[richardc323]

Sure, there is a trade off, but they have it wrong for online fraud from stolen credit cards.

The three digit CVV code should be a one time passcode (OTP). Banks have been using these since the 1990s for online logins.

Using 90s technology, the card issuer would issue one of these OTP fobs along with the card. It has the card number printed on it, a button and a LCD screen where the OTP is displayed. The CVV is already sent through to the computer that authorises the transaction, the software that checks the CVV would need to be changed.

So we have a trade off of the user having to have a separate thicker card, to fit the battery, for online use.

I just googled, you can get batteries that are 0.4mm X 22mm x 29mm, a credit card is 0.76mm. Eink is old technology now with the right performance characteristics. I suspect in volume using this technology you could integrate the OTP device in the standard card form factor for less than a couple of dollars a card.

So with a bit of innovation the friction of payment / fraud tradeoff goes away.

This all strikes me as fairly obvious to someone designing these things, is there another tradeoff going on here?

[still_grokking]

Banks don't have much initiative for investments in IT security. They have insurances.

That's why IT sec all around banking is just the bare minimum required by regulations.

Those sec-specs are also usually at least one decade behind the state of the art… And they get updated only extremely seldom as this would cause "a lot of paper work" at the banks, so the banks are always against any changes to that regulations; and if something changes finally it takes the banks again at least half a decade to adapt to those changes; they can do it like that as the time windows to comply are usually set to be very long, because you know, it's really a lot of paper work…

[richardc323]

I suspect it is the credit card company rather than the banks that have the power to fix this, but yes the incentives seem wrong.

They have successfully shifted liability for the problem to banks and merchants.

Instead the innovation has gone into things like Paywave which reduces payment friction.

[jokethrowaway]

If each card were a public/private keypair, you could sign a message authorising a payment of X amount at current time, in zero knowledge, without leaking your secret (the credit card number) in every transaction.

Add two factor authentication, if you want, but fix the underlying giant issue first.

[richardc323]

This would be more secure than what I proposed, but requires changes that are out of the control of the credit card companies.

For the card to sign the transaction, you need to add some kind of card interface to the users device. Maybe this is what happens with chip cards when you use it at a shop with a card terminal.

[skybrian]

I have memorized the CVV for one card I use, and the rest is saved in the browser. So, having to actually get out the credit card would be adding a minor inconvenience. That doesn't matter too much for me, but it probably does mean many millions in revenue for retailers.