Hacker News new | past | comments | ask | show | jobs | submit login

I had my card taken that way five-ish years ago. It was on a ferry where presumably there wasn't enough service to use a digital reader. Or maybe the system was just down. I never knew that was an option until then!



I was on a train a few years back and the snack cart had to go cash-only when we were in cellular dead zones. I guess it depends on the operator's risk tolerance - you can't tell if a card is declined until the customer is long gone, but if the dead zones are big enough you'll get fewer sales because so many people don't carry cash anymore.


One of the hotels I used to stay at did this too, they had a modern card terminal when you checked out, but they took impressions of cards during check-in. It doesn't really do much of anything in the modern era, but you felt like it was doing something and that's enough. Card payments have two separate uncorrelated steps. Authorisation and Settlement.

In the Authorisation step, the merchant on behalf of the network can decide whether you, the supposed card holder, are authorised to make this payment. For example if you have Chip-and-PIN this is the step where a PIN failure means they won't give you the bottle of whiskey you just pointed at through the glass.

To be effective Authorisation must happen up front. With Chip cards, (and also contactless payment) this can happen even offline, because the Chip can carry policy decisions like "Offline payment of up to $10 each time, $100 total before I talk to the network is OK, after that No more until I see a network" inside it.

Impression machines were the very most rudimentary type of "Authorisation", the impression recorded is some evidence they actually saw your card. Or a card embossed with the same numbers, at some point. Modern networks don't want the useless paper trail which results, but some impression machines are still out there and hey, it felt like a "real" card payment. The fact they're essentially useless doesn't matter because...

The Settlement step is separate, and often happens hours, or even days later. In this step the Merchant says, hey Payment Network, I'm Some Big Merchant and I want $123 from your customer #9876.

You might think, aha, and now they provide details from that authorisation right? Right? Nope. It's totally unauthenticated, subject to all manner of glitches and mistakes, and it is based entirely on trust. The big merchants are rich, so, if they sometimes lie and steal that's OK. Whereas if you, Mr Wage Earner, don't pay for that can of Pepsi, you're a criminal and you're going to jail.

If some merchant in say, Spain decides you just spend €546 on a TV with your card, even though you've never visited Europe, that just works. Left to itself, €546 plus conversion costs goes on your card account. To reverse that you'd have to notice the €546 charge, call your bank and complain about this clearly fraudulent card transaction. They're not always going to magically detect it, they should have some anti-fraud pattern matching e.g. if that store suddenly claims everybody living in your town in Ohio bought a TV from them, that's suspicious, it probably doesn't go through, and hey if you never visited Europe maybe that's enough to block it, but not necessarily. The responsibility sadly always stays with you to report any bogus transactions that get through even though the Card Networks made barely any effort to prevent fraud. So, read your card statements.


Me neither, my first encounter with it was 3 or 4 years ago at a backpacking shelter in Iceland.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: