{"id":1848,"date":"2016-01-15T01:02:28","date_gmt":"2016-01-14T23:02:28","guid":{"rendered":"http:\/\/www.greenman.co.za\/blog\/?p=1848"},"modified":"2016-01-15T01:13:04","modified_gmt":"2016-01-14T23:13:04","slug":"trust-us-were-a-payment-gateway","status":"publish","type":"post","link":"https:\/\/www.greenman.co.za\/blog\/?p=1848","title":{"rendered":"Trust Us, We’re a Payment Gateway"},"content":{"rendered":"

\"\"<\/p>\n

A friend told me today about an experience of attempting to book a flight on kulula.com<\/a>. His credit card wasn’t working, but there was an option for bank transfer (EFT), so he chose that.<\/p>\n

The EFT option used SID<\/a>, a payment option promising secure EFT transactions. All good so far, so he followed the link.<\/p>\n

The SID window asked him to enter his bank account login details… You know, the kind you’re constantly warned about to never give to anyone and never to enter on any other site except your banks.<\/p>\n

I couldn’t believe that this is actually what happened (perhaps the friend had missed his morning coffee), so I checked it for myself. Looking into SID’s documentation, they claim to be externally verified, not to store the login details, and to use the bank’s own security system. But yes, you are asked to enter your bank account login details in their window.<\/p>\n

I’ve got no reason to doubt that SID does what it says, but the methodology seems hopelessly flawed.<\/p>\n

Let’s say I start a new payment system called SAD. At the same time I launch my casino website, relying on trusted SAD security. I state clearly that SAD uses the bank’s own security systems, and doesn’t store any of the login credentials. Totally secure!<\/p>\n

The transaction succeeds, and the customer has a credit to spend on my casino site. They spend many happy hours on my casino website, winning up a storm, and dreaming of their new Tesla. For some reason the cashout option isn’t working today, but check back soon…<\/p>\n

Some time later, they decide to check their bank balance, and find, to their horror, it’s all gone. They immediately phone their bank. Perhaps the conversation goes something like this:<\/p>\n

HORRIFIED CUSTOMER: There’s a transaction clearing out my entire balance! It wasn’t me! The transaction needs to be reversed!<\/p>\n

BANK: Hmm, our records indicate you logged in from internet banking, and transferred the money out. When was the last time you remember logging in?<\/p>\n

HC: Er, I logged in to winbigbillionscasino.com and made a R50 transfer to their account from my bank account, using the safe and secure SAD system.<\/p>\n

BANK: OK, no problem, we’re refunding the money now, apologies for the mistake.<\/p>\n

Or perhaps not…<\/p>\n

Perhaps the bank, in their charming and professional manner, laughs you off the phone and tells you you’re and idiot for giving your login details to another site.<\/p>\n

Merchants asking customers to trust them, assuring them that their bank details are secure, is a recipe for disaster. Just don’t do it.<\/p>\n

Related posts:<\/p>\n