Dear Linkedin,

The credit card companies should pull their heads out of their asses about this.

It is much better from an anti-fraud perspective for a stolen card not to contain a specimen signature for the thief to learn to forge.

It is far preferable for the merchant to request ID and verify that the signature matches the ID _AND_ the picture in the ID matches the customer.

I've never had my card refused because I wrote SEE ID on the signature panel in lieu of my signature. I have been frequently asked for my ID and make a point of thanking the merchant for their diligence in each of those cases.

I've only had one merchant get a little persnickety about the lack of a signature technically invalidating the card. I basically explained why I did it that way and informed them that they could cancel the transaction if they didn't like my methods. They chose not to cancel the transaction.
(Which was a rather significant sale in a relatively small shop)

Owen

The credit card companies should pull their heads out of their asses about t=
his.

It is much better from an anti-fraud perspective for a stolen card not to co=
ntain a specimen signature for the thief to learn to forge.

It is far preferable for the merchant to request ID and verify that the sign=
ature matches the ID _AND_ the picture in the ID matches the customer.

So, what ID do you consider to be acceptable? Especially when traveling,
you've just opened up a can of worms. As a merchant, do you know what a
Canadian driver's license is supposed to look like, for example?

The reality is that forging signatures is not particularly easy, and since
merchants generally don't check ANYWAYS, the whole issue is kind of
nebulous.

... JG

The agreements often prohibit minimums and cash discounts/card fees.

However, the Dodd-Frank act trumps the agreements as law > contract.

Owen

Given that the thread now spans nine conversations threads and at least
122 messages and is buried in the finer details of merchant handling of
gas cards I think it can stop now.

Thanks from all of us.
Joel

It is far preferable for the merchant to request ID and verify that the signature matches the ID _AND_ the picture in the ID matches the customer.

In the late 1990s I had a Visa card from (I think) Citibank that had my picture embossed on the front of the card. I'm surprised this didn't catch on with more card issuers. I see that Bank of America offers this free of charge to their Visa clients, as do some US based credit unions.

That card was never lost or stolen, so I don't know if the photo verification would fail as spectacularly as signatures do.

--lyndon

That's obviously only going to be of use in cases where the card is physically stolen and used in-person. I don't have the numbers, but I strongly suspect that sort of credit card fraud is a small minority, with the majority being CNP transactions. I've personally had several instances of one of my card numbers being used fraudulently (for everything from online casino gambling to tractor parts to hotel charges in countries I've never been to), but never via the card having physically been stolen.

Maybe from the anti-fraud standpoint, but not necessarily from the merchant's viewpoint.

It's only better if nobody's standing in line. If matching the ID and
signature and picture reduces fraud from 4% to 3%, but increases the time to
serve the customer by 5%, you're losing money due to fewer sales/hour.

And the local supermarket can save a *whole* bunch of money if they can get me
to scan my own stuff and pay with a debit card with minimal/no interaction with
the staff. Sure, might be a bit higher fraud rate, but being able to run 4
almost-unattended checkout lines more than covers it. Figure a warm body costs
$8/hour - as long as the added fraud is under $32/hour, they're coming out ahead.

I think part of the problem is there's no uniform answer to these
observations.

I remember news reports with videos of cash/credit signs at gas
stations saying these were illegal (well, violated their contracts)
but no one was enforcing it, an urge to get attorneys-general in on
the act since non-uniform contract enforcement could be a violation of
some sort of commercial laws or grounds for a civil suit if an injured
party has standing.

Or maybe some gas companies had the leverage to get exceptions written
into their contracts, etc.

They're just contracts, they can say anything as long as it's legal.

A few years ago I had a checkbook stolen. The genius bank branch
decided it was sufficient to just print new checks starting at a much
higher number and "put it in the system" rather than cancel the
account number. I protested but hey so long as they were responsible
for any fraud*.

Then thousands of dollars of cashed checks began appearing.

