Unauthorized debit card transactions

Sparx

grumbler wrote: »

What you say - is it a fact or just your thought? I am no expert, but for some reasons I trust wiki more than you:
http://en.wikipedia.org/wiki/Card_Verification_Value

FYI, [4] in the quotation is a link to "Rules for Visa Merchants"

Irrelevant. When you buy content on Steam, you input all of your card details including the CV2, if you let Steam save these details, they exclude the CV2. This is similar to a CPA [continuous payment authority].

You can then buy further content with your saved card details, due to the 1st successful transaction. Similar to Amazon, except they never ask for the CV2 in the first place [slightly worrying].

grumbler

I don't know what 'Steam' is, but I cannot see how some 'Stem' can prove that Visa rules are irrelevant. It's like saying that some speeding driver proves that Highway Code is irrelevant.
Unlike normal purchases a CPA is a special agreement between the customer and the company and the customer has to agree explicitly to this. 'Similar' is a very funny term in this context.

Again, if some 'Steam' process transactions without asking for CVV, it's their business and their risk that they deliberately decided to be exposed to.

Bravehearted_2

Yeah, blame the retailer for the fraud committed by your son.

This is common practice for many online retailers and it doesn't contravene any regulation.

FYI, they don't actually store the cv2 - so your security argument is irrelevant.

Sparx

grumbler wrote: »

I don't know what 'Steam' is, but I cannot see how some 'Stem' can prove that Visa rules are irrelevant. Unlike normal purchases a CPA is a special agreement between the customer and the company and the customer has to agree explicitly to this. 'Similar' is a very funny term in this context.

Again, if some 'Steam' process transactions without asking for CVV, it's their business and their risk that they deliberately decided to be exposed to.

Steam is the online company the OP is having his bank debited by, it was mentioned in the thread earlier. They are an online digital games content provider. People can buy games online and download them instantly, as opposed to going to a shop and buying a physical copy.

The customer has agreed explicitly to this. The OP's son did this when he agreed to Steam's T&Cs and also didn't un-check the "save card details" check box.

Steam has not broken any card scheme rules. They have not saved the CV2. They have only stored the card number and expiry date, this is all they need to have a CPA after the initial successful purchase.

The OP gave permission to the son to use her card, it's her own fault for providing it and not supervising the purchase. The only person the OP can blame is her son, as technically it is fraud.

grumbler

Sparx wrote: »

...The customer has agreed explicitly to this.

To what?
I have online accounts with many companies and many do store my card details. However all, except Amazon, ask me for CVV every time I pay.

The OP's son did this when he agreed to Steam's T&Cs

Care to quote? What you say is correct for "Subscriptions" (“Recurring Payment Subscriptions”), but I have not seen anything in the OP's posts indicating that it really was the case. I have to admit that I missed 'steam' either.

and also didn't un-check the "save card details" check box.

Even if it is the case (I cannot check), no way does this means that they can keep using the details without asking for CVV every time they use them.

IMO, if it wasn't a subscription and if Steam processed the transactions without CVV, the OP can ask the card provider for a chargback on these grounds.

Sparx

grumbler wrote: »

To what?

To the continuous payment authority.

grumbler wrote: »

I have online accounts with many companies and many do store my card details. However all, except Amazon, ask me for CVV every time I pay.

Steam process sales just like Amazon, no CV2 required for the CPA.

grumbler wrote: »

Care to quote? What you say is correct for "Subscriptions" (“Recurring Payment Subscriptions”), but I have not seen anything in the OP's posts indicating that it really was the case. I have to admit that I missed 'steam' either.

As a user of Steam, I'll screenshot how the checkout is displayed. You are agreeing to Steam's 'Subscriber' T&C agreement. The 1st image shows if I had my card details saved, I can just pay by just agreeing each time to the Steam Subscriber agreement and hit Purchase.

Image #1 - http://i48.tinypic.com/j909pi.png [saved card details]
Image #2 - http://i47.tinypic.com/288vyfn.png [new card]

As you can see, you are agreeing to subscribe to Steam's services, with the saved card details.

grumbler wrote: »

Even if it is the case (I cannot check), no way does this means that they can keep using the details without asking for CVV every time they use them.

I don't grasp what you are not understanding, just like Amazon and a few other online etailers, Steam's merchant services agreement allows them to process repeat payments without the CV2.

No card scheme rules [VISA, MasterCard, AMEX, etc] are being broken. Steam have been provided with the card details, they save the card number & expiry date after the initial successful purchase. The customer agrees to their Subscriber agreement and to save the card details. The user then has repeat access to the card they used successfully previously.

I'm not saying I agree with Steam's protocol. As I find this very nerving, it's only a little more secure than Amazon's payment process, who don't ever ask for the CV2! It is quite nerve racking that they are able to do this. I'm just trying to help all understand how you get to this stage.

meer53

What do you hope to achieve by dragging this out ?

The bottom line is, your son has spent your money, the gaming site isn't going to refund you, nor is the card issuer.

A CVV number isn't required for a purchase, lots of online retailers don't ask for it. It will have been taken for the first transaction only, the retailer knows that your card is valid so won't need it again. Your son has bought something and it has been paid for, i'm assuming he'll know not to do it again ?

grumbler

Sparx wrote: »

Image #1 - http://i48.tinypic.com/j909pi.png [saved card details]
Image #2 - http://i47.tinypic.com/288vyfn.png [new card]

As you can see, you are agreeing to subscribe to Steam's services, with the saved card details.

Well, this is something worthwhile that does clarify the situation.

I don't grasp what you are not understanding, just like Amazon and a few other online etailers, Steam's merchant services agreement allows them to process repeat payments without the CV2.

I don't remember agreeing to any