South Park once had a good scene about just not accepting random things that pop up (in HumancentiPad). If you see something popping up on a website - maybe just delete the pop-up from the HTML. (Click on Inspect - Examine - Delete).

Heise is a bit nasty with technology, and it's a bit harder to get rid of their thing, but I can read everything without accepting anything.

Which is the same as many if not most of the other sites we regularly link to on HN. You just aren't told about it.

https://archive.is/6h2TN

Oh, valid point. I actually hate heise.de's approach to hard-require consent to ad-tracking (or payment). As my university has a subscription for heise.de, I was not shown the consent popup and forgot about that. Sorry.

What’s "FP" for?

The optimal amount of fraud is zero.

But fraud prevention is not free and has negative returns at some point.

I dislike it when people use "the optimal amount of fraud isnt zero", because it is wrong and makes the underlying problem harder to understand, which is that people like to overoptimize a single desirable property(fraud prevention) without considering other desirable properties(like ease of use and a low rate of false positives for legit transactions)

I believe you’re referencing Patrick McKenzie’s takes on fraud, which I agree with — but when he (and others) talk about the optimal amount of fraud they’re usually referring to fraud from “losing money from the company to customers”. This is not PayPal’s case; because PayPal isn’t the victim of fraud on its platform but makes money off its use, their optimal amount of fraud is “as much as they can permit without losing customers or regulators getting up their ass”.

This is an important concept. More you push to zero fraud, the more inconvenience you put on your customer. You can cut bunch of fraud if you only allow shipments to the billing address but then you inconvenience people who want to buy gifts, recently moved or have a vacation home. You can block all traffic from cloud providers but you'll end up blocking outbound proxies for people on military bases or corporate proxies.

and of course, confiscating the fraudster's money without refunding it

Routing and account numbers have been on every check written for decades. Banks usually aren't quite that naive to let anyone with the numbers transfer whatever they want. There's name validation they can do, but legally/contractually IIRC it's optional. So the numbers + a lot of social engineering skill can do damage.

But I kinda suspect the ROI is higher for social engineering into an online account portal to Zelle a bunch of stuff around vs waiting for ACH transfers. Breach a login vs find an ACH list and transfer stuff out of the high-value accounts without triggering any flags (imagine you had access to that Paypal list - how are you trying to exfiltrate from millions of accounts without looking suspicious?).

I'm trying to think of any bank that I've used that would not have "address book"-like functionality, and I can't think of one. All of them have this, and have had the feature for as long as I've used their online banking. Perhaps the banks you're used to aren't very modern?

SEPA transfers are (at least mine have been) max. 1h until the transfer is complete (some limit this to "banking hours"). Instantaneous transfer is common.

It seems to me like there is great variety depending on what bank you use.

API's are common, and even the same between banks now with PSD2.

Tbh, a banking barcode (or EPC QR if you prefer) displayed on the seller's webpage with unique reference + reading it with your phone and making the payment is that internet payment method via giro. The webshop uses PSD2 open banking to get notified of new transactions and knows when it is transferred.

> Giro is not instant, and almost no bank will offer an API that signals that a specific customer has transferred funds successfully.

And because of that we have leeches like Sofortüberweisung. They basically proxy the web interface of your bank and you'll give them full access to your account, so they do the transaction for you by scraping your banks web interface (and your transaction history) and report success to the vendor.

SEPA Instant Credit Transfer allows instant sepa transfers, and soon all transactions will be required to be ict if possible.

Banks have APIs you can integrate with, which e.g. KDE's money app used to support in the past.

The actual underlying transaction system is extremely well designed and reliable, it's just missing the nice APIs that other payment systems have.

Austria has the state-run EPS system. It's very ubiquitous here, I use it for most online payments.

? IBAN transactions are instant and free.

All three of my banking apps offer adresse books.

why couldnt i sent money back? I see the sender and the IBAN

I can even in some cases cancell payments

where are you at?

me france germany italy and switzerland.

Are you from the states or canada? The parent talked about europe.

ideal will handle that. But it’s only in NL.

I don't do much banking in the U.S. system, but I'm assuming that ACH transfers get you pretty close to a giro system. Apparently, they are quite slow by SEPA's standards.

This comment is not towards you but there's always an excuse with the big German banks.

For example, during Covid when interest rates where negative - some major German banks like Commerzbank charged interest from customers when their balance exceeded an amount like 50000€. Now that the interest rates have gone up - they are not even close to passing on those high interest rates. The same Commerzbank now asks for 50000€ in assets otherwise they charge a 4.90€ subscription charge from their customers.

So yeah there might be technicalities but nothing stops those technicalities being addressed until the law does.

