Site requests bank logins for online purchases

https://lolware.net/2016/11/17/requesting_bank_login.html

by technion • 10 years ago

282 219 10 years ago

late2part• 10 years ago

Newegg recently did this when I used my American Express. It was a valid referral to Amex's website so I see how folks would fall for this.

wmf4• 10 years ago

Newegg redirected to you the Amex site which asked you to enter your password (this is 3D Secure aka SafeKey) or Newegg asked you to enter your Amex password on Newegg's site?

464192002d7fe1c3• 10 years ago

NewEgg does the former, for sure, with my corporate Amex. Oddly they don't do it with my personal one.

ThrustVectoring• 10 years ago

Yes, I've spoken to them. They don't see an issue.

This is exactly why the PCI Security Standards Council is a thing. They need to have someone straight up tell them something at least as serious as "fix this, or we will no longer take your credit card payments". Honestly, it's better off being "we aren't taking your credit card payments, you should know better. Fix this and go through a security audit and we might reinstate you".

daurnimator2• 10 years ago

But this isn't a credit card payment. This is for direct debit.

I've sadly seen all sorts of stuff spring up around this in australia, like https://polipayments.com/Buy (which e.g. is one of the only ways a normal person can pay for a jetstar flight without a credit card surcharge)

SyneRyder2• 10 years ago

It is for a credit card payment - the article mentions they paid via AmEx, their card was charged, and then a day later the website asked them to provide the login to their AmEx account as proof that they are the card holder. (Some/many AmEx cards come direct from AmEx itself, not via a bank.)

PostOnce• 10 years ago

What's wrong with just sending money from your acct# to their acct# with a reference number/code to identify that transaction as you, other businesses work this way (such as my power and phone bills from diff. companies), but the NZTA for example requires me to use either a credit card (which is fine) or POLi, which is garbage.

"no one can see your bank details" it says on https://www.polipayments.com/security which is a fraudulent claim, yeah the hell you can, its being sent to your server, not my bank, this is crazy. It also says they don't cache anything -- all kinds of criminals claim they're up to no harm. POLi says they're up to no harm, why should I believe them? There is NO EXCUSE for using POLi vs. just paying with your bank, if a business offers POLi and not bank transfer directly or a credit card, i would never even remotely entertain doing business with them. NZTA is not a business though, it's a government agency. You can do it in person though (transfer ownership of a car for example), or by CC, so whatever, I don't understand who would ever use POLi, the naive? Hopefully they go bankrupt in the near future.

CGamesPlay• 10 years ago

Mwave has identified online banking access as the quickest and easiest method to get access to your banking information.

Well, that's certainly true...

https://www.mwave.com.au/help/faq/view/76

captncraig• 10 years ago

I'm confused. They think this is easiest? Either they have someone manually going into bank accounts and making transfers, or somebody actually programmed something to log in via the webpage and do stuff. Neither of those are "quick and easy".

Is a paypal button really so hard?

Also, how are they not shut down? It seems a single user sending that screenshot to Amex should be more than sufficient to close any merchant account they have.

madeofpalk2• 10 years ago

There are services that give you programmatic access to bank accounts from multiple providers. Plaid and Yodlee are examples of these.

Not sure exactly how they services work under the hood, but it wouldn't be too dissimilar to just screen scraping.

maerF0x0• 10 years ago

Pretty sure Expensify and Mint did/do this, no?

fishtoaster• 10 years ago

True, but they have a legitimate need to access your banking info: they need access to your transaction history to function. The absurdity here is asking for bank login info just to make a purchase.

kjbflsudfb2• 10 years ago

Yea, but those are different services that utilize the history of your transactions. What reason does an online retailer have to access that level of detail? Shouldn't they simply be able to accept the information on the credit card for the sale?

jpalomaki• 10 years ago

They can reduce their risk by doing this. For online retailer there is always risks in accepting card payments. (Not saying this is a good idea, just trying to find reasons).

adambrenecki• 10 years ago

Sites like Mint do this to retrieve your banking history. Asking for banking login details seems to be the standard way of doing that sort of thing. (Don't get me wrong, it's still terrible, but it's not like the banks provide an API you can log in to with oAuth or something.)

This is different; mwave is a retailer, all they're doing is receiving a payment.

cyberferret3• 10 years ago

I don't think there is reason to any longer. Most banks now have a trust relationship with feed providers like Yodlee etc. We use Xero, and I believe they use Yodlee to pull bank and credit card transactions in. IIRC we had to authorise the transfer with Yodlee, and not with Xero directly (i.e. Xero doesn't get to see or capture our bank login details).

voycey2• 10 years ago

I don't think PCI compliance is a factor here (unfortunately) - they literally only deal with the taking of cards, I would think Banks should be looking at this pretty skeptically! Although here in Australia there seems to be a lot more "access" available to your bank account than in many other countries (including my native UK), it makes things like integrations nicer but I do wonder just when it's all going to come crashing down!

voycey2• 10 years ago

"Usernames and passwords to electronic accounts holding payment data are not sufficiently protected"

I correct myself - maybe it does!

windowsworkstoo• 10 years ago

That is more referring to the user/pass you might use to login retrieve card details say from a card vault for manual processing. Indeed PCI 3.1 (and actually from v2) has a strong requirement for MFA when connecting to the cardholder data environment network.

