The comparison to Paypal is funny. Paypal has decided that I don't exist, or, if I do, that I'm somehow ineligible to buy things through Paypal using my credit card.
Buy. Things.
If your site does payment processing through Paypal then, through some accident of account processing or technology or the history of my account, I can't use any of my 3 payment cards to buy what you're selling, because Paypal believes it needs to (for reasons passing understanding) link directly to my bank account before any card with my name on it can be used through Paypal.
You can purchase through Paypal without logging in, there's a little text link at the bottom of the purchase page under the "sign in" box. They'll also taunt you if you enter a [mandatory] email address that matches a known account, but this is also skippable.
It's a trick. The verbiage on the page strongly suggests you have to log in, but there is a little link or something to skip it. It has been a while since I bought through paypal, but I always skipped it because it was so much more of a hassle to log in.
No, I think this means PayPal recognizes tptacek's CCs and forces a log in. Even with a new card, perhaps they'll just base it on the name and refuse to process it without an account login.
weird. PayPal actually suspended my account the first time I sold something, but I just called them and they fixed it. That's why I said PayPal > Square.
Did you ever dispute a charge or have an incident with PayPal? They will block users forever (or a long time) I've seen the error code on the other side. Basically "PayPal doesn't like this guy due to a past issue so he's not getting through"
Are you sure about that? If you get 1000 people to pay $100 for your "product" that you don't ship to them, that's a pretty good profit. You can just walk away with the money, never to be seen again (under that name at least). How the economics would take care of that is anyone's guess.
And precisely because of this the we have chargebacks.
As a merchant it would be lovely to accept payments only via bitcoins. As a customer I'll avoid purchasing anything if I cannot issue a chargeback. So the only way to get me to actually buy anything via bitcoins is to remove all alternatives.
No need to build a new financial system, the new financial system is already in place. It needs wider adoption.
In the time it took him to write the post complaining about Square, OP could have integrated BTC payments via Coinbase. He could even offer a BTC discount, since he's saving 2-3% on processing fees. If his product is in demand, customers will find a way to pay for it, even if they haven't used Bitcoin before.
There's no bitcoin equivalent for the experience of being able to have someone physically swipe their credit/debit card in your phone for point of sale payment. Bitcoin cannot replace all point of sale transactions that Square enables.
And once more the crowd asks, "who's going to use it?".
There is a very, very tiny competitive advantage to supporting Bitcoin. There is a catastrophic competitive disadvantage to not supporting the basic method of Internet transactions.
The entire context of this discussion is regarding a person who cannot accept cards. It is pointing out that Bitcoin is a non-solution because the user base is so small and most people pay with credit cards. You need to keep in mind the context in which you are responding.
The guy can't take cards and this thread is nattering on about how Bitcoin is the answer and you're asking that question when I point out that Bitcoin NFC apps don't replace that he can't take cards?
QR code payments phone to phone are even easier. I'm seeing street fair vendors who started taking square last year taking bitcoin now with QR codes on phones without much resistance. I don't know what their volumes are like.
Or someone will recreate it, support credit cards, and eat his lunch because that someone can actually do business with people who don't know what SHA1 is.
The "central entities", whatever they may be, are certainly not the only parties that benefit. To be successful, we must broaden the appeal of the changes we hope to see.
> Until we accept that centralized payment systems only benefits the central entities, we're going to be stuck with these problems.
That's beyond ridiculous. The main reason here is that they are trying to prevent their service from being used for fraudulent purposes. How would Bitcoin change that? Realistically, there would still need to be some form of identity verification. The actual problem here is that it's really hard to verify a person's identity over the Internet. The questions in the article can be answered by a determined attacker, so it's clearly the verification system that's broken.
Bitcoin is only "no or low fees" because it has no regulations and protections. It'll need those to get broad government, consumer and merchant adoption. And then it won't be fee free.
it's also free because the payment processors, the "miners", are payed by freshly-made bitcoins. once we hit the max number of bitcoins, they'll charge fees to run the "mines".
For me to start using a mechanism to pay on the internet, there would need to be a way I can get a refund if it doesn't arrive, or is broken, or the company goes out of business, or if my computer was hacked to make the payment. I would have to be confident that I could call up and get a refund even without having kept careful documentation of the interaction. And there would have to be history/legal precedent backing that up.
From the fine print on the linked Identity Verification Service page [1]:
>Due to the nature of the origin of public record information, the public records and commercially available data sources used in reports may contain errors. Source data is sometimes reported or entered inaccurately, processed poorly or incorrectly, and is generally not free from defect. This product or service aggregates and reports data, as provided by the public records and commercially available data sources, and is not the source of the data, nor is it a comprehensive compilation of the data. Before relying on any data, it should be independently verified.
I'd guess the failure rate of using this service was deemed an acceptable trade off to implementing an independently verified service.
That's true--every system will fail. I took issue with Square because the humans supposed to fix things when it fails are not allowed to do anything (company policy?). Amazon and PayPal people were helpful.
I like how I had no problem, when I was sixteen, setting up Paypal so that I could buy some random components for some old PDA's from china on ebay.
But this is seriously upsetting, the tone of this writing wants to rip my heart out for the author. I can only wish that this gets resolved decently.
His comparison also reminds me how Amazon's customer service is absent as much as possible. Automation and all that. Yet on that topic, it seems people don't mention Google as much. (I wonder if they filter that out in their results..)
Amazon customer service absent? They have some of the greatest customer service I've ever seen. If I need help with my Kindle, I can click a button to get a human to call me immediately, so I don't even have to pay for an international phone call. The one time Amazon sent me an incorrect parcel, I got connected to a real human who initiated an immediate & instant refund while I was talking to them and let me keep and/or sell all the items I'd received mistakenly. For such a large company, Amazon's customer service is really good. (I agree that Google's is nowhere near as good, though.)
If you're flagged by them as an unfit marketplace seller (weird that this can happen when you've never sold a thing on their marketplace before) then their support is horrendous. They get a person to explain politely that there's no appeal, they won't say what the matter is, and they just don't care if you're now tainted for life by the last person who lived in your apartment who apparently was shady.
Ahh I see, I wasn't thinking from the perspective of a marketplace seller on Amazon.
I do know that in fraud prevention it's common to not explain what the problem is, because it tells fraudsters which filter they've tripped (and potentially how to evade it on their next attempt), but it certainly doesn't help genuine people caught in a false positive.
As a customer, yes, they can be (are) great. I have close to 1,000 orders in seven years, tens of thousands of dollars.
Yet I sold a camera lens on Marketplace. Perhaps the tenth thing I'd sold. I was willing to be patient to get a better price. Nine items sold, no problem.
This one arrived three days after the "expected delivery date". The buyer complained, and my Marketplace account was canceled. I could appeal. I pointed to history, inclement weather. Said I'd be willing to be flagged "Fulfilled By Amazon-only", if that was possible.
"After review, our decision stands and you will remain permanently disqualified from using Amazon Marketplace."
There are also lots of reports online regarding Square holding payments to sellers, without much info why. Plus they have no phone support, only an email address.
It's sort of funny, that all three verification questions listed would be answerable by an attacker, but at least two would be easy for normal people to get wrong.
If she knows anything about the target (glossing over the fact that the actual target is square), an attacker could get correct answers with high probability. Twitter, FB, LI, etc. provide people the target is likely to know. In many locales you wouldn't even need an exact address to know which streets cross which other ones (although frankly how hard is it to know someone's address?). And of course there is a direct mapping from social security numbers to states, so asking the SS question in that fashion adds no security.
All of this ignores the fact that these are multiple choice questions. Attackers don't have to win every time. 1/64 of targets would be vulnerable given no knowledge whatsoever. This is just an upper bound on how useful this set of questions is for Square, while the rest of TFA constitutes a convincing lower bound on how harmful they are to those who would legitimately use Square.
I went through this almost two years ago, with the key difference being that I was able to sign up with Square and accept payments around four years ago (whenever they launched). I even interviewed there at one point, just like you.
After two months, they closed my account because I was living in Puerto Rico at that time and there are no partner banks in Puerto Rico. Once I moved to San Francisco and linked Square with my new California bank account, I was able to accept payments again.
Then one day I got a notification indicating that my account had been closed, and that the decision is final. I contacted Support, and they reiterated that their decision was final, and could not communicate with me any further.
It is the weirdest interaction I've ever had with a company. I still use them as a payment method and I'm a big fan of the company, but I feel disappointed whenever I log in and they remind me that my merchant account is disabled.
> I still use them as a payment method and I'm a big fan of the company
Why? If you had such a bad relationship with a company, why use them and why being such a fan? I genuinely don't understand, if I had an interaction like this, I would never recommend them.
They only banned me from accepting payments. I can still use them to pay at any establishment that uses Square, which, here in the Bay Area, is a very common sight.
Aside from the refusal to explain why I cannot accept payments, I haven't had any negative interaction with the company. They just seem unable to provide any further information, for either legal or policy reasons.
Unable to do something for policy reasons just means "we decided not to do it". It's their own policy, which they can change anytime, so they can hardly hide behind it.
It's trying to be a non-repudiation system based on something only you and they know. Unfortunately, without a credit history or paying utility bills, credit sources alone aren't enough. So why not use other facts such as partial DoB, partial SSN, parent/s SSN, etc. only when no other details are available? It's not ideal, but it's better than either losing business or falling back on something much less secure eg facts that are in the public record.
This will make it more likely that you see a favourable resolution. Further, this assists due process in identifying and resolving problems in our financial system.
If they don't respond, the case is marked as unresolved or something like that. Square's score will get dinged. So they have to say something (assuming they care about the BBB score).
KBA (knowledge based authentication) is what that question-answer type of system is called. Typically companies don't implement it as the sole form of identification for the exact reasons that you mentioned.
I found it very surprising that Square doesn't provide an alternate method for identification, it's mind boggling even. Something like Instant Bank Verification (similar to what mint.com or venmo does) would be a good alternative and carries no additional overhead for Square.
seems like it would be tough to file a complaint for them not letting you process. I would imagine that right (to deny your business) is spelled out in their TOS (something, which in my experience@wepay, is something that regulators fixate on).
if they were holding your money without a schedule of release, that would probably be a stronger ground for a complaint.
CFPB and DFS complaints open an officially mediated channel between you and the company. Regardless of what is in their ToS, there should be a good reason for denying services with no option for assistance than - this helps that reason get teased out and evaluated.
Further, when consumer finance issues come up in D.C. or Albany it is these complaints which inform the debate. Having no documentation means regulators flying blind.
Keep in mind that financial services are regulated, and they cannot simply TOS the regulations away. It may well turn out that there's grounds for action here, and the people who know the regulations are best-equipped to say if there is.
(3) Try Shopify's POS. I do not work for Shopify and have never used it so I cant speak for it beyond its advertised features. I have been comparing POS's lately and Shopify is cheaper and has an API to allow you to manage your inventory or allow others to make tools to help you.
(4) If you research any other POS's reply here so I can see. ;)
I really dislike these ID verification services. I had my identity stolen about a decade ago; worked it out with the police and credit bureau. To this day, I still get verification questions related to the fraudulent credit card account. Do I answer truthfully and not get verified, or play the game and choose the "correct" yet wrong answer? (answer: play the game.)
From the recent story - Square faces rancor from merchants over customer service:
"Barry said she grew so frustrated exchanging e-mails with customer service representatives that she drove two hours to the company's San Francisco headquarters to get some help in person.
Instead, she cooled her heels in the lobby for a couple of hours. No one would speak to her, she said, and the security guards threatened to call the police. Then Square deactivated her account, saying "high-risk activity was detected."
I had a similar experience recently when I tried to get my free annual credit report. To verify my identity they asked me questions about my financial history, mainly about my credit history. Well, I haven't had a loan in many years, so they had to dig deep into the archives and asked me about the monthly payment amount on a car loan that my wife had over ten years ago. My financial records actually go back that far, but hers don't, so I was unable to "prove" that I am me (with "prove" in scare quote because IMO it's highly questionable whether getting the right answer on a multiple-choice quiz can possibly "prove" anything about anyone).
I also had a similar issue trying to set up a fedex account over the phone. I couldn't do it online because their site was down. I called over the phone and they made me answer a bunch of questions from over 10 years ago. Since I missed 2 questions they refused to set up an account for me, and refused to ask a new set of questions. It was infuriating.
I was asked about the term for a car loan I had and I had absolutely no idea what it was. I never knew because it wasn't important to me, I had no desire to pay the loan for the duration of the loan - so I just went for the lowest interest rate I could find and no early penalty. I had my own payment plan that was a year long that I planned for and followed.
The response "I'm sorry our decision is final and we cannot communicate any further" that vendors give (Google, Square in this case, etc.) is nothing short of stomach-clenching maddening. Just reading it fires up rage inside me.
I understand why they do it -- it's pretty clearly related to their anti-fraud / anti-spam / security systems, and I understand that by giving any further information, they're exposing those prevention measures to weakness. And I'm sure in cases of real fraud / spam / security risk, this is the right approach.
But man, does it stink for everyone involved when there's a false positive (i.e. in this case). There's got to be a better way of handling this. Some sort of escalation / appeal process?
(And if there isn't -- hint hint, companies that haven't gotten big enough to be immobile on this issue: Implement one.)
There are two kinds of companies: companies that are big enough to be immobile on this issue, and companies that aren't big enough to take on fixing the US's consumer finance infrastructure.
Just to add some context, this is a not unexpected consequence of Square's approach, which in many ways parallels what Paypal did in the ecommerce space.
Prior to Square the individual / very small business market was underserved (for real-world transactions). You had to go through a PITA application and due diligence process with a processor. And you typically had to pay significant up-front costs and ongoing fees to maintain your account.
There's a reason for that: the processor is financially liable for any fraudulent merchant charges. If a merchant signs up and puts through $10K of fraudulent charges and skips town with the money, it's the processor that pays.
So Square did two things. First it lowered the upfront costs by piggybacking mobile devices to turn them into low-cost swipers.
But the second very crucial thing they did is hidden on the back-end: they streamlined the signup process and support costs. They did that by doing exactly what you see here, using alternative ID and credit check methods. And making their customer support largely a self-service operation.
The good news is that the particular case you see here is probably fixable with continued improvement. But that's why it happened.. they are replacing an otherwise more costly and burdensome signup process with something largely automated. And there's a lot of money at stake if they screw it up and let fraudsters on board.
I know how it used to work -- I've been following Square from the beginning. I just don't think it would cost that much to outsource verifying a DL and bank statement that I upload to their website.
"I am sorry, but our automated verification system cannot process your information, if you wish to continue, we would need to bill you a 25 dollar verification fee to cover additional information gathering."
This does not solve the problem "Fraudsters will appeal their denial, happily pay the $25 fee using a stolen credit card, and then skip town with their first $X,000 in payments."
If the fee is to pay for better checking, then it's a fake $25 payment that results in a denial. And in this case square is still accepting them to make payments but not receive them, so there should be no problem with the $25 bouncing. In the general case perhaps they could demand cash for the verification fee.
You'll generally not find out that a credit card was used for a stolen payment until weeks after the payment goes through. At that point, it's too late for Square.
Sorry did a bit of editing as you replied. But I think you misunderstood the idea. The $25 is not to prove them trustworthy, it's to incentivize square to do a better investigation into whether someone is trustworthy.
It doesn't matter very much that someone could use a stolen credit card for that $25 payment, because square would deny such a person during their deeper investigation and lose less than $25 dollars total. And there is little reason for the criminal to do this because it will get one of their nice card numbers blocked faster.
Or ignore the second paragraph and charge cash for the service of doing a better investigation with responsive customer support.
Again, fair argument, the 25 dollars was just me throwing out a number. If you want to get better identity checking the underlying idea is you can push the burden of cost onto the user and make them pay for it, because they are going to make money for themselves by using your service.
So what would be a fair cost? $1,000? Imagine what this blog post would be like with that 'cost': "Strip won't let me sign up unless I pony up a shake down fee of a grand!"
Of course not, but you might trust them to the same verification outsourcing companies that already handle your identifying information whenever you apply for a new job or sign a new apartment lease.
You can automate the DL verification process using Jumio. You hold your DL in front of your computer's camera, Jumio reads the info, and verifies the information. IIRC, Western Union uses Jumio for this very purpose.
I am all for automation - but this is the same problem as Google has: there is no human intelligence available for the rare cases where the automation does not work.
> The good news is that the particular case you see here is probably fixable with continued improvement.
Everything I've seen of Square suggests that they really are adopting the Paypal approach of "fuck you unless you're big enough or can rally someone big enough to make us care".
That is not fixable, really, without massive change. As much as I'm loathe to say this, I think the financial-services industry is in dire need of waves and waves and waves of frivolous litigation. If it were possible for cases like OP's to end up costing Square even a few hours of a corporate lawyer's time to get the complaint dismissed, that would be enough to tip the scale and make real customer service the cheaper option.
Just search online. There are plenty of frustrated posts by Square users (some of them small-business owners) who've had their money held and been unable to get ahold of someone to resolve it.
identity verification of small merchants is a really hard problem to solve with 100% accuracy. (or even 90% accuracy) At WePay, we use Facebook identity to help supplement KBA. It's not 100%, but does dramatically increase success rate.
I am seeing some parallels between how Paypal operates and deals with their customers and how Square deals with their customers, you know the ones that make them profit from the fees they charge for using their service? Sadly, this is how big commerce works. You try and try to get a human response and you're met with the old favourite, "Our decision is final" nonsense.
I recently encountered this with Electronic Arts and their Battlefield 4 game. I forked out about $150 AUD for the base game and premium addition only to be informed my account has been permanently banned after coming back from a month in Europe on holiday because they said I was cheating. Well actually, they wouldn't give the exact reason, but that was essentially what their response implied. When I asked for whatever proof they had, they said our decision is final and we can't show you any proof.
I am in the process of getting a refund as I paid by credit card, but this is definitely a commonly recurring theme amongst larger companies who struggle to deal with their customers and ultimately retain them. What kind of business model punishes their customers?
Good luck, I think you have a real chance of getting some human response now that this is on the front page of Hacker News. My understanding is that this is how people get responses from people over at Paypal as well, create a loud enough noise for someone higher up to respond as to avoid a PR nightmare and get your problems resolved.
So this is what millions of low income, undesirable customers face every day when they try to join the financial system by opening a checking account. What OP has experienced is the next iteration of that. What happens to society when the gatekeepers of our technologically enhanced future decide for some arbitrary, non-appealable reason that you are an undesirable and you may not participate. Everything from accepting payments via a dohickey on your iphone to even having an iphone. Or maybe the internet. Maybe you can't have the internet cause the we say so authority says they don't like the neighborhood you live in or something that was in your credit history.
I'm getting failed on a similar knowledge based identification on coinbase right now. Failed twice already. At least it's not a final decision, to their credit.
There needs to be laws against this almost certain dystopia. That's one reason why I support the EFF.
And people wonder why Walmart is so popular with the working poor. Bluebird credit cards (even takes direct deposit), prepay phones, low prices, and low friction. They were advertising health insurance last time I was in there. I do believe they had minute clinics at some places.
I'm having the same problem with Coinbase. And I'm not even under 21, like the author of the article. I'm 28 and have a credit history. But since my name is common enough, I get questions based on my own and others' histories. I even double checked my credit history to make sure there wasn't anything suspicious in there. Coinbase is simply pulling in other people's data.
I wonder if there's an identity theft vulnerability waiting to happen here. You're getting questions based on other people and you know one of the answers must be correct. I wonder if an automated system could use that to find the correct answers for a given name.
Same exact thing happened with Dwolla. Couldn't figure out if the identity verification service used my old address, current address, or my parents' address. I'm still locked out...
(Disclaimer: I write fraud detection algorithms for Eventbrite, and work closely with the team that built the fraud systems at PayPal.)
I'm sorry this happened to you. I personally believe the burden of proof should be on the company. However, that some choose to err on the side of caution is perfectly understandable.
The thing is that companies that handle credit card payments are very vulnerable to fraud because they are liable for consumer chargebacks [1], at least in the US. This is particularly unfortunate since US cards also happen to have pretty poor security (which also has probably something to do with the fact the merchants are liable, and not the banks). Stolen credit card numbers are extremely easy to obtain (cf. Target breach) [2], and once this is done fraudsters have basically two main ways to extract money out of it:
1) Use the card number to make purchases online, or better yet, find a self-service platform that lets you become a merchant then purchase your own offerings (eBay/PayPal, Eventbrite, etc.).
2) Duplicate the card (made much easier by the US' slowness in adopting chip-and-pin), and use it to pay for goods or to load the money on some account. Square is perfect for this since you own the card-reading device, which makes it much less risky than attempting to use a duplicated card at an ATM or at a retailer.
Now, the problem is that you potentially need a lot of cushioning to withstand fraud attacks: while the processor only makes profit from the transaction fee, they are liable for the entirety of the charge, so one single fraudulent transaction can wipe out the profit of thousands of good ones. Being attacked by a fraud ring for hundreds of thousands or even millions of dollars in a single day is not impossible (in fact we've seen this happen, and Eventbrite's transaction volume is much smaller than PayPal's or even Square's), so this is a lot of risk to take on for a company, especially a startup.
Regarding the bad customer service you've received, there is a specific reason why companies often decline to comment on fraud security checks: by allowing you a way of recourse, they would be disclosing information about how their system works, which makes it potentially vulnerable to attackers. For example, if they said "sure, just send us a copy of your driver's license and we'll lift the ban", this would be a signal for fraudsters to try to fake such documentation.
Overall, it's a complex issue and unfortunately frustration is part of the game (trust me, if PayPal could have found a way to make operations smoother and less frustrating, they'd have done it). At Eventbrite we've chosen to assume this risk and be more liberal with verification because we decided that providing a good user experience is worth losing some money over (and because we have faith in our ability to keep up with the fraudsters), but this is a decision every company that handles money has to make and it's not an easy one.
[2] fun fact: you'd be surprised to see how big this underground economy is; it's so well-oiled that some sellers even provide customer service on the credit card numbers they sold, and offer money back guarantees if the card has already been deactivated
Thanks for the insight -- that makes a lot of sense. I guess you could forge a driver's license with a skilled Photoshopper on the team, since those are hard to validate. (as a consumer, it's still frustrating though.)
The thing is, "but fraud and chargebacks" are not an excuse for treating people like shit. If you can't provide even the bare basic minimum of customer service, you deserve to be bankrupted by a competitor who will.
This makes sense. These policies are probably warranted for actual credit card companies. But, the OP's grievance was with Square, which isn't liable for fraud and probably doesn't need to use such excessive security.
Frankly, it often seems as though many consumer financial companies (like Mint and Square, etc.) go out of their way to make their service harder to use simply to increase their "legitimacy."
Sites like Mint refuse to remember login information and automatically log users out after a short period of time. As far as I'm aware actual bank account can't be accessed from Mint; data is only reported. In the grand scheme, this information is not particularly important.
It would be far more catastrophic for someone to gain access to my email account or social network profiles (where they could actually do damage) than it would be for them to learn what (little) I have in my bank account. Yet, we all survive using only standard security on most of our other accounts.
Moreover, there seems to be a huge disparity between credit card security in the real world and credit card security online anyway. In the real world, I hand my credit card to numerous people with whom I have no relationship and whom I can't trust at all, every single day. No one thinks twice. Yet, when someone wants to look at their bank statement, they need to bend over backwards. It just doesn't make sense.
Integral pieces of the financial apparatus might need to be totally secure, but consumer web apps that don't ever handle money don't, and should put user experience first.
>This makes sense. These policies are probably warranted for actual credit card companies. But, the OP's grievance was with Square, which isn't liable for fraud and probably doesn't need to use such excessive security.
I think the parent comment (which seemed fairly well informed) actually says the complete opposite of this, that is, not only is square liable, they are specially exposed.
Square is absolutely liable for any fraud. They are playing the role of the merchant in this chain. The cc companies will push any chargebacks to Square who, because they have decided to take away the security of a traditional merchant account, have little or no ability to reclaim funds from their merchants, especially fraudulent ones.
Additionally, if the fraud and charge back rates get too high, say over a few tenths of a percent (!), the cc companies will either cut them off or raise their interchange rate -- either one kills their business model.
It's attitudes like this that make life miserable for a minority of people.
Google: Our products work for most people. If they don't work for you, we won't support you. Good luck with our competitors.
Paypal, Square: our fraud prevention metrics are generally reliable. If you're a false positive, we won't serve you. Good luck getting your money.
Comcast, Time Warner Cable, etc: Our Internet services work pretty well for most people. If they don't work for you, enjoy spending an hour or more in customer support hell. They may solve your problem. If not, good luck getting home internet from our non-existent competitors.
Imagine if the rest of the world worked like this:
* People whose legs work can use the toilets here. In a wheelchair? Good luck finding somewhere else.
* Only people who can drive a car can get state-issued ID. Can't drive? Good luck not officially existing in the eyes of many.
* Only people without a history of chronic illness can get free health care. Pre-existing condition? Good luck with your third job to pay for your treatments.
It is absolutely Square's prerogative to determine who they will and will not serve. And if you choose not to serve someone because they are an inconvenient minority, it's your call. And it makes you kind of a jerk. Expect to be called out on it.
Square: you are PayPal. You are Comcast. You are the old and busted status quo that the new hotness will usurp one day. Don't like it? Prove it otherwise.
He did a pretty good job explaining the problem which seems quite complex. Cut the guy some slack, it doesn't sound like he is in a position to make necessary changes, such as making the banks liable for their own crappy security procedures.
1. It's a complicated problem. I will explain to you why it is complicated. Now it is your problem.
2. It's a complicated problem. I will own the problem. I will insulate you from the problem as much as possible.
It's not pyduan's fault, and I'm not asking him to own the problem. But explaining why the problem is complicated or excusing bad behavior because it stems from a complicated problem is an active barrier to actually fixing the problem. How many indignities do we suffer daily simply because complicated problems have entered the status quo and become our problems?
I think you may have misinterpreted my comment (you know I don't work for Square right?).
> Hard problems should be challenges, not excuses.
Which is precisely why I mentioned in my original post that my preference (and Eventbrite's) goes towards doing the opposite and trying hard to give the user the benefit of the doubt. By doing this we expose ourselves to more risk because we want to transact with everyone -- without risking to disclose too much about our policies, you'll notice our system is very tolerant for mistakes and missing inputs, and in case something does go wrong we have a dedicated support team to deal with these issues. This makes building and training our algorithms that much more complicated if we want to keep our risk profile in check but it is a trade-off I'm happy to make, so I'd like to think I'm not guilty of what you're accusing me of.
Overall, my point was just to provide some context on where Square comes from since OP seemed confused about what they perceived as a ridiculous policy. The comparisons you picked (Comcast, Google) are a good example of why it's interesting to talk about fraud (which is a topic we rarely have in mind when building or using payment services): fraud is not a simple inconvenience for startups -- it's something that can potentially put the entire business at risk, so you have to have both the ability and the willingness to take on that risk. In the absence of controls I can think of many ways to defraud Square out of millions of dollars in the matter of hours. They're strong enough to take the hit it now, but one single such attack while they were younger could have put their success in considerable danger had they not taken some precautions.
Of course this is no excuse for not having a friendlier or more reactive support, but Square or not Square I just felt this is a topic worth bringing to the spotlight.
I took exception to your comment not because I thought you were representing Square but because it seemed like your comment was using "fraud prevention is hard" as an excuse to defend Square's treatment of OP.
> I just felt this is a topic worth bringing to the spotlight
It's always good to have an experienced, rational explanation of why a company might have engaged in some seemingly-ridiculous behavior. Thanks for providing that. Unfortunately, such an explanation often gets used as a crutch or an excuse for not aiming higher. How many years did individuals and small businesses have no recourse from PayPal before Stripe, Square, et al. came along? Do we really want to have that long of a gap again just because the new incumbents can hide behind the same "it's hard" mentality as the old?
So while I'm sorry that I interpreted your comment incorrectly as defending the "fraud prevention is hard so let's marginalize the minority" argument, I wanted to make sure that I expressed my dislike for that mindset before it took hold.
So while I'm sorry that I interpreted your comment incorrectly as defending the "fraud prevention is hard so let's marginalize the minority" argument, I wanted to make sure that I expressed my dislike for that mindset before it took hold.
So you're saying you were in too much of a hurry to jump on his back to read what he wrote? At least put the apology at the top of your comment rather than at the end of all the excuses.
>> Unfortunately, such an explanation often gets used as a crutch or an excuse for not aiming higher. How many years did individuals and small businesses have no recourse from PayPal before Stripe, Square, et al. came along? Do we really want to have that long of a gap again just because the new incumbents can hide behind the same "it's hard" mentality as the old?
What's the solution here? If I assume you aren't advocating legal requirements for how easy companies have to make verification (which, let's be honest, is a non-starter since laws generally make it harder to verify than easier), the only real solution is to call out companies that do this, which should in turn spur competition from those who think they can do better. It's unfortunate that it takes as long as it does, but I'm not sure if there is a better system.
That said, writing this post is exactly the type of response that should encourage improvement and competition.
I'm not sure, at an implementation level, what the solution is. But I know the only way to get there is to not view the problem of fraud prevention without alienating the minority to be an insoluble problem. And that's the response my comment was intended to provoke.
You seem to be demanding that someone somewhere make the problem go away. Personally I hope whatever grows out of bitcoin (maybe even bitcoin) makes it go away. It's a hard problem. It's not ideal for customers, merchants or payment processors.
The reality is that it's not solvable right now without compromises. Transaction fees are high until it get solved. It could take 5, 10, 20 years. We won't know until it gets solved. Big hairy problem. I don't think it's fair to get up and demand this be solved.
I think he's saying that businesses discriminating based on incorrect credit ratings when in fact the person is demonstrably credit-worthy, and it's the business who is at fault for not checking correctly, and not providing an alternative route to getting things checked, is somewhat analogous to discriminating against the disabled.
In each case it's not the customer's fault, and the customer should not be discriminated against. It's not an equivalence, it's an analogy. In each case the business is denying service for a reason that is not the customer's fault. There is an analogy to be drawn, even though it's not an equivalence.
I'm pretty sure Square knows he exists, especially given that they allow him to accept cash payments. The title is (possibly justified) hyperbole. They know he exists, they just choose to ignore him having decided he's a bad risk for some of their services.
@ColinWright - From what I understand, Square's verification exists to make sure the person signing up is who they say they are. So if I find someone's social security card on the ground, or guess the SSN (not that hard in some cases), I can't sign up for Square pretending to be that person. I don't think they are running credit checks. Their provider simply scrapes credit reports as an additional source for questions ("Which of these banks do you have an account at?" or "What's the street number of your first mortgage?")
We're using the same terms in slightly different ways. You're talking about acknowledging that someone really is who they are, but being unwilling to extend them credit. I'm talking about not being willing to extend credit to the entity in question, whether they are who they say they are or not.
It's a genuine distinction, but perhaps it doesn't really matter. Perhaps it does, but regardless, we're not really disagreeing. Square is refusing to provide access to the individual because they claim it is risky to do so. They're saying it's because they can't confirm his identity, but it's still a refusal to extend "credit" to an "individual."
There are several categories of service which are in this category where a private company's decision not to service certain customers amounts to a problematic (and sometimes arbitrary) discrimination. Credit cards & financial services, payment processing, insurance (auto, health, tradesman etc.), some rental markets. There are a bunch.
These tend to be oligopolistic or monopolistic markets where where decisions are made methodically by algorithms, actuarial & statistical analysis & such. Low margin industries.
The problem is that accessing health or financial services is something bordering on the realm of human right. I understand and sympathize with the objection to the proliferation of"positive" rights. The "right to housing" for example has been tried and (not everywhere) failed or at least caused a lot of collateral damage.
But, I also sympathize with the statement that access to (for example) financial services is pretty fundamental and needs to be accessible to everyone in order to maintain a base level of egality necessary for democracy. So if by whisky you refer to…..
It's a hairy problem. I think square & paypal should make it a priority to be fair in a common sense way, even if it raises costs somewhat. If not, they will eventually get stuck with ombudsmen or regulators.
Which is precisely why things don't always "scale" elegantly. There's always someone, somewhere, some how having an exception to the rules of your system.
Everything you said was true, but that wasn't being debated.
The point was that Square has terrible customer service. The other payment co's mentioned actually support people with this problem.. they allow the user to mail proof of ID.
Square doesn't pay enough people to work support, instead opting to deliver an artisanally crafted, gorgeous "Fuck You".
>This is particularly unfortunate since US cards also happen to have pretty poor security...
I remember reading about someone (or some startup) trying to address this issue by using public key crypto to address the short-comings of credit cards in the states. The fees were supposed to be substantially lower and the major sources of fraud eliminated. But they kept hitting an invisible wall with every financial institution that was pitched the idea. It was a fascinating read (be sure to read all the parts).
Interesting! I don't have a strong enough background to know if Ron Garret's suggested protocol is superior to chip-and-pin or falls to the same sort of attack mentioned in the link, but surely a strong and water-tight implementation is floating out there somewhere in the collective ether.
The problem is presumably getting everyone to agree and move at once. Same problem with all the early 90s Internet protocols. Chip n PIN really messed up though, it was a big opportunity for change.
The consumers don't implement chip-and-pin because they don't control ANYTHING.
The retailers don't implement chip-and-pin because they buy their point-of-sale terminals from some supplier and they choose the cheapest one, which only has a magstripe reader, not a chip-and-pin reader. They're not losing any business this way because everyone's card supports magstripe readers.
The card issuers are actually kind of interested in chip-and-pin, and have been for a couple of decades. But there are some serious problems. The cards cost more, and it's not fun to shoulder that expense without some benefit. Worse yet, the chip-and-pin cards are harder to use (you have to memorize a pin) and that loses customers. A couple of experiments with more advanced cards (notable the American Express Blue Card which had some SERIOUS advertising money behind it) have been abject failures.
But this is all about to change. The rate of credit-card fraud by organized crime has finally reached the point where the credit card companies realize that they MUST act. While some of the cost gets pushed onto merchants, the majority is absorbed by the credit card companies and that's cutting into their profits. They can start issuing chip-and-pin capable cards, but it won't help because there aren't any reader terminals in the US. So they've found a way to fix that problem: by pushing the cost onto someone else.
Starting in late 2015, any card-present transaction done with a chip-and-pin capable card (or chip-and-signature which will be used more heavily in the US because of that usability issue) which is found to be fraudulent will be the liability of the merchant, not the credit card issuer, if the merchant had a magstripe-only card reader. This, they hope, will finally change the US infrastructure, motivating major retailers and mom-and-pop small businesses throughout the country to spend collectively 100s of millions to billions of dollars on new card reader hardware.
SOURCE: I work for one of the top US credit card issuers.
What are the hardware costs per chip-and-pin reader?
$500?
It doesn't seem like such a big investment for a mom and pop.
Wal-Mart/Target would have to buy 50-75 per store but the costs would be relatively the same.
Whether or not it is "a lot" depends on a lot of details like what price you're getting offered, how big your profit margin is, and how much you have to pay to the person who installs it, configures it, and trains you to use it. These costs may be much more than $500.
Empirically, I can say that despite the credit card industry asking nicely, almost no merchants anywhere in the US have installed pin-and-chip readers. (Of course, there has been essentially no benefit to them either.)
Exactly. That's why I think the threat of having to shoulder the fraud risk will encourage people to upgrade. Not only is it an additional cost, it's an UNKNOWN cost, which is quite scary.
When the banks issued people chip and pin cards, we upgraded our terminals. We had to because people needed to use the chip and pin cards. We didn't have an option to resist it because all that does is harm our ability to take payment.
I also notice though that from consumers, interac debit seems to be more popular than credit cards for general purpose, and those have always required a pin.
Does the US consumer primarily use credit cards? Or do they at least use them more than Canadians (or maybe Europeans?).
I can see the difference in behavior between knowing a pin and not having to being a big difference in consumer adoption, moreso than retailers being willing to accept the cards. Like I said, when we had chip and pin introduced years ago, we just had to be able to support it whether we wanted to or not unless we wanted to start turning people away.
But if consumers have always used primarily credit cards or cash, I can understand them avoiding the move towards having to remember a pin.
The way that it was dealt with here is: If the merchant has a magstripe-only reader, my card will not be accepted. Everyone card is a chip and pin card, and people rarely carry cash. If you don't upgrade your hardware, it's not just a matter of being liable for fraud, it's simply that you can't continue to do business.
Hi, Canadian immigrant to the US. People in the US tend to use debit cards tied to their bank accounts which are also Visa / MasterCard cards. These cards can be swiped as either a debit card (requiring a PIN, similar to Interac) or a credit card (requiring only a signature, or nothing at all in some cases, like a gas pump). They don't force you to use it as a debit card because that would preempt certain transactions, like online ones. (My theory is that this is part of why the US has a far bigger online economy than Canada, beyond simple population density.)
Canada also has far stronger central controls on, for example, their banking system than does the US. In the US, such things would be considered onerous government regulation, even if the long term impact was positive.
> by allowing you a way of recourse, they would be disclosing information about how their system works, which makes it potentially vulnerable to attackers.
Then companies, like the one you work for, need to band together and lobby for change. This is classic 'security through obscurity' bullshit and its hurting user experience.
As someone who has never used a credit card and never will due utter disgust in that they can't even get basic authentication right, here's a big fuck you. I am a constant victim of retarded sites that try to pin down some identity other than a password to users. Trying to identify people you don't know is plain bullshit, and the industry should stop. Why the fuck do I have to prove who I am to a computer? This is like trying to explain to a lemon what color is. The only thing all of this bullshit amounts to is that id fraud is incredibly easy, because nobody knows what information they are supposed to protect.
Stop fucking using IP addresses in conditionals. Same goes for anything else that is not a username+password or unguessable token. Period. If you're in a job that's prolonging this behavior, quit. There is an endless supply of places you can work at if you're a good developer.
263 comments
[ 3.1 ms ] story [ 301 ms ] threadBuy. Things.
If your site does payment processing through Paypal then, through some accident of account processing or technology or the history of my account, I can't use any of my 3 payment cards to buy what you're selling, because Paypal believes it needs to (for reasons passing understanding) link directly to my bank account before any card with my name on it can be used through Paypal.
I thought that what guest checkout is for, even though it's a per-merchant configurable option: https://www.paypal-community.com/t5/About-Business-Archive/G...
Until we accept that centralized payment systems only benefits the central entities, we're going to be stuck with these problems.
As far as not shipping a product you paid for, economics takes care of that. Not delivering purchases is a bad business model.
As a merchant it would be lovely to accept payments only via bitcoins. As a customer I'll avoid purchasing anything if I cannot issue a chargeback. So the only way to get me to actually buy anything via bitcoins is to remove all alternatives.
Even if this were true, there are still X number of people who got ripped off with no recourse.
> With Bitcoin, your credit card can't be skimmed or stolen
No, but your private key can be stolen/lost, and in that event, you don't have the benefit of fraud protection.
In the time it took him to write the post complaining about Square, OP could have integrated BTC payments via Coinbase. He could even offer a BTC discount, since he's saving 2-3% on processing fees. If his product is in demand, customers will find a way to pay for it, even if they haven't used Bitcoin before.
There is a very, very tiny competitive advantage to supporting Bitcoin. There is a catastrophic competitive disadvantage to not supporting the basic method of Internet transactions.
The "central entities", whatever they may be, are certainly not the only parties that benefit. To be successful, we must broaden the appeal of the changes we hope to see.
That's beyond ridiculous. The main reason here is that they are trying to prevent their service from being used for fraudulent purposes. How would Bitcoin change that? Realistically, there would still need to be some form of identity verification. The actual problem here is that it's really hard to verify a person's identity over the Internet. The questions in the article can be answered by a determined attacker, so it's clearly the verification system that's broken.
But, I'll admit to thinking the exact same thing. 2-3% transaction fees and the BS admin overhead that comes with accepting CC payments is ridiculous.
Oh yea, and merchants are (usually) liable if they accept a stolen credit card. What a crappy system...
In your opinion, what regulations/protections are required that don't currently exist?
>Due to the nature of the origin of public record information, the public records and commercially available data sources used in reports may contain errors. Source data is sometimes reported or entered inaccurately, processed poorly or incorrectly, and is generally not free from defect. This product or service aggregates and reports data, as provided by the public records and commercially available data sources, and is not the source of the data, nor is it a comprehensive compilation of the data. Before relying on any data, it should be independently verified.
I'd guess the failure rate of using this service was deemed an acceptable trade off to implementing an independently verified service.
[1]http://www.lexisnexis.com/risk/solutions/instantid-qa.aspx
That will leave a mark.
But this is seriously upsetting, the tone of this writing wants to rip my heart out for the author. I can only wish that this gets resolved decently.
His comparison also reminds me how Amazon's customer service is absent as much as possible. Automation and all that. Yet on that topic, it seems people don't mention Google as much. (I wonder if they filter that out in their results..)
I do know that in fraud prevention it's common to not explain what the problem is, because it tells fraudsters which filter they've tripped (and potentially how to evade it on their next attempt), but it certainly doesn't help genuine people caught in a false positive.
Yet I sold a camera lens on Marketplace. Perhaps the tenth thing I'd sold. I was willing to be patient to get a better price. Nine items sold, no problem.
This one arrived three days after the "expected delivery date". The buyer complained, and my Marketplace account was canceled. I could appeal. I pointed to history, inclement weather. Said I'd be willing to be flagged "Fulfilled By Amazon-only", if that was possible.
"After review, our decision stands and you will remain permanently disqualified from using Amazon Marketplace."
All of this ignores the fact that these are multiple choice questions. Attackers don't have to win every time. 1/64 of targets would be vulnerable given no knowledge whatsoever. This is just an upper bound on how useful this set of questions is for Square, while the rest of TFA constitutes a convincing lower bound on how harmful they are to those who would legitimately use Square.
After two months, they closed my account because I was living in Puerto Rico at that time and there are no partner banks in Puerto Rico. Once I moved to San Francisco and linked Square with my new California bank account, I was able to accept payments again.
Then one day I got a notification indicating that my account had been closed, and that the decision is final. I contacted Support, and they reiterated that their decision was final, and could not communicate with me any further.
It is the weirdest interaction I've ever had with a company. I still use them as a payment method and I'm a big fan of the company, but I feel disappointed whenever I log in and they remind me that my merchant account is disabled.
Why? If you had such a bad relationship with a company, why use them and why being such a fan? I genuinely don't understand, if I had an interaction like this, I would never recommend them.
Aside from the refusal to explain why I cannot accept payments, I haven't had any negative interaction with the company. They just seem unable to provide any further information, for either legal or policy reasons.
Other than that, Mrs. Lincoln, how did you enjoy the play?
I agree with the GP poster, I'm at a loss to comprehend why you continue to "enable" companies like this to continue bad business practices.
(1) Consumer Financial Protection Bureau (CFPB): http://www.consumerfinance.gov/complaint/, and,
(2) New York State Department of Financial Services (DFS): http://www.dfs.ny.gov/consumer/fileacomplaint.htm.
This will make it more likely that you see a favourable resolution. Further, this assists due process in identifying and resolving problems in our financial system.
http://youtu.be/Yo8kfV9kONw
That's the shakedown the GP was referring to. The BBB is a scam.
I found it very surprising that Square doesn't provide an alternate method for identification, it's mind boggling even. Something like Instant Bank Verification (similar to what mint.com or venmo does) would be a good alternative and carries no additional overhead for Square.
if they were holding your money without a schedule of release, that would probably be a stronger ground for a complaint.
Further, when consumer finance issues come up in D.C. or Albany it is these complaints which inform the debate. Having no documentation means regulators flying blind.
(4) If you research any other POS's reply here so I can see. ;)
So if they have the data, why couldn't a pirate, NSA officer or errant banker?
Perhaps a better test is what I choose to forget.
"Barry said she grew so frustrated exchanging e-mails with customer service representatives that she drove two hours to the company's San Francisco headquarters to get some help in person.
Instead, she cooled her heels in the lobby for a couple of hours. No one would speak to her, she said, and the security guards threatened to call the police. Then Square deactivated her account, saying "high-risk activity was detected."
http://www.sfgate.com/business/article/Square-faces-rancor-f...
I understand why they do it -- it's pretty clearly related to their anti-fraud / anti-spam / security systems, and I understand that by giving any further information, they're exposing those prevention measures to weakness. And I'm sure in cases of real fraud / spam / security risk, this is the right approach.
But man, does it stink for everyone involved when there's a false positive (i.e. in this case). There's got to be a better way of handling this. Some sort of escalation / appeal process?
(And if there isn't -- hint hint, companies that haven't gotten big enough to be immobile on this issue: Implement one.)
Prior to Square the individual / very small business market was underserved (for real-world transactions). You had to go through a PITA application and due diligence process with a processor. And you typically had to pay significant up-front costs and ongoing fees to maintain your account.
There's a reason for that: the processor is financially liable for any fraudulent merchant charges. If a merchant signs up and puts through $10K of fraudulent charges and skips town with the money, it's the processor that pays.
So Square did two things. First it lowered the upfront costs by piggybacking mobile devices to turn them into low-cost swipers.
But the second very crucial thing they did is hidden on the back-end: they streamlined the signup process and support costs. They did that by doing exactly what you see here, using alternative ID and credit check methods. And making their customer support largely a self-service operation.
The good news is that the particular case you see here is probably fixable with continued improvement. But that's why it happened.. they are replacing an otherwise more costly and burdensome signup process with something largely automated. And there's a lot of money at stake if they screw it up and let fraudsters on board.
Its certainly better than their response.
If they verify the identity and know they are going to make it back in fees or however square does business, then sure.
It doesn't matter very much that someone could use a stolen credit card for that $25 payment, because square would deny such a person during their deeper investigation and lose less than $25 dollars total. And there is little reason for the criminal to do this because it will get one of their nice card numbers blocked faster.