What was amusing was they each had info like my driver's license
number and date of birth carefully hand-printed on them.

EXCEPT, it wasn't *my* driver's license # or date of birth, it was all
just kinda random.

Which led us to believe (when talking to bank security) that they just
have friends who work as cashiers, these were all at places like
Wal-Mart, big retail stores, who just accept the bad checks for a cut.

I agree it's all a matter of percentages but it says something about
putting photos on credit cards etc.

I had something similar happen with business checks (a small vendor
was burglarized), similar result and conclusion: The crooks were
working with bank tellers or other insiders, they even knew the magic
amounts at each branch beyond which more security checks kick in,
again, according to the bank security people I was clearing this up
with.

* I sort of regretted that because they managed to burn up quite a few
hours of my time when it all went bad. They've got you at that point,
show up here, show up now, fill out all these affidavits, etc or we
won't cover the fraud.

For the most part, fraud in a card present transaction isn't eaten by
the merchant.

But the same reasoning still applies. The card issuers don't want you
have to show ID, becuase you might decide it's too much trouble, and
just use some other method to pay.

Eliminating fraud isn't an objective of card issuers. Making money is.
Fraud reduction is only done when the savings from the reduced fraud
exceeds both the cost of the fraud preventing measure and any revenue
that is lost because of inconveniencing customers. And, sometimes,
they'll choose to accept a higher rate of fraud if it will generate
enough revenue to offset it ... consider how many places you can now
avoid signing for small dollar purchases. The cost of accepting the
additional fraud was considered worth it in comparison to the revenue
generated from getting people to use their cards for small
transactions.

     -- Brett

Stephen Sprunk <stephen@sprunk.org> opined:

>> From: Jay Ashworth <jra@baylink.com>
>>
>> Even Further Off-Topic, isn't "debit" supposed to be "cash"? Why do
>> I pay the Credit price for it?
>
> It is, and *ISN'T*, 'cash'.
>
> Unlike cash (and like a credit card), it is simply an instruction to a
> third party to pay the retailer a specified amount. And as such, is
> subject to the terms of the contract between -those- parties as to how
> payment is made an what charges are imposed.
>
> Unlike a credit card, the money _is_ immediately dedecuted from your
> bank account.

All of the above is completely irrelevant to the merchant.

False to fact.

The fact that it is an order for (deferred) third-party payment, vs 'cash
in hand', is *very* relevant to the merchant.

For starters, the purchase amount becomes a 'debt' owed to the merchant by
the third party. There are massive legal ramifications to that distinction
alone.

> Like a credit card, it is the third-party clearinghouse that gets the
> mone from you, and passes it on to the retailer. AFTER extracting their
> charges for the service they provide.

FWIW, this is known as the "discount" rate.

"Not exactly".

There are typically three components to the total charge that the merchant
pays on a given transaction. One is a charge based on a percentage of
the transaction amount -- that _percentage_ figure is known as the discount
rate, distinct from the dollar-amount deducted for that purpose. Over and
above the 'percentage' amount, there are 'per transaction' charges - which
are essentially independant of the size of the transation. On 'small'
transactions, the 'per transaction' charges tend to swamp the 'percntage'
charge.

> You pay the 'credit' price, because the card issuer, and the clearinghouse
> operations _charge_ the merchant the same amount for those transactions
> as for 'credit' ones. Thus the merchant does not receive any of the
> benefits of a 'cash' transaction, so there is no 'discount' to pass on to
> the buyer.

The merchant's discount rate varies between card types. That's why many
merchants don't accept AmEx, DC, CB and Nexus: their discount rates are
higher than Visa and MC. For a low-margin business, the difference in
rates can make the difference between profit and loss on a given sale.

> At one point, VISA, charged -more- for debit transactions than credit
> ones. Despite the fact that there was -zero- risk to them on the debit
> transaction.

Wrong. Even debit cards present a risk of chargeback due to fraud.

*SNICKER*

According to the law, 'debit' cards (processed through the CC network) do
-not- have any of the protections with regard to limit-of-liability that
credit cards do. The account owner can assert 'fraud', but VISA is _not_
required to refund them any of the monies involved. For the 'debit' type
transaction, VISA has the money in hand -before- they pay out to the merchant,
the risk of them not getting the money is zero. Legally, the risk of having
to return the money after an allegation of fraud is also zero, given that
the merchant has followed the letter of the contract in processing the card.
And, if the merchant has not don so, then VISA charges back the full amount
to the merchant -- with the net risk to VISA being zero.

The other kind of 'debit' items -- ATM transactions do not involve VISA at
all, only the issuing bank. For these, With the proper PIN presented,
'fraud' charges are (sometimes) eaten by the bank involved as a 'customer
relations' measure. Generally, the presentation of the proper PIN is taken
as 'proof' that an authorized user did perform the transaction, *until*
such time as the bank is notified that the card or PIN has been lost/stolen
or otherwise compromised.

However, the fraud rates are lower due to the us of PINs, so the
discount rate is also lower.

Sorry, but that is utter fiction.

PIN-based payments are processed as ATM (Automatic Teller Machine) network
transactions -- they are *NOT* 'debit' transactions via credit-card clearing-
house network.

> VISA got sued over the matter, since (at that time) it was impossible to
> tell whether the card number presented was debit or credit.

It's still impossible to tell, which is why most card terminals ask
whether the card is credit or debit.

Incorrect. (this is mostly a terminology issue -- what has become 'common
usage' is muddy at best and often misunderstood)

The terminal has no 'need to know' whether it is a bank-issued credit or
bank-issued debit card. It does NOT ask that -- contrary to what the buttons
appear to imply. <wry grin>

Terminals ask because many cards today are 'multi-function' -- they can
act as a bank-issued credit (or debit, but not both) card _and_ as an
ATM card.

The _labels_ on the terminals are technically inaccurate, the proper
labels should be 'Credit/Debit' and 'ATM'.

There are -four- types of cards in existance in the U.S., today, with
=two= unrelated, unconnected, types of processing networks.

Many, but _not_ all, cards have 'dual credentials', and are usable on
both networks.

The four types of cards:
  1) non-bank-issued credit cards. examples: Amex, Diners Club.
  2) bank-issued 'association'-branded credit cards. example: Visa/MC.
  3) bank-issued 'association'-branded debit cards. example: Visa/Mc.
  4) bank-issued ATM cards.

The two types of networks:
  1) the inter-bank ATM networks e.g. STARZ, CIRRUS,
  2) the credit-card clearinghouses. e.g. VISA/MC, AMEX, etc.

A non-bank-issued card cannot be used on the ATM network.

A bank-issued card can function as a debit or credit (but not both) card,
as an ATM card, or as _both_.

The point-of-sale terminal asks a question to determine 'which network'
(ATM or credit/debit-card) to process the transaction over. When a card
can be used on both networks, there is no way to determine which network
should be used, =other= than to ask. As the old saw goes "ROM does *NOT*
mean <R>ead <O>perator's <M>ind" *grin*

                                      If you press the "credit" button,
even if the card is a debit card, it is processed as a credit card--with
the credit card discount rate.

TODAY, that is correct. Before the VISA lawsuit mentioned above, that was
-not- the case. A VISA 'debit' card, _processed_as_a_credit_card_, was
charged at materially higher rates than a VISA 'credit' card.

$DAYJOB found that the clearing-house charged the same for processing the
transaction, but the passed-through charges originating from VISA were over
40% higher. It was impossible to predict the charges, which meant it was
impossible to automatically feed data into the accounting system.

I had a major argument/fight with $DAYJOB's clearinghouse and with VISA
corporate on this precise matter a few months before the above-mentioned
lawsuit was filed. $DAYJOB was a small-fry operation and did not participate
in the lawsuit.