I've lived PCI for a while - I don't think this particular issue would fall under their purview. As per PCI-DSS doc, it is primarily concerned with the secure "acceptance, transmission and storage" of cardholder data.

If they use a 3rd party payment processor for their credit/debit card transactions, they will only have a very limited PCI scope (probably just SAQ-A) which will basically say "oh, make sure you send it to your processor over TLS" and don't peek.

This particular instance is probably one for the regulatory body, which in our case in Aus would likely be APRA.

joatmon-snoo• 10 years ago

According to the PCI-DSS website, "[i]t is important to note that the payment brands and acquirers are responsible for enforcing compliance, not the PCI council." [1] No idea what the state of actual legally-enforceable penalties is.

In the meantime I've tweeted @AmericanExpress about this.

[1] https://www.pcicomplianceguide.org/pci-faqs-2/#1

andrewguenther2• 10 years ago

Would you mind linking the tweet? I'm curious to see if they respond.

abrookewood2• 10 years ago

I wouldn't think there are any legally enforceable penalties except maybe through contract law. PCI-DSS is not law, it's an agreement between companies.

brazzledazzle4• 10 years ago

I think legally-enforceable penalties in a regulatory sense vary depending on where you and your customer are. But the contracts between you and your credit processing merchants are civilly enforceable and in my experience they don't mess around. They will fine you and raise your transaction costs when out of compliance and will ultimately cut you off if necessary. They also know their competitors will do the same thing because they bear the brunt of the costs incurred by fraud.

russdill• 10 years ago

Is this the verified by visa thing? https://usa.visa.com/pay-with-visa/featured-technologies/ver...

Bank passwords alone wouldn't work on any of my accounts because it would detect a different computer and request secondary authorization. It does this by looking at the information the browser sent...and...oh...oh. Geez I hate security theater. Is there anything less secure than the information sent by your browser?

464192002d7fe1c3• 10 years ago

It looks like their own ghetto implementation of Verified by Visa.

Verified by Visa is secure because it uses a shared secret (not terribly unlike how JWT works) for the merchant to redirect you to the bank (with information on what card you used), who verifies your username and password and that that is your card, who then redirects you back to the merchant with something that says "Yep, we verified them"

0x02• 10 years ago

A big problem with VbV is that the VbV step is usually embedded as an iframe, making it near impossible to verify its authenticity in normal browsers.

vertex-four• 10 years ago

Verified By Visa happens immediately after you hit "pay", not a number of days later. Also, there's a number of implementations of it - some banks in the UK ask for a password you've set up previously, some don't, some ask for random other info. It is consistent between sites, though - it's bank-dependent, not site-dependent.

rajington• 10 years ago

This is how Venmo does it so they don't have to make you do the "verify two microdeposits" process, and it's getting more popular. I think because when you give your login you're giving over complete access so bank is not liable for fraud.

fraserharris• 10 years ago

Huh? Venmo requires a bank card - that's all.

andrewguenther2• 10 years ago

I never had to do this for Venmo. Is this a recent change?

JadeNB• 10 years ago

I had to do it when I signed up. That's why the history of my interaction with Venmo was (1) change bank password, (2) accept the money from the person who would only pay using Venmo, (3) change bank password back so that Venmo / late hackers into Venmo databases don't get any ideas.

msk5293• 10 years ago

I think you're referring to Plaid's Auth product, which is for verifying bank accounts. https://plaid.com/products/auth/

smaili• 10 years ago

Why do I need to provide my bank login information (username, password, security questions)?

Mwave has identified online banking access as the quickest and easiest method to get access to your banking information. In order to access this information, it is required that you provide your username, password, and any security questions associated with your online banking account.

mikestew• 10 years ago

Mwave has identified online banking access as the quickest and easiest method to get access to your banking information.

Well, one can't argue that they're wrong in making that statement. However, that's the reason we don't give random websites the credentials for our "online banking access". :-)

brazzledazzle4• 10 years ago

Security questions too. Unbelievable. I wonder how much political good will some poor engineers wasted fighting this.

barbs• 10 years ago

Wow. And that's an Australian company, based in Sydney no less, not far from where I live... how embarassing.

yashwanthcp• 10 years ago

This page has a good explanation of why - https://www.mwave.com.au/help/faq/view/24

cyberferret3• 10 years ago

That link explains other security measures, but doesn't actually say that they need your bank/credit card login details though?!? (unless I missed it somewhere).

"Please note: Due to the rise of credit card fraud and for your security all credit card orders will be subject to detailed security checks requiring further documentation; that may include Driver Licence, CreditCard or bank statements. If your order does not meet our security check requirements, you will be contacted and further credit card security procedures will be implemented.

As part of our verification process we will utilise various procedures to ensure ultimate protection to the Credit Card holder. These processes may include but not limited to charging a small amount randomly under $2 requiring confirmation prior to approval; verbal verification via phone or a request for written Authorization, photo identification including valid Driver Licence, Utilities bill or the copy of the credit card or a request for your bank statement displaying the debit entry.

Mwave may also use a verification service powered by BankStatements.com.au, the Australian leader in automated bank statement data retrieval. Since 2013 BankStatements.com.au has provided secure, automated data retrieval services to over a quarter of a million Australians as part of their credit applications. "

1ris5• 10 years ago

This is common practice in germany. The whole payment methode "sofortüberweisung" or "sofort" is based on this. You give your login information and a single use password to sofort, they initiate a wire transfer and instantly guarantee the money will arive. (It will arrive 24h later, as banks are allowed to delay it this long and they use it as additional liquidity) Of course this is a security nightmare and or course the ToS of the Banks prohibit you from sharing your login details. But unfortunately they don't enforce their ToS. Recently the cartel office called for making this part of the Banks ToS void, as they would "hinder the adoption of innovative FinTec".

But it illustrates how deeply flawed the whole banking sector is that people are willing to give up passwords to third parties or paying insane fees to paypal. IMHO we urgently need a law that makes wire transferees instant, or this dangerous and incredible expensive layers grow for the disadvantage of everybody (expect paypal and sofort).

candiodari• 10 years ago

From the merchant's perspective this works because bank transfers have to be free for both the source and the destination. So banks have an incentive to sabotage this and they will. By contrast bank fees on credit cards can go close to 6% now. That's why you get cashback offers, points, ... on credit card offers.

I think a lot of people (but not banks) would be very keen on having regulated fees for transfers. Of course, not banks.

dublinben3• 10 years ago

Credit card transaction fees are regulated at a much lower level in Europe.

morgante7• 10 years ago

By contrast bank fees on credit cards can go close to 6% now.

I'm not sure where you're getting your info, but that's off by a factor of 2.

Credit cards work great for consumers, just not merchants.

brazzledazzle4• 10 years ago

This is totally and completely insane. If a site gets hacked and your money is stolen there's no way the bank is going to indemnify you when you willingly turned over your credentials to a third party.

Do they have to have all kinds of specialized fraud detection in place to prevent unknown IPs from transferring more than a certain dollar amount? It also just occurred to me that you probably can't have 2-factor enabled on your bank account.

revelation• 10 years ago

There isn't actually anything you can do with the login + password. Sure, you can look at the transactions, so I guess it's a privacy problem.

But any transaction or change usually requires generating a single use pin with your debit card and a small card reader. Some also use your mobile phone.

1ris5• 10 years ago

The second factor is the one time password. You get ~200 by snail mail and need one for each transaction. So you only give up control for one transfer. But yes, indeed, this is insane.

paulmd• 10 years ago

This same procedure is used in the United States with startup darlings like Coinbase. No debit card or one-time-password required, please give your real bank account password.

https://support.coinbase.com/customer/en/portal/articles/194...

hackinthebochs• 10 years ago

What we need is just a secondary password with limited permissions and some fraud guarantees. There's no reason your bank account can't also act as a payments gateway with the right protections.

wmf4• 10 years ago

We could call it... a credit card number.

morgante7• 10 years ago

This is a solved problem. Credit cards work great.

The issue is that lots of merchants (particularly in the EU) simply don't want to deal with the fees associated with credit cards so come of up with lots of creative ways to externalize the cost of fraud to consumers.

1ris5• 10 years ago

No, they don't. They are completely insane aswell. They are like smart cards, but with the secret printed on them, visible for the world. If you want to clone them you don't need a highly advanced lab, you can just remember the number. You also share said "secret" with everybody you do business with.

Of course you constantly get your money stolen. You just don't notice because the loss is distributed evenly. That's why they are so expensive.

I'm suprised people use such a low tech system. I wouldn't even accept such authentication system for my throw-away reddit accounts, let alone for money.

Symbiote2• 10 years ago

The EU has introduced limits for card fees, so there's no reason for merchants not to accept debit cards now.

codedokode3• 10 years ago

If they don't want to pay the fees why don't they just develop some open payment protocol any bank and merchant could use? It would also solve the privacy problem with sending customer data to USA (Visa and MasterCard are both american companies).

djsumdog• 10 years ago

I thought in Germany you used one-time disposable TAN numbers for this purpose?