Or ignore the second paragraph and charge cash for the service of doing a better investigation with responsive customer support.
Everything I've seen of Square suggests that they really are adopting the Paypal approach of "fuck you unless you're big enough or can rally someone big enough to make us care".
That is not fixable, really, without massive change. As much as I'm loathe to say this, I think the financial-services industry is in dire need of waves and waves and waves of frivolous litigation. If it were possible for cases like OP's to end up costing Square even a few hours of a corporate lawyer's time to get the complaint dismissed, that would be enough to tip the scale and make real customer service the cheaper option.
I recently encountered this with Electronic Arts and their Battlefield 4 game. I forked out about $150 AUD for the base game and premium addition only to be informed my account has been permanently banned after coming back from a month in Europe on holiday because they said I was cheating. Well actually, they wouldn't give the exact reason, but that was essentially what their response implied. When I asked for whatever proof they had, they said our decision is final and we can't show you any proof.
I am in the process of getting a refund as I paid by credit card, but this is definitely a commonly recurring theme amongst larger companies who struggle to deal with their customers and ultimately retain them. What kind of business model punishes their customers?
Good luck, I think you have a real chance of getting some human response now that this is on the front page of Hacker News. My understanding is that this is how people get responses from people over at Paypal as well, create a loud enough noise for someone higher up to respond as to avoid a PR nightmare and get your problems resolved.
I'm getting failed on a similar knowledge based identification on coinbase right now. Failed twice already. At least it's not a final decision, to their credit.
There needs to be laws against this almost certain dystopia. That's one reason why I support the EFF.
I wonder if there's an identity theft vulnerability waiting to happen here. You're getting questions based on other people and you know one of the answers must be correct. I wonder if an automated system could use that to find the correct answers for a given name.
I'm sorry this happened to you. I personally believe the burden of proof should be on the company. However, that some choose to err on the side of caution is perfectly understandable.
The thing is that companies that handle credit card payments are very vulnerable to fraud because they are liable for consumer chargebacks [1], at least in the US. This is particularly unfortunate since US cards also happen to have pretty poor security (which also has probably something to do with the fact the merchants are liable, and not the banks). Stolen credit card numbers are extremely easy to obtain (cf. Target breach) [2], and once this is done fraudsters have basically two main ways to extract money out of it:
1) Use the card number to make purchases online, or better yet, find a self-service platform that lets you become a merchant then purchase your own offerings (eBay/PayPal, Eventbrite, etc.).
2) Duplicate the card (made much easier by the US' slowness in adopting chip-and-pin), and use it to pay for goods or to load the money on some account. Square is perfect for this since you own the card-reading device, which makes it much less risky than attempting to use a duplicated card at an ATM or at a retailer.
Now, the problem is that you potentially need a lot of cushioning to withstand fraud attacks: while the processor only makes profit from the transaction fee, they are liable for the entirety of the charge, so one single fraudulent transaction can wipe out the profit of thousands of good ones. Being attacked by a fraud ring for hundreds of thousands or even millions of dollars in a single day is not impossible (in fact we've seen this happen, and Eventbrite's transaction volume is much smaller than PayPal's or even Square's), so this is a lot of risk to take on for a company, especially a startup.
Regarding the bad customer service you've received, there is a specific reason why companies often decline to comment on fraud security checks: by allowing you a way of recourse, they would be disclosing information about how their system works, which makes it potentially vulnerable to attackers. For example, if they said "sure, just send us a copy of your driver's license and we'll lift the ban", this would be a signal for fraudsters to try to fake such documentation.
Overall, it's a complex issue and unfortunately frustration is part of the game (trust me, if PayPal could have found a way to make operations smoother and less frustrating, they'd have done it). At Eventbrite we've chosen to assume this risk and be more liberal with verification because we decided that providing a good user experience is worth losing some money over (and because we have faith in our ability to keep up with the fraudsters), but this is a decision every company that handles money has to make and it's not an easy one.
[1] http://en.wikipedia.org/wiki/Credit_card_fraud#Merchants
[2] fun fact: you'd be surprised to see how big this underground economy is; it's so well-oiled that some sellers even provide customer service on the credit card numbers they sold, and offer money back guarantees if the card has already been deactivated
Don't you think it's an overstatement? At least They responded to his question and he did not lose any money.
Frankly, it often seems as though many consumer financial companies (like Mint and Square, etc.) go out of their way to make their service harder to use simply to increase their "legitimacy."
Sites like Mint refuse to remember login information and automatically log users out after a short period of time. As far as I'm aware actual bank account can't be accessed from Mint; data is only reported. In the grand scheme, this information is not particularly important.
It would be far more catastrophic for someone to gain access to my email account or social network profiles (where they could actually do damage) than it would be for them to learn what (little) I have in my bank account. Yet, we all survive using only standard security on most of our other accounts.
Moreover, there seems to be a huge disparity between credit card security in the real world and credit card security online anyway. In the real world, I hand my credit card to numerous people with whom I have no relationship and whom I can't trust at all, every single day. No one thinks twice. Yet, when someone wants to look at their bank statement, they need to bend over backwards. It just doesn't make sense.
Integral pieces of the financial apparatus might need to be totally secure, but consumer web apps that don't ever handle money don't, and should put user experience first.
I think the parent comment (which seemed fairly well informed) actually says the complete opposite of this, that is, not only is square liable, they are specially exposed.
Additionally, if the fraud and charge back rates get too high, say over a few tenths of a percent (!), the cc companies will either cut them off or raise their interchange rate -- either one kills their business model.
Google: Our products work for most people. If they don't work for you, we won't support you. Good luck with our competitors.
Paypal, Square: our fraud prevention metrics are generally reliable. If you're a false positive, we won't serve you. Good luck getting your money.
Comcast, Time Warner Cable, etc: Our Internet services work pretty well for most people. If they don't work for you, enjoy spending an hour or more in customer support hell. They may solve your problem. If not, good luck getting home internet from our non-existent competitors.
Imagine if the rest of the world worked like this:
* People whose legs work can use the toilets here. In a wheelchair? Good luck finding somewhere else.
* Only people who can drive a car can get state-issued ID. Can't drive? Good luck not officially existing in the eyes of many.
* Only people without a history of chronic illness can get free health care. Pre-existing condition? Good luck with your third job to pay for your treatments.
It is absolutely Square's prerogative to determine who they will and will not serve. And if you choose not to serve someone because they are an inconvenient minority, it's your call. And it makes you kind of a jerk. Expect to be called out on it.
Square: you are PayPal. You are Comcast. You are the old and busted status quo that the new hotness will usurp one day. Don't like it? Prove it otherwise.
1. It's a complicated problem. I will explain to you why it is complicated. Now it is your problem.
2. It's a complicated problem. I will own the problem. I will insulate you from the problem as much as possible.
It's not pyduan's fault, and I'm not asking him to own the problem. But explaining why the problem is complicated or excusing bad behavior because it stems from a complicated problem is an active barrier to actually fixing the problem. How many indignities do we suffer daily simply because complicated problems have entered the status quo and become our problems?
Hard problems should be challenges, not excuses.
> Hard problems should be challenges, not excuses.
Which is precisely why I mentioned in my original post that my preference (and Eventbrite's) goes towards doing the opposite and trying hard to give the user the benefit of the doubt. By doing this we expose ourselves to more risk because we want to transact with everyone -- without risking to disclose too much about our policies, you'll notice our system is very tolerant for mistakes and missing inputs, and in case something does go wrong we have a dedicated support team to deal with these issues. This makes building and training our algorithms that much more complicated if we want to keep our risk profile in check but it is a trade-off I'm happy to make, so I'd like to think I'm not guilty of what you're accusing me of.
