they should also require an affirmative step on the part of the payer to initiate a given transaction of a given amount. In other words, it shouldn&apos;t be a matter of handing over your card number, or even a one-use cryptographic token, and letting the merchant fill in the details. You should have to explicitly send an amount of money that you specify. Then, of course, a smart merchant would verify that the amount is correct before fulfilling her end of the bargain.&lt;p&gt;Ugh, no thanks. The system you describe is more like cash. I have to actively dole out the necessary amount, and then receive change that is counted at each transition. I abhor these types of transactions.&lt;p&gt;Convenience is a significant motivator in the adoption of credit cards. Any competing system will have to compete on simplicity. The fact that consumers and merchants haven&apos;t fled from credit card use as fraud rates (and costs) have increased is evidence that the market is willing to bear them.&lt;p&gt;The legislative changes that allow merchants to charge a CC-use surcharge will resolve the significant matter of ignorance. I do agree that consumers are largely ignorant of the hidden costs of fraud associated with the current CC model. The question is whether they&apos;ll pay these costs once they&apos;re brought to light. I believe they will continue to pay them in exchange for convenience.</text></comment>
<story><title>A simple solution to credit card fraud, and why you won&apos;t see it any time soon</title><url>http://blog.rongarret.info/2013/02/a-simple-solution-to-credit-card-fraud.html</url></story><parent_chain><item><author>jarrett</author><text>To expand upon the author&apos;s idea, the problem is not just that credit card data is reusable, but that &lt;i&gt;possession of credit card data amounts to permission to charge any arbitrary amount to it&lt;/i&gt;. Not &lt;i&gt;legal&lt;/i&gt; permission, mind you, but permission in the sense that the infrastructure lets you do it, and you have to sort out the consequences through social/legal channels after the fact.&lt;p&gt;Not only should future payment systems be based on cryptography, but they should also require an &lt;i&gt;affirmative step on the part of the payer&lt;/i&gt; to initiate a given transaction of a given amount. In other words, it shouldn&apos;t be a matter of handing over your card number, or even a one-use cryptographic token, and letting the merchant fill in the details. You should have to explicitly &lt;i&gt;send&lt;/i&gt; an amount of money that you specify. Then, of course, a smart merchant would verify that the amount is correct before fulfilling her end of the bargain.&lt;p&gt;In other words, the process should be that the payer &lt;i&gt;gives&lt;/i&gt; money to the payee, not that the payee &lt;i&gt;takes&lt;/i&gt; money from the payer.&lt;p&gt;Unfortunately, as the author points out, progress on this front has been almost nonexistent with respect to the established credit card networks. We may have to hope/work for a totally new system to replace it. (Perhaps Bitcoin, or something inspired by it.)</text></item></parent_chain><comment><author>pbreit</author><text>But &quot;pushing&quot; has proven to be problematic for US consumers. They&apos;ve basically traded the 5 or 10 basis points of fraud losses for a substantially better user experience (although they didn&apos;t really get to make that tradeoff decision).</text></comment>