One prominent example is DKB (easily in the top 10 consumer banks by size)

I can't speak to how other European countries did only payments, but you never gave your credit card number to the merchant in Denmark. It was always done via a 3rd. party payment provider, initially mostly DIBS, then came WorldPay and later many more.

Charge backs was also always fairly easily done via your bank. Though you did have to call them, so yes PayPal was/is easier. I don't know, the trust in PayPal was always really really low.

Right. But that was only relevant because US customers wanted to pay by credit card (because of some combination of credit cards being good and other payment methods being bad in the US). Which was not the case in most of Europe.

The "global" is the problem here.

Each country had a local solution. Direct transfers, or better direct debit, was the common way in Germany. You literally just entered your bank account number and that was payment, the seller would debit it from your account. Zero authentication, and it worked - never had a fraud issue (in the background, I assume sellers checked the delivery address against some database before accepting this, as the seller would ultimately be on the hook for any fraud).

Aside from manual bank transfers (seller ships when the money arrives 1-3 business days later) there were also two systems based on direct bank transfers. One (Sofortüberweisung/Sofort) was essentially institutionalized phishing - you give a third party your banking credentials, they log into your account, snoop around a bit, wire the money to the merchant using your credentials and confirm to the merchant that your account has enough money and the wire is happening. The other was a similar service but by the banks, so you'd log in directly at your bank to authorize the transfer.

Most other European countries had other local systems that covered this need, but there was nothing global. Globally, your best bet for small amounts is unfortunately likely still PayPal unless your counterparty accepts crypto. For bigger amounts, there is Wise and similar services (note that I've had a horrible experience with Wise - KYC asking for things that didn't exist, luckily before they had my money to hold hostage). Wiring directly to accounts with Revolut also works reasonably well.

For transfers within the Euro zone, a regular SEPA bank transfer is easiest, with the only "downside" that you need to ask for the destination IBAN rather than just a phone number or similar that some of the other systems support.

Global scale is different indeed.

EU scale there are tons of solutions: iDeal (expanding to EU from NL), Klarna, sofort..

> where a website gets a "yes this person is >18" signal, nothing else, from the user's bank.

I am amazed on how this practical solution can't be implemented for age verification instead of all those ID uploads etc.

Looking at the Wero page, it's not very European if 4 countries are listed. I have never heard of it here in Slovakia, and none of our banks are listed, although some belong to the groups that are there. This will be a long process if it really wants to be European.

> the singular reason people have tolerated their horrid service over the years they've been an effective monopoly in many locales.

This is correct. For some reason, many people (merchants surprisingly!) love PayPal and only accept payments through it, especially those outside the US and UK. Sometimes "guest payments" aren't an option, and that means you either get a PayPal account or don't purchase the product/service.

Just delete it. I used to have an account, and my experience using “guest payments” (which are usually, but not always, supported) is generally more reliable than logging in and paying.

I did delete many years ago.

They blocked me claiming suspicious activity occurred in my account (just a low traffic personal account). Ignoring me wanting to know what suspicious activity was it and if it needed, or actually already was, reported to the authorities.

Unluckily this deletion does not hold well, occasionally with weird merchants only offering PayPal payment - credit card through PayPal - the paying fails using my old email used in the purchase and was used with PayPal before. They keep forcing me to log in. But can't! It is deleted!

I did not trust their sloppy ways then, the feeling is stronger now.

Strong digital credentialing—something the web has been surprisingly allergic to.

KYC is just box ticking by the bank, so they can claim to the government that they did try to stop money laundering.

>I'm not sure what a better solution would look like

Federal government provided electronic money accounts and transfer systems, along with federal government provided identity verification APIs, where the fraud requires defrauding the government. Basically, a government utility. They do it with passports, why not with digital travel?

Obviously, this has to go hand in hand with constitutional inalienable rights to protect people's access to electronic money accounts and identity verification.

Amen.

I concur. Thankfully, that's changing and changing very rapidly. I really hope to delete my PayPal account sooner rather than later.

Happened to me with Moneybookers a few years ago. Started getting spam from various casinos at a unique email address. I contacted support and spent a few weeks explaining that, nobody could have gotten this email address unless they were hacked or willingly sold my address. After sending full dumps of the emails and a minor threat to go public with the information, suddenly the spam stopped.

Exactly. They're not leaks, they're sales

The Nordic countries all have bank-backed apps for instant transfers from a checking account indexed by phone numbers. It basically replaces every peer to peer transaction that would be cash in other countries (paying back a friend, buying something at a flea market, chipping in for a gift at the office...)

I would imagine that fraudsters are deterred sometimes.

I think the bank of the consumer is also completely automatically getting the money back. The risk is on the initiator if the payment (=PayPal).

To be fair, Venmo is owned by PayPal...