Forum Moderators: buckworks
This is a Windows (setup.exe) application that you install. The program generates a one-time use throw away MasterCard number. The functionality is similar to MBNA's ShopSafe feature.
The FAQ is here: [paypal.com...]
[edited by: encyclo at 12:48 pm (utc) on Dec. 25, 2006]
[edit reason] fixed link [/edit]
This should be a standard Mastercard/Visa feature. Paypal beat them to the punch.
I've been using Disposible Email Addresses for website registration and online commerce for some time. This is a logical extension.
I'd rather have one point of vulnerability than dozens.
Where do I find out to see if I qualify to see the paypal virtual debit card checklist? ;)
None of the links seemed to work. Just get punted to the profile summary page.
But I'm Canadian, so maybe that's why I can't access anything. Either that or the website is buggy / got pulled.
Anyone else from Canada able to access the virtual debit card?
Happy Holidays.
There are many other on-line providers of virtual (ie throw-away or single-use) VISA/MC numbers. I know, since I was CTO for one of them...
It *is* a very kewl idea, and stops all sorts of fraud dead in its tracks.
Rgds
Damon
Anyone else from Canada able to access the virtual debit card?
Second that question.
I think that you need to support that statement.
I can't say that would have been true in our case, and indeed some of the links in our chain were designed to be fragile and break if someone pulled too hard.
Rgds
Damon
For those with mastercards, this has been out for some time.
ALL Mastercards? Or only certain banks?
I certainly haven't heard of this. They seem to have done a terible job of marketing if this is true.
Certainly VISA has the concept of the "virtual" VISA card which can be put to a number of uses (it just has no issued plastic). But VISA is not a bank (or other retail financial institution, it is a trade club of them) and usually does not create/market new products directly for retail, mainly the brand concept. You need a third-party institution to directly create and market new such retail products, such as the one I referred to. You may not have heard of us because our marketing and budget was a little lower than VISA and some banks. B^>
But a little Googling will find the company that I am referring to, and others, and so far as I know Canadians are welcome.
Rgds
Damon
I think that you need to support that statement.I can't say that would have been true in our case, and indeed some of the links in our chain were designed to be fragile and break if someone pulled too hard.
I don't think rohitj needs to.
There isn't 100 percent trust in a transaction.This is the only statement rohitj implies to be a fact, and since I do not trust such transactions completely, therefore rohitj is correct.
In fact, if they somehow got access to the generator, it'd be harder to stop them/detect them and they'd be able to victimize one person for longer.
I believe the security will fail first at the weakest point - end user. There will be mock sites of card generators which require to enter the full-card information, or some variant thereof.
The problem may not be at the banking institutions but the user apathy toward security, and general misconception of what is and is not secure.
Still, I am delighted PayPal is implementing this. It will eliminate some credit card fraud. Bad timing of course - should have been implemented in October, before the Christmas shopping rush.
[edited by: Tapolyai at 12:21 am (utc) on Dec. 26, 2006]
There is seldom any reason to give any other type of credit card numbers when shopping online. At my bank you can even create a card which is good for multiple purchases (up to a limit you decide) until a set expiration month (which is also decided by you when creating the card). The same options should be possible to implement for other banks (or Paypal).
[edited by: ADovervik at 2:20 am (utc) on Dec. 26, 2006]
We physically pick up the phone, call Visa, MC Amex, Discover, and get the phone number for the card issuing bank. From there we call to verify the billing address. We also ask them to kindly look to see if there's any pattern of suspisious activity and tell them how big a transaction we're going to run, what it's for, etc. We also ask them if the address has been recently changed. Sometimes they'll let us know if there are any red flags, and often times we have to make a gut-feeling type of call of whether to process it or not. Sometimes I go so far as to even check who the phone numbers are registered by doing a reverse white pages lookup, or even sometimes I have looked up the tax assessor's information for that cardholders residence to see if they're the actual owner. (I'm not going to ship a $50,000 ring to some shmuck in an apartment in the Bronx).
Anyone who uses paypal knows the risk of chargeback is still there and there's virtually no support if you process through paypal and get ripped off if you're a merchant.
To be honest I'd rather not accept any payments of this type at all. I'll tell my customers if I can't physically call their bank and verify the info the order will be cancelled. If this feature was offered by the VISA/MC or whatever company directly it would be of value since you're talking to the same people. But adding one more layer of processing with miserable support like paypal is not something I'd be willing to go through.
If VISA/MC did something to make CC-processing safe for both merchants and cardholders I think it would be quickly adopted. This is just crappy. I will not accept these types of payments... maybe for $200 gold chains but not $10,000+ diamond rings.
One of the features offered by the company I mentioned was to remove much of the risk of chargebacks from merchants because we have the user money in the account first and verified before we let the user spend it. So (a) we don't do credit and (b) we DO know who they are if the police come calling, as it clearly says in the Ts&Cs.
So, although your position is a very difficult one, a virtual card need not be a bad thing for you to handle.
(And yes, when one of my unrelated plastic cards was cloned the scumbags immediately tried to use it to buy jewelry, and I think they got it out of the shop before they were rumbled.)
Rgds
Damon
[edited by: DamonHD at 9:59 am (utc) on Dec. 28, 2006]
Anyone who uses paypal knows the risk of chargeback is still there and there's virtually no support if you process through paypal and get ripped off if you're a merchant.To be honest I'd rather not accept any payments of this type at all. I'll tell my customers if I can't physically call their bank and verify the info the order will be cancelled. If this feature was offered by the VISA/MC or whatever company directly it would be of value since you're talking to the same people. But adding one more layer of processing with miserable support like paypal is not something I'd be willing to go through.
Yep, PayPal is just a layer of crud that I don't need either...
Is there some consistency in the numbers issued by Paypal Virtual Debit Card (i.e. the first four numbers)? Are you rejecting them in an automated way? Or will this also be a manual process?
Of course, it's still up to you to decide which payments you will accept and how to manage your risk. :-)
Every VISA/MC/etc card number starts with a unique 6-digit "BIN" (Bank Identification Number). You can block by BIN if you want to (though nothing stops BINs being shared between some different uses). The BIN indicates a sponsoring bank (within the VISA/MC/etc scheme), the card scheme, and other stuff like the currency for that range of cards...
You'd need a big look-up table to decide what to do given a card's BIN...
Rgds
Damon
If I call that VISA or MC line and it tells me the card issuing bank is Paypal, you can bet I will be voiding that transaction, especially if its a big purchase! Or I will call up my customer and tell him how it is and if they can please use the actual card.
As far as cards that pull funds out of a bank account (no credit) those ACH transfers can still be reversed. The only thing that cant be reversed is a wire transfer. I usually offer my customers a 5% discount for large purchases even though CC processing is only 2.4% or so, because it lets me put my mind at ease and the customer is usually very happy to get the discount. If someone is going to pay cash electronically, then why not do a wire transfer and save a good chunk of change, especially on a large purchase?
My industry is a bit unusual because jewelry has no serial number, and can be dismantled, melted down, etc and sold as scrap, loose gems, etc. So we are always targets of fraud.
Yes, for your industry and transaction size, I'm sure you're doing the right thing.
Credit cards are really more for the middle ground of middle-sized transactions for ordinary goods and services between counterparties unknown to one another where risks are small or moderate.
Rgds
Damon
