I use my American Express card every day, sometimes multiple times. I do a mixture of card-present and card-not-present transactions. AMEX has decent fraud detection and I get notified quickly if they suspect something.

However, for the third time in less than a year, my info was compromised. This time, the thief actually made a fake card and used it multiple times before it got blocked.

It got me wondering why seeming simple things are not used to prevent this. Some examples...

  1. Every X transactions (where X is a small but random number) a photo ID is required to complete a card-present transaction with card confiscation if ID is not provided.

  2. Every card-present transaction uses a cheap webcam to snap a photo of the holder. Legitimate users shouldn't be bothered by this, but it might prevent thieves from using fake cards.

  3. One-time use numbers. My old Discover Card did this years ago. There was a web site that would generate a one-time use number, valid only for one transaction. Even if the info was intercepted in transit, it couldn't be used more than once, and would not compromise my real card info.

The coming chip-and-pin system in the US might help things a little bit, at least for card-present transactions. But for online purchases, it seems there are simple, inexpensive, minimally intrusive things that could be done. Why are the card issuers, banks, and gateways apparently not doing more and just eating the costs of fraud?

  • 1
    The credit card companies compare the costs of putting in these measures with the monetary benefits that might be gained. These measures might be great for their customers, but they might not see these fixes as a benefit to themselves.
    – schroeder
    Feb 23, 2015 at 22:00
  • #1 and #2 are intrusive and require coordination between merchant and acquirer that doesn't exist.
    – gowenfawr
    Feb 23, 2015 at 22:01
  • Here in Europe, every money automate makes a continous photo from you during usage. It is extended by the chip & pin authentication.
    – peterh
    Feb 23, 2015 at 22:36
  • For what it's worth, there is an official "Take card away from customer" response that the bank can return when the card is used... At least in the US, no one sends it, and even if they did, it's unlikely the store would honor it.
    – Bobson
    Oct 2, 2017 at 2:18
  • With machines where the customer does not need to hand over their card at all, I imagine the following exchange: Merchant to thief: "Please hand over the card" Thief: "uh, no" (etc).
    – Phil
    Aug 20, 2018 at 11:12

2 Answers 2

  1. I recently lost my ID at a ski resort. While I was waiting for them to mail it back, I got groceries. If they had asked me to present ID, then I would have had it taken. Plus, there's a burden on the sellers to confiscate/store IDs, and deal with all the people who would absolutely lose their marbles when their CC is confiscated. You'd be really screwing with normal commerce.

  2. That's a ton of data. Plus, a photograph doesn't mean too much if you're prepared for it. Makeup, wigs, and lighting are magical.

  3. Interesting. A two-step auth for credit cards! That's feasible, but vendors are just starting to roll out two step for passwords. That might be a ways off for the general populace, which when faced with technology is only slightly smarter than a bag of hammers.

Why are the card issuers, banks, and gateways apparently not doing more and just eating the costs of fraud?

Because they can!

  • Personally i'd be really angry if there was such a high rate of theft. The amount missing is usually passed back to the customer, except the amount made from other quarters more than makes up for it.
    – munchkin
    Feb 24, 2015 at 13:09
  • OK, I get it how merchants don't want to do anything that potentially annoys customers. But I bet they'd be more vigilant about fraud if they had to eat the costs, instead of us consumers who the credit cards companies ultimately pass them along to. There should at least be some deterrents (merchant or infrastructure supplied) that make fraud harder to get away with. My Costco AMEX has my photo on it. Why not require a photo on all cards? And merchants have affirm that they checked or eat the cost if the transaction ends up being fraudulent.
    – user249493
    Feb 25, 2015 at 0:09

They are simple to think about, but no so simple if you take into account that in 2012, 26 billion transactions where made only in the US. The simple things you listed would create a massive overhead:

Every X transactions a photo ID is required

In Brazil, you are required to provide a ID and a signature on every transaction without a PIN. How many times I had to provide one in the last decade? Not even once.

The seller have to ask you for your ID and maybe refuse a purchase you just did. He would lose the purchase AND probably the customer. So they don't ask, and let the customer be happy.

Every card-present transaction snap a photo

This would create a logistics nightmare. 26 billion transactions, taking a (very small) 100kb picture on each would create 26 PB of data. Who would archive, manage and search all that data?

Besides that, people are not likely to provide a picture on every transaction, because of NSA, Snowden, Carnivore and other state surveillance programs (and rumors). No, it would not work.

One-time use numbers

We are moving to a world when you don't even have to swipe your card to make a purchase. If you have to swipe the card, then reach out for your smartphone, open up an app, read the code and enter the code, you would end up using the other card that does not need that. Simplicity beats security on the market.

Just think that a lot of people will use 123456 as a password and 1234 as the PIN. It's stupid, but it's how it works.

  • If we as a society can invent self-driving cars and manipulate genetic material to cure or prevent diseases, why can't we come up with a more fraud-resistant credit card payment system? I'd be fine if the back of my card said, "The holder should be a short, balding, white guy with hazel eyes. If not, don't allow the transaction." Simple, low-tech, doesn't require much cashier training, and would make it at least a little harder for the thieves.
    – user249493
    Feb 25, 2015 at 0:12
  • And for online, card-not-present transactions, the card issuers should require two-factor authentication. Non-complying merchants eat the cost of fraudulent transactions. But I really still want my one-time use numbers. Can be made easy to use on a computer or smartphone. Would vastly reduce online card fraud. I guess the pain of changing is still greater than the pain of doing things the same way.
    – user249493
    Feb 25, 2015 at 0:15
  • The card means nothing. The thief would just strip the data from the card, and write it on a card with this is the back: "The holder must be a tall, hairy, afro girl with dark eyes." And the girl would use it to buy a TV, resell it on eBay and wire the money to Nigeria.
    – ThoriumBR
    Feb 25, 2015 at 17:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .