[jwr]

After 35 years of building software systems I've learned to temper my hubris. These days I rarely assume things to be "definitely true".

For example "Impossible travel": these days you can add your credit card to your phone and use Apple Pay. Well, this is useful for many things, one of them being adding your credit card to your kid's (teenager) phone, so that your kid can use your card in case of need/emergency when they are away from you. I did exactly that recently and actually worried about fraud control systems when my child paid using my card in Boston while I was in Europe.

Many things which you think are true might not be.

Anecdotally, US banks are terrible at building fraud control systems. It seems US banks assume any transaction that is charged by an entity outside the US is fraud. In my 10-year history of running a SaaS, the US banks and their "fraud control" systems have been one of the biggest billing problems.

[VladVladikoff]

Apple Pay & Google Wallet are actually considered lower risk by card brand than other card transactions because Apple and Google have so much tracking and biometrics on you, the phone must be unlocked and pin entered to pay. My company gets lower rates on these types of transactions than regular card transactions, lower rates because fraud is paid for by the fees, less fraud for a transaction type, lower merchant rates. So likely those transactions your kid does on their phone are flying way below the fraud threshold to trigger, even if it hits one trigger like “impossible travel distance”.

[gosub100]

The card processor collects a lot of data, presumably they would have a flag whether the card was used via a phone or real plastic. I suspect the "card used in 2 locations" thing is pretty old. Cards are supposed to have switched to chip for many years now. AFAIK magstripes are the only ones that can be cloned.

[VladVladikoff]

>Anecdotally, US banks are terrible at building fraud control systems. It seems US banks assume any transaction that is charged by an entity outside the US is fraud. In my 10-year history of running a SaaS, the US banks and their "fraud control" systems have been one of the biggest billing problems.

This rings home so true, as a Canadian company I am SO TIRED of US banks flagging our transactions as fraud. We have done so much to try to prevent it too. We have a mail forwarding office address in the US. A bank account in USD in the US registered to that address, the merchant account tied to that charging in USD, and still we get these fraud flags. And we’re over the 10 year mark now, I think almost 15. You would thing we would have built up some trust at these banks, but nope.

My next biggest hassle lately is we are a “tokenize and bill later” type service, and we don’t charge monthly recurring exact same amount, depends on the users incurred charges in that period. And lately it seems most Americans leave their cards on a permanently lock, and only unlock to allow a charge, this means most of our charges decline initially until the user unlocks their card and retries the payment. A real support headache if any has a fix to either of these problems I would pay good money for it.