Australia also has direct person-to-person/business money transfers, but without the one-time-use pins. That this company would even ask for a bank login is terrible and unnecessary.

atomwaffel3• 10 years ago

I thought in Germany you used one-time disposable TAN numbers for this purpose?

We do, Sofortüberweisung just acts as a man in the middle and passes through all TAN requests from the banking website to the client. They can't transfer money out of your account without your consent, but they can do just about anything else that doesn't require a TAN.

dx0347• 10 years ago

If someone intercepts the traffic (a hack on sofort's server) they could read all transactions and account info without anyone noticing. Guess with that information you could make a lot of money phishing.

ChemicalWarfare2• 10 years ago

>we urgently need a law that makes wire transferees instant

Not sure about Germany, in the US this is a "technical" issue with the way consumer banking settlement is implemented. The notification of the intent to move the funds is almost instantaneous, the actual clearing takes days in some cases.

dx0347• 10 years ago

In the UK it was solved by making all small transfers instant, while large transfers (direct debits, salaries) are still settled overnight. That way most of the transfers are instant while >90% of the amount transferred is still settled. Avoids issues for the banks' cash management while it's convenient for the user at the same time.

I think the US has the problem that it had to set up that way when clearing was done physically (due to the size of the country) and it's now very costly to change, for very little benefit to the banks.

gcb0• 10 years ago

that is actually great!

with one time password it does work.

In the USA, you give them a number (which is written on each check anyway) that allows anyone to empty your account if so they wish, with absolutely no passwords or anything else.

Rafert• 10 years ago

This is a solved problem in the Netherlands with iDEAL. Go to checkout, select your bank, authenticate at your banks website with your credentials and 2FA (SMS/EMV CAP reader/QR code), confirm transaction details and you'll be redirected back to the web store. The wire transfer is not instant but it is guaranteed so the merchant can start shipping immediately.

See https://www.ideal.nl/demo/en/ for a demo.

rbag• 10 years ago

In France we have 3D Secure, when you make the paiement you are redirected to a page that belongs to the bank, you receive a SMS with a one time code to validate the paiement and are redirected to the merchant with the validation.

Quite efficient, but I think there's fees for the merchant in this case.

the_mitsuhiko5• 10 years ago

I don't consisted that a solved problem. Austria has the same "solution". Try paying as a foreigner without a local bank account. Also no support for chargebacks.

lucaspiller• 10 years ago

This is how most ecommerce works in Lithuania too. Debit cards (vs credit cards) typically didn't allow online transactions until last year, so most ecommerce companies just do this - there are only 3 or 4 major banks, so for the user it's pretty easy. I assume the fees are lower for the business too.

The only downside is if you don't have a local bank account (i.e. as a foreigner) you can't use it.

2FA is done by a) paper code b) passcode generator fob or c) mobile signature, which uses your SIM which holds an RSA key (it doesn't use SMS):

https://en.m.wikipedia.org/wiki/Mobile_signature

fungi• 10 years ago

australia has https://www.polipayments.com/

jve• 10 years ago

Yeah, also happens in Latvia. Already for many years, many banks here and many online services provide you with this way of payment.

webjunkie• 10 years ago

This sounds exactly like "Giropay" in Germany, a competitor to Sofort and supported by some banks, but has very low adoption.

atomwaffel3• 10 years ago

Yes, the same system exists in Germany too (confusingly alongside Sofortüberweisung). It's called Giropay and it works the same in that you sign in on your online banking website and the wire transfer is guaranteed by your bank, not a third party.

It's nice and works well. All would be great if it weren't for the fact that it's only offered by some banks (mainly cooperatives I think) and only accepted by some shops. Why the German banks have tried to sue Sofortüberweisung out of existence instead of implementing their own universal system that undercuts Sofortüberweisung's merchant fees (0.9% + €0.25 per transaction) is beyond me.

77pt77• 10 years ago

Some places solved this by creating one shot virtual VISA cards created at the banks website.

It's a good compromise that works almost everywhere.

thirdsun• 10 years ago

Is that actually true? I remember I used Sofortüberweisung once when I had to and it didn't feel (for a lack of a better term) as if I was sharing my credentials with Sofort.

It was a long time ago but I had the impression that they used some kind of legitimate connection to your bank (with TAN check and my original banking interface) and were only notified about the success (or failure) of the transaction while never receiving the sensitive credentials themselves.

Of course I may be wrong.

the_mitsuhiko5• 10 years ago

Yes, they just scrape your banks online system.

dom0• 10 years ago

This is common practice in germany. The whole payment methode "sofortüberweisung" or "sofort" is based on this.

I've never used that and only one person I know did use it ever. And even that person felt rather uncomfortable about it. So I don't think it's very common.

A year ago or so it was also exposed that sofortüberweisung doesn't only do the transfer, they actually retrieve details of all recent transfers.

darklajid• 10 years ago

Well, given that they have all the login information (bank, user/account number, password/pin) they can basically access everything that is read-only and not TAN protected.

For my bank the transfers of the last month would be accessible right away, for example.

Honestly, I (German as well) didn't believe 1ris right of the bat and went to their website to prove someone wrong on the internet. Oh my was I wrong (apologies, 1ris). Horrible idea.

biafra4• 10 years ago

To solve the problem with Sofortüberweisung it would be enough if my bank would just provide a digitally signed statement, that I authorized a payment and had enough funds at the time so they would execute it. I could take this statement, show it to the merchant and he could verify it by using a publicly known publlic key of that bank. If nothing better is available it could be the key they us on their website.

I wonder who is interested not to already have this. I can't be the first person with that idea.

blauditore• 10 years ago

From what I understand, this is basically what happens for most online credit card payments. If you enter your credentials, you're redirected to a verification page by the issuer where you have to enter a password or SMS-sent key. On success, this page then passes a signed token (or similar) back to the original online shop as confirmation.

kekub• 10 years ago

Let me elaborate on that:

For a German it is common to have a "check account". The underlying system is called "girocard". It contains a module for paying in stores (electronic cash) and another one for withdrawing money from cash dispensers ("Deutsches Geldautomaten-System"). In addition to that most banks offer their customers access to "maestro" (some debit card service from Master Card) and V-Pay (same as maestro but from Visa). Credit cards are only popular among the younger population as they need them to buy things online (iTunes, Google Play, etc...). However the "check accounts" come with a different kind of insurance. You can read quite a lot about that online, my personal experience is the following: If somebody steals (no matter how) 200€ from your credit card the bank will cancel the transaction immediately, if the same happens with your "check account" you need to go to court to get it back.

Having this system you might imagine why our online-banking is overly complex: You have to login with a username and a password[=PIN] (for some banks you have a fixed username, at others you can choose one). Afterwards you are allowed to send someone money. Therefore you require another one-time-password[=TAN]. This TAN can be obtained in multiple ways: 1. Snake Mail (Just a printed TAN list asking you for a random free TAN), 2. Snake Mail (A printed TAN list asking you for a specific TAN at a given index), 3. Snake Mail (A printed TAN list asking you for a specific TAN at a given index and returning a verification code, that is also printed on the list), 4. Mobile TAN (TAN via SMS), 5. Push TAN (TAN via Banking App), 6. Photo TAN / QR TAN (Optical System which works with pub/priv key to verify your transaction), 7. Chip TAN (Special device that uses the chip in your card to verify your transaction).

After you verified your transaction it takes up to three days before the recievers bank notifies the reciever that he got the money. The real joke is, that everything regarding payments can be transmitted in real time. However some banks make use of these days to generate more interest.

End of the story: If you want to pay something online and you want to recieve it quick you need to either use a Credit Card or some proprietary system that your bank might support (see paydirekt, giropay). As both might not be available for some users they either have to wait for 3 days for their money to arrive at the reciever or use a untrustworthy service like sofortüberweisung (which scans all your transactions and predicts your accountability [Disclaimer: If I remember correctly, German Ref. http://www.pcwelt.de/news/Datenschuetzer-alarmiert-Sofortueb...).

gosubpl2• 10 years ago

Solved problem in Poland. Actually I usually laugh when I hear about "FinTech" startups struggling to deliver technology that is history here. mBank has been offering "instant" money transfer for purchases for the last 15 years, now there are more then a couple of vendors aggregating almost every bank that there is on the market. Real time transfers have been available via BlueMedia (private company) for like 7 years and via central banking transfer hub for over a year. You can pay with your mobile via a couple of providers, including said central banking transfer hub (Blik payments). And standard bank transfers (take around 8h to deliver - depending on incoming and outgoing transfer sessions timing - there are 3 sessions a day) are free - so many people are used to pay via standard bank transfer and there are many solutions for merchants that do automated account scraping to match incoming transfers. Poland - the land of FinTech future. Downside - if you are Financial IT provider - you can hardly get anything sold here - everything that comes from outside is history here.

mootothemax2• 10 years ago

Yeah, the tech side is great, it's just a shame that borrowing costs - for anything in złoty, e.g. mortgage - are gigantic, saving interest rates are abysmal, and you really have to watch out for bad actors thanks to the close-to-zero consumer protection rights.

For example, a number of online shops show items as being "in stock" despite having an empty warehouse (or no idea if their supplier has anything in stock). It's possible to transfer large sums, and then have to sit around waiting for a month or two while the shop decides what to do, all with close to zero repercussions for the shop themselves.