Overall, my point was just to provide some context on where Square comes from since OP seemed confused about what they perceived as a ridiculous policy. The comparisons you picked (Comcast, Google) are a good example of why it's interesting to talk about fraud (which is a topic we rarely have in mind when building or using payment services): fraud is not a simple inconvenience for startups -- it's something that can potentially put the entire business at risk, so you have to have both the ability and the willingness to take on that risk. In the absence of controls I can think of many ways to defraud Square out of millions of dollars in the matter of hours. They're strong enough to take the hit it now, but one single such attack while they were younger could have put their success in considerable danger had they not taken some precautions.
Of course this is no excuse for not having a friendlier or more reactive support, but Square or not Square I just felt this is a topic worth bringing to the spotlight.
I took exception to your comment not because I thought you were representing Square but because it seemed like your comment was using "fraud prevention is hard" as an excuse to defend Square's treatment of OP.
> I just felt this is a topic worth bringing to the spotlight
It's always good to have an experienced, rational explanation of why a company might have engaged in some seemingly-ridiculous behavior. Thanks for providing that. Unfortunately, such an explanation often gets used as a crutch or an excuse for not aiming higher. How many years did individuals and small businesses have no recourse from PayPal before Stripe, Square, et al. came along? Do we really want to have that long of a gap again just because the new incumbents can hide behind the same "it's hard" mentality as the old?
So while I'm sorry that I interpreted your comment incorrectly as defending the "fraud prevention is hard so let's marginalize the minority" argument, I wanted to make sure that I expressed my dislike for that mindset before it took hold.
So you're saying you were in too much of a hurry to jump on his back to read what he wrote? At least put the apology at the top of your comment rather than at the end of all the excuses.
What's the solution here? If I assume you aren't advocating legal requirements for how easy companies have to make verification (which, let's be honest, is a non-starter since laws generally make it harder to verify than easier), the only real solution is to call out companies that do this, which should in turn spur competition from those who think they can do better. It's unfortunate that it takes as long as it does, but I'm not sure if there is a better system.
That said, writing this post is exactly the type of response that should encourage improvement and competition.
The reality is that it's not solvable right now without compromises. Transaction fees are high until it get solved. It could take 5, 10, 20 years. We won't know until it gets solved. Big hairy problem. I don't think it's fair to get up and demand this be solved.
Who are you making this demand to?
So you're saying a business discriminating based on credit rating is equivalent to discriminating against the disabled?
In each case it's not the customer's fault, and the customer should not be discriminated against. It's not an equivalence, it's an analogy. In each case the business is denying service for a reason that is not the customer's fault. There is an analogy to be drawn, even though it's not an equivalence.
It's a genuine distinction, but perhaps it doesn't really matter. Perhaps it does, but regardless, we're not really disagreeing. Square is refusing to provide access to the individual because they claim it is risky to do so. They're saying it's because they can't confirm his identity, but it's still a refusal to extend "credit" to an "individual."
These tend to be oligopolistic or monopolistic markets where where decisions are made methodically by algorithms, actuarial & statistical analysis & such. Low margin industries.
The problem is that accessing health or financial services is something bordering on the realm of human right. I understand and sympathize with the objection to the proliferation of"positive" rights. The "right to housing" for example has been tried and (not everywhere) failed or at least caused a lot of collateral damage.
But, I also sympathize with the statement that access to (for example) financial services is pretty fundamental and needs to be accessible to everyone in order to maintain a base level of egality necessary for democracy. So if by whisky you refer to…..
It's a hairy problem. I think square & paypal should make it a priority to be fair in a common sense way, even if it raises costs somewhat. If not, they will eventually get stuck with ombudsmen or regulators.
Sounds like a lot of Europe.
The point was that Square has terrible customer service. The other payment co's mentioned actually support people with this problem.. they allow the user to mail proof of ID.
Square doesn't pay enough people to work support, instead opting to deliver an artisanally crafted, gorgeous "Fuck You".
I remember reading about someone (or some startup) trying to address this issue by using public key crypto to address the short-comings of credit cards in the states. The fees were supposed to be substantially lower and the major sources of fraud eliminated. But they kept hitting an invisible wall with every financial institution that was pitched the idea. It was a fascinating read (be sure to read all the parts).
http://blog.rongarret.info/2013/02/a-simple-solution-to-cred...
Seriously: Why doesn't the US implement chip-and-pin?
Chip and PIN was shown to be flawed in 2010 at CCC[0]. This isn't why the US doesn't use it, but it it's a bit of a disaster in its own right.
http://events.ccc.de/congress/2010/Fahrplan/events/4211.en.h...
The consumers don't implement chip-and-pin because they don't control ANYTHING.
The retailers don't implement chip-and-pin because they buy their point-of-sale terminals from some supplier and they choose the cheapest one, which only has a magstripe reader, not a chip-and-pin reader. They're not losing any business this way because everyone's card supports magstripe readers.
The card issuers are actually kind of interested in chip-and-pin, and have been for a couple of decades. But there are some serious problems. The cards cost more, and it's not fun to shoulder that expense without some benefit. Worse yet, the chip-and-pin cards are harder to use (you have to memorize a pin) and that loses customers. A couple of experiments with more advanced cards (notable the American Express Blue Card which had some SERIOUS advertising money behind it) have been abject failures.
But this is all about to change. The rate of credit-card fraud by organized crime has finally reached the point where the credit card companies realize that they MUST act. While some of the cost gets pushed onto merchants, the majority is absorbed by the credit card companies and that's cutting into their profits. They can start issuing chip-and-pin capable cards, but it won't help because there aren't any reader terminals in the US. So they've found a way to fix that problem: by pushing the cost onto someone else.
Starting in late 2015, any card-present transaction done with a chip-and-pin capable card (or chip-and-signature which will be used more heavily in the US because of that usability issue) which is found to be fraudulent will be the liability of the merchant, not the credit card issuer, if the merchant had a magstripe-only card reader. This, they hope, will finally change the US infrastructure, motivating major retailers and mom-and-pop small businesses throughout the country to spend collectively 100s of millions to billions of dollars on new card reader hardware.
SOURCE: I work for one of the top US credit card issuers.
$500?
It doesn't seem like such a big investment for a mom and pop. Wal-Mart/Target would have to buy 50-75 per store but the costs would be relatively the same.
Empirically, I can say that despite the credit card industry asking nicely, almost no merchants anywhere in the US have installed pin-and-chip readers. (Of course, there has been essentially no benefit to them either.)
When the banks issued people chip and pin cards, we upgraded our terminals. We had to because people needed to use the chip and pin cards. We didn't have an option to resist it because all that does is harm our ability to take payment.
I also notice though that from consumers, interac debit seems to be more popular than credit cards for general purpose, and those have always required a pin.
Does the US consumer primarily use credit cards? Or do they at least use them more than Canadians (or maybe Europeans?).
I can see the difference in behavior between knowing a pin and not having to being a big difference in consumer adoption, moreso than retailers being willing to accept the cards. Like I said, when we had chip and pin introduced years ago, we just had to be able to support it whether we wanted to or not unless we wanted to start turning people away.
But if consumers have always used primarily credit cards or cash, I can understand them avoiding the move towards having to remember a pin.
The way that it was dealt with here is: If the merchant has a magstripe-only reader, my card will not be accepted. Everyone card is a chip and pin card, and people rarely carry cash. If you don't upgrade your hardware, it's not just a matter of being liable for fraud, it's simply that you can't continue to do business.
Canada also has far stronger central controls on, for example, their banking system than does the US. In the US, such things would be considered onerous government regulation, even if the long term impact was positive.
Interac is a Canadian-only thing, BTW.
Then companies, like the one you work for, need to band together and lobby for change. This is classic 'security through obscurity' bullshit and its hurting user experience.
Stop fucking using IP addresses in conditionals. Same goes for anything else that is not a username+password or unguessable token. Period. If you're in a job that's prolonging this behavior, quit. There is an endless supply of places you can work at if you're a good developer.