                                That's why Visa's advertising and
contests promote customers using signature (i.e. "credit") transactions:
Visa gets more money that way (at the cost of their merchants).

Actually, VISA gets _some_ money rather than none. They don't get anything
on an ATM nextork (PIN-based) transaction.

It also saves the purchaser from being assessed a charge for a 'foreign' ATM
transaction by their bank -- typically at least $1, and possibly as much
as $4.

For a 'quality' merchant, the typicaal difference in transaction fees
between the two networks (ATM vs VISA/MC) is a fraction of a percentage
point. Small enough to be, generally, immaterial to the retailer.

> As a result of the lawsuit, the cost differential between credit and debit transactions was eliminated.

... except it's still there, though perhaps in the other direction.

You don't know what you don't know. Starting with the difference between
PIN-based ATM network transactions and PIN-less 'debit card' VISA/MC/etc
network transactions.

The discount rate for "debit" transactions is lower, but a PIN must be
used to get that rate.

Incorrect. That is an bank ATM card transaction -- not a merchant-account card
transaction. It is procesed by an entirely different network, with an
entirely different fee structure. Ususally including a fee of $1 or more,
charged directly to the cardholder for using an 'off network' ATM machine.

The VISA/MC network transaction rates are *identical* for VISA 'debit' and
VISA 'credit' cards. Since the above-mentioned lawsuit, that is.

                        The exact rates vary between card networks, card
processors and even merchants, but a few years ago the numbers I heard
were 4% for "credit" (i.e. signature) transactions and 1% for "debit"
(i.e. PIN) transactions.

I don't know where you heard those numbers but 4% on credit card transactions
is typical of what the 'we provide credit card processing for *anybody*'
sleazeball operations charge. The ones that fly-by-night internet-only
pornography operators use. A sizable, established, brick-and-morter retailer
with a an established record of few-to-no chargebacks will typically have
rates of around 1.4%. $DAYJOBB got a discount rate of 1.9% after putting
together only a six-month history with -zero- chargebacks. This was for an
established 'MOTO' (mail-order/telephone-order) business, located in a
downtown office building, gross reveues in the low 7 figures, but only a
few thousand dollars a month in card charges.

                          That is why those nifty PIN terminals appeared
everywhere virtually overnight: saving 3% on every "debit" transaction
easily paid for all those new terminals.

The PIN terminals appeared so that people could use bank ATM cards -without-
having to have the 'name' credit card. Especially when those 'name' cards
started applying significant 'annual fees' for the right to simply -have-
the card.

VISA/MC/etc 'debit' cards were usable at any location that took 'credit'
cards of the same brand, with _no_ additional equipment (not even a PIN
pad) long before widespread ATM networks existed.

In the early days of ATM transactions, but after 'networks' were in place
that allowed one to use an ATM card at any ATM of any 'cooperating' bank,
there was -no- charge to either the bank or the ATM owner/operator. The
assumption (borne out in practice, _then_) That there were roughly equal
numbers of transactions by non-customers at bank-owned ATMs and transactions
by bank customers at non-bank ATMs.

As ATMs proliferated beyond bank sites, into retail establishments, and
eventually integrated with the cash-register CC processing, that balance
no longer held. And 'per transaction' charges were assessed. ATM operators
charged 'foreign' customers a transaction fee for the privilege of using
their machines, AND banks charged their customers a fee for using 'foreign'
machines.

The credit card companies should pull their heads out of their asses about t=
his.

It is much better from an anti-fraud perspective for a stolen card not to co=
ntain a specimen signature for the thief to learn to forge.

It is far preferable for the merchant to request ID and verify that the sign=
ature matches the ID _AND_ the picture in the ID matches the customer.

So, what ID do you consider to be acceptable? Especially when traveling,
you've just opened up a can of worms. As a merchant, do you know what a
Canadian driver's license is supposed to look like, for example?