If you've paid with a credit card instead of a bank transfer, it's simple enough to kick off a chargeback. (well, not as simple as in other nations, but a short form and a quick chat with a moody call centre rep).

As a recent example, I had a ~5,000zł purchase go wrong (to a well-known Apple authorized store) after the payment was successfully taken, but the store's website had an error and failed to process. Trying to get a response out of the payment processor or the shop was like getting blood out of a stone; the only thing that worked inside of a reasonable timeframe (I gave them a week to even reply to me on phone -or- email) was a chargeback.

While I can live with unfavourable rates, give me the UK's consumer protection laws any day of the week!

kybernetyk2• 10 years ago

Yeah, I was living in Poland for 4 years some time ago. (2008-2012) and I was astounded how modern banking is compared to Germany.

Here wire transfers still take 1 day minimum. (Except your transferring within the same bank). Doesn't matter if you send the payment in the first or last scheduled transaction window. For the receiver it won't show up till the next day.

Our bank cards won't double as credit/debit cards either. We still have to get an extra card if we want to perform VISA payments. And NFC is still not wide spread. (though that might be a good thing)

I also like how integrated Polish banks are with public services. You could issue a tax or social insurance payment directly from online banking. Granted on the backend it's still just a normal wire transfer but that most banks have an easy to use form for that is great.

I still have my mBank account and feature-wise (and UI wise) it's light years ahead of what my local German bank offers.

I guess here in Germany when it comes to banking we're the victims of early innovation and have to cope with entrenched old standards instead of adopting all the nice new tech.

captn3m02• 10 years ago

.nl and .in have similar systems that allow one-time transfers to be made using your online bank account.

In .nl they have iDEAL, as someone already pointed out. In .in, we have to integrate with each bank individually, and there are several aggregators that do this for you, and you don't have to sign an agreement with each bank.

gosubpl2• 10 years ago

Yes, I have noticed. But thanks for the update again :) I think future is here, just it is not evenly distributed. But I really laugh when talking to someone who has just heard of this new exciting London or SV Fintech startup and learns that in some countries this is already forgotten history and we moved forward since :) I think Poland is more striking for them than The Netherlands as people are used to thinking about old Comm block countries as a bit backwards ;)

thesimon2• 10 years ago

as they would "hinder the adoption of innovative FinTec".

Which is not surprising considering the banks have their own similar scheme giropay/paydirekt and not allowing competitors doesn't seem that fair.

IMHO we urgently need a law that makes wire transferees instant

SEPA Instant Transfers are coming 2018

PSD2 coming 2018 requires bank to provide API access to third parties as well, so this is basically a solved problem.

jnsaff2• 10 years ago

In Estonia it was solved in a somewhat saner way: there is a unified framework with which customers can: - click on a Pay with Internet bank link - it directs you to your chosen bank's internet bank - you log in - the payment is already pre-filled and - once it is done the seller gets a signed confirmation from the bank that the transaction has actually happened.

vurpo• 10 years ago

This is a common method of payment in Finland as well, but, the store always asks you to choose your bank, then redirects you to the online bank where you then authenticate and authorize the transfer on the bank's website. It then redirects you back to the merchant's website.

Basically, banks provide an API (similar to OAuth? I guess) where the merchant only asks the bank for a specific amount of money, and the authentication and authorization of the payment happens only directly between the customer and the bank.

Why would this be so hard to so in other countries?

ptaipale• 10 years ago

And note: the same authorization is mandatory also for credit card payments in Finnish web shops.

I.e. when you're ready with your shopping cart and click "pay", and give your credit card number, then next thing is a redirect to the bank's page (where you really should check the URL and SSL certificate...), you give your OTP for bank login, and this authorizes the credit card payment, you get a redirect back to the seller website and complete the transaction.

codedokode3• 10 years ago

What if the login credentials are stolen with a keylogger, will the hackers be able to transfer the money the same way? It looks totally insecure.

And as I understand the customer cannot charge back the payment later.

IMHO we urgently need a law that makes wire transferees instant,

Why not just use card processing systems like Visa? Are the fees too high or are there privacy concerns with sending personal data to USA?

ThomPete2• 10 years ago

Wiretransfer at least internationally can't be instant since there is no such thing as an international wiretransfer. What there is is a bunch of agreement between banks. So at least globally a law wont change anything.

ascorbic2• 10 years ago

https://en.wikipedia.org/wiki/Single_Euro_Payments_Area

germanier2• 10 years ago

Not only is there such a thing as a common system for international wire transfers in Europe (SEPA Credit Transfer, which is also used for domestic wires as well), instant payments are coming soon™ to that (supposedly end of next year): http://www.europeanpaymentscouncil.eu/index.cfm/sepa-instant...

jaunkst• 10 years ago

No. Just no. Not necessary. Its amazing that this is successful by any means.

plantain• 10 years ago

This is very normal in Australia. All the major airlines do it via POLi[1]

[1]https://en.wikipedia.org/wiki/POLi_Payments

abrookewood2• 10 years ago

I wouldn't say it is common - I've never seen it.

