5 ms·
Wait, am I getting it right you're talking about collecting a prospective customer's card number and CVC over the phone, and then typing it yourself in a third
by vntok 1mo ago
Wait, am I getting it right you're talking about collecting a prospective customer's card number and CVC over the phone, and then typing it yourself in a third party system?
Then it's trivial to settle: that's the big bad PCI DSS violation mouthful, so two to three things will happen. One, the customer's bank will reimburse them as soon as they complain that they have not authorized the fraudulent transaction that appears on their account. Product being sent, received, sent back, etc has no bearing on this. Two, you will be audited, fined $xx,xxx monthly and/or perhaps even get banned from the PSP layer. Again, sending real products has no bearing in this. Three, well the customer's own bank will be in touch pretty soon with yours to "settle things", as banks don't particularly like to advance reimbursements to their clients for fraudulent transactions. Hope you weren't using your own bank as a PSP as they kept receipts of everything you were doing (they just weren't looking until now).
- wpietri 1mo agoWe're not talking about fraud, we're talking about telemarketing. The case you describe is correct for fraud, but doesn't need any new law making "void and nulls contracts made by phone". That being epolanski's proposed fix for telemarketing.
- vntok 1mo agoWell you were the one talking about "If I get a card number, type it into my POS system, collect money". A PCI DSS violation is indistinguisable from fraud. If you collect random credit card numbers and then transact on them, you'll be harshly punished. Actually providing a service on the side of the fraud does not make the fraud disappear. The proposed fix to make contracts established over inbound calls void is useful as a guide for the public to clearly know their rights. And if a company still chooses to collect a payment over the phone, now that's not only a PCI DSS violation but also a theft because money changed hands from an individual to a company without a valid contract.
- wpietri 1mo agoI was talking about it in the context of a conversation with someone else, one easily available to you. It is frustrating to have someone not only give an irrelevant reply but then double down on the misunderstanding.