From someone who supplies an out-of-country drivers license, I'd request to
see their passport. From someone who supplies an out-of-state drivers
license, I'd probably accept it, but the risks there are somewhat reduced at
least.

Mostly, I'd accept any domestic government issued photo ID and/or any
passport. Generally when someone asks for my ID, I use my passport.

The reality is that forging signatures is not particularly easy, and since
merchants generally don't check ANYWAYS, the whole issue is kind of
nebulous.

Sure. However, if you provide the forger a specimen of your signature on
the card, you're just asking for trouble IMHO. If the merchant is going to go
to the trouble of checking the signature, the extra step of matching that against
ID that matches the cardholder name instead of just matching it to the back
of the card is a negligible additional inconvenience while providing an
additional layer of protection.

Owen

In such a circumstance I use the following:

"Close this account. Either send me a check for the remaining balance or
deposit into my newly created account at your institution. Whichever you
prefer."

Owen

Right, but eliminating fraud should be an objective of consumers because
ultimately, we are the ones paying for it regardless of who "eats it" on the
actual transaction.

If the merchant eats it, the merchant has to make up for it with increased
prices.

If the card processing company eats it, they have to use high discount rates
or other fees to cover it.

If the card issuing company eats it, they have to use fees and/or interest rates
to make up for it.

If the bank eats it, they have to make up for it in other fees, reduced services,
reduced interest on accounts, increased interest rates, etc.

Ultimately, no matter who eats it, it gets passed along to the consumer.

So, any card company that starts getting their merchants to decline transactions
based on my anti-fraud efforts will find that I consider their product too risky and
will use an alternate form of payment.

Owen

Except for Amex, who have always *stringently* required this; I've even
seen customer-facing advertising pointing it out.

They have to do something to get merchants to take their card with the
higher discount rate.

Cheers,
-- jra

That assumes that minimizing cost is an objective of consumers. In
general, it's not. Maximizing utility is.

For some, minimizing cost is a major part of that.

For me, I routinely trade money for convenience. And I'll gladly pay a
percentage point or two more in exchange for all my credit transactions
being handled more quickly. I'm far from the only one. Credit card
companies keep making it easier to use their card, because they've
found it more profitable to do so. There doesn't seem to be a market
for a card that is harder to use, but saves consumers a little money
through reduced fraud.

     -- Brett

Don't know if someone already posted this but there forcing people the reset there passwords, but it let's you reset it to the same password as before... How many people are going to use the same pass? I'd say a good portion, LinkedIn needs some new isec employees

> Eliminating fraud isn't an objective of card issuers. Making money is.

> > Fraud reduction is only done when the savings from the reduced fraud
> > exceeds both the cost of the fraud preventing measure and any revenue
> > that is lost because of inconveniencing customers.
>
> Right, but eliminating fraud should be an objective of consumers because
> ultimately, we are the ones paying for it regardless of who "eats it" on the
> actual transaction.

This applies just as well to fraud-prevention measures, a cost is a
cost is a cost, your perceived morality of the cost makes no
difference, money is fungible! Which means, money doesn't care! You'd
have to make up the cost of all that fraud-prevention in the same way.

The money doesn't care... but the customers sure the hell do. Alas, getting
the corporation in the middle to eat it out of profit -- I'm not clear why
we're at a place where no one even considers that possibility, but we very
clearly are; I'm sure the corporations are thrilled -- is next to impossible.

Cheers,
-- jra

It's only Linkedin not bank accounts -- not that most people's bank
accounts are much to worry about either :slight_smile:

But what's dumb is that what they're asking for with that policy is a
big headache for themselves when accounts get messed up, whatever
pranksterism or nefarious deed, I dunno, spamming from someone's
cracked acct is a good example, and Linkedin's staff has to deal with
each and every one.

Maybe they lack imagination as to what they might be getting
themselves into.