_kyran• 10 years ago

It's usually the only option to avoid a $5-$70 credit card surcharge. Have you ever paid for a flight online with Jetstar, Tiger or Air Asia?

With Jetstar, up until a few months ago, you could do your own bank transfer, but now poli is the only option.

polemic• 10 years ago

There is a similar system in use in New Zealand and Australia called POLi:

https://en.wikipedia.org/wiki/POLi_Payments

It's discouraged by banks and you don't see it as much as you used to (in NZ anyway).

elemenopy• 10 years ago

It's still around for some things, eg Jetstar. You used to be able to do a manual online transfer to pay for flights but now POLi is the only way you can avoid the $5 credit card surcharge. Grinds on me every time I buy a flight.

snikch• 10 years ago

Poli now manage this via an API with Westpac at least, i.e. you go to Poli, redirect to Westpac and log in, then redirect back to Poli who pull in the info with an API. Very much like an OAuth flow, but I don't know the actual details of it. (I won't get into how oauth isn't a great solution, but at least I'm not exposing my creds to Poli).

cyberferret3• 10 years ago

I am wondering about the legalities of them doing this. I remember back when we had a merchant account for a retail style business, we were repeatedly warned by the bank that we were legally on the hook if we took a customer's credit card information and it got somehow compromised or leaked.

This was back in the pre-EFTPOS days when a store would have to keep a carbon copy of the customer card imprint (as well as their signature). We were told to guard those slips like gold, and dispose of them properly when not needed any longer, because with that information, we could in effect impersonate the customer elsewhere.

I would say that things have changed markedly these days, but I wonder if the legislation, especially here in Australia, has kept up with that, seeing as a customer's login credentials are effectively the same as having their signature which can be copied?

daurnimator2• 10 years ago

mwave can be pretty shady... I know that their user email list has been either stolen or sold.

netfreak111• 10 years ago

The way I handle this is, I have a dumb checking account which I transfer money to, when I do such transactions. This is more akin to giving a lame email address to websites you don't care.

bathory2• 10 years ago

If only banks had a special login for these one-time transactions. One where the history isn't enabled either. In the Netherlands such a system exists, it's called iDEAL

technion• 10 years ago

Author here. The post was put together in a bit of a rush - I've updated it based on a number of the queries I've seen.

Overall, if attention to this issue can stop one other company doing this, I'll be pretty happy.

ctpide5• 10 years ago

So, technically, everyone who does this (provides their login info) violates their terms with the bank I assume, as they probably told you not to share your password with any third party?

wolframhempel• 10 years ago

As the son of an otherwise amazing woman who falls for every credit card scam to ever hit her inbox I think this is another great reminder of the mindset disparity between techies and the wider public. While we obsess over end-to-end encryption and distributed ledgers the vast majority of people are perfectly happy typing online banking credentials and uploading pins to random websites.

SwellJoe• 10 years ago

I used to love MWave, many years ago. They were just a fantastic vendor back then. They shipped faster than anyone, handled returns fast and with zero hassle.

But, I had a couple of mildly negative experiences (slow to ship, items listed as in stock weren't, etc.) and I stopped buying from them.

This, though, is just crazy. I can't believe their merchant bank even allows them to do this.

BrandiATMuhkuh2• 10 years ago

I've talked with a friend working in the IT department of one of Austrias biggest banks (black + yellow colour ;) ) about it. Apparently, banks want to become the identification services of the future. The idea is, that you can only (not sure if that is true) open a bank account with a valid ID, therefore the bank login can identify if a person is real or not. Example: creating a Twitter/FB account with you bank credentials would make your account automatically an approved account (you are you)

boredpudding• 10 years ago

This is true. However, they will not let you enter the details on the page itself.

In The Netherlands they are launching 'iDIN'. Which is a bit like OAuth 2.0, so it only provides the webshops with the things they need (and a bit more like age. So yay, privacy issues).

BrandiATMuhkuh2• 10 years ago

One of the problems is when this is done by companies instead of states. A company might remove your access for some, not obvious reasons. Just see current trending HN link http://www.dansdeals.com/archives/98444 where google suspended an account and with that the person could not use the google login anymore. Even for non-google pages. That is scary. A protocol like the EDUROAM system would be nice. In that case, credentials include a domain (usually a Uni name), and with that domain the home uni(bank) can be used as an authentication authority.

biafra4• 10 years ago

It's that they apply the charge to your card a day before giving you this prompt, leaving you begging for refunds when you refuse.

That is strange. I never begged for a charge back with any of my credit cards. When I say the transaction is fraudulent or not authorized by me, I get my money back. Always.

The merchant can then sue me, if he thinks different. Is that not what happens with all credit cards in all countries?

Biganon• 10 years ago

It wouldn't work for me (UBS, Switzerland), I need to punch a code into a special calculator thing in order to login.

celerrimus• 10 years ago

There was similar attempt here in Poland few years ago, i believe it was sofort used by few online shops owned by German parent companies.

This ended very soon, because people here are quite sensitive for such practices and Financial Supervision Authority begin informative action as this was against the law.

But what was more important, people quickly realized that they could abuse this process. After such payment, they log in again to bank account and cancelled wired transfer (in most banks we can cancel wired transfer unless it actually leave your account few hours later), and then change their bank password. From point of view of shop, payment was successfull, they process order, but never get cash for it. This was the reason such payment systems ended very soon.

Like kybernetyk and other wrote, in Poland we have very modern banking system, there's no problem to make fast wire (up to 15min) using official banking systems or reliable payments systems - you authorize each transaction directly in your bank system without revealing your login details to the middleman.

tener• 10 years ago

Still an issue - tried to buy shoes from Deichmann, they requested my login credentials. WTF.

dx0347• 10 years ago

It's because Germany has a very low credit card penetration rate and the German debit cards cannot be used to guarantee a transaction. Direct debits can be cancelled without any reason for a while and aren't confirmed at all for several days.

Unfortunately that doesn't seem to change. The big banking networks have their own debit system that's not compatible with many international online payment systems. There is thus little incentive to switch to sth like Visa/Mastercard debit cards.

expertentipp• 10 years ago

Stay away from German payment "inventions" like Sofort, direct debit by default, "cash is the king" bollocks. Many German retailers and "startups" entering Polish market are trying to introduce their (low) standards and this can deteriorate banking culture in Poland. The retail banking in Poland is working really good and is customer friendly - keep it this way.

ian0• 10 years ago

Typically the payment process is be managed by a dedicated payment gateway through an iframe and not the merchant so it should in principle be slightly more secure than it looks. Someone mentioned Poli, one such gateway in Oz.

As being shut down is a genuine business risk they strive for legitimacy - id be surprised if it was in-country and operating without at least tacit agreement of banks. Even slow moving banks could counter against this type of browser automation technically - not to mention legal action. No large merchant would fancy negative security related PR either.

Honestly speaking - the payments industry is full of hacks like this. Look at US p2p systems built on ACH refunds. Or using 3D Secure for identity verification. Or processing pre-auths of 1 cents and rolling back to add a card to a wallet.

Banks are slow and competitive, schemes are just slow, central banks often take a wait-and-see approach. When they get their act together systems like this tend to be replaced or evolved into more sensible and durable solutions - but that can take awhile.

And in the meantime everyone tries every avenue possible to reduce fees or provide a better UX (in this case at the expense of consumer protection).

codedokode3• 10 years ago

Is that even legal? What is the difference between this company and phishers collecting bank logins?

And doesn't it look suspicious if the logins into different accounts are made from the same IP belonging to the online shop? Some banks in my country even require SMS verification if you are logging in from new IP address.

Karupan• 10 years ago

There is something similar in India called netbanking. Typically, the site redirects you to a payment gateway, which then redirects you to the bank's site. You enter your username/password only on the bank's site and complete the transaction. It is used quite frequently due to convenience and security.

When I moved to Oz and tried to buy something online, I was quite taken aback that I was being asked to enter bank login details on 3rd party sites directly. Felt completely unsafe, so haven't used it yet.

jaaames• 10 years ago

There's a few places doing this now.

I've met the CEO of bankstatements.com.au at a trade conference. Currently it's hard to get data feeds from banks - these guys are logging in, scraping bank statements and then providing them as digestable feeds.

Pocketbook is another Australian fintech that was recently acquired that do the same things with credentials.

The banks know they're doing it, it's against terms of service, but seem to turn a blind eye.

POLi seems to have more reputation but I still feel dirty the few times I've been strongarmed into using it.

sathackr2• 10 years ago

Paypal does the same thing. I added a bank account, and Paypal requested my username and password to automatically verify the two test deposits they made.

theobon• 10 years ago

Is that new. When I signed up, admittedly a number of years ago, they just asked me to tell them the amounts of the two test deposits. No login creds provided.

sathackr2• 10 years ago

At first I thought so, as the first time I saw it was a couple of months ago when I added a new account, but then I googled and found [1]

So I guess it's based on your routing number and whether your bank's online system has the proper framework to allow it.

[1] http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2009/2/12...

Site requests bank logins for online purchases

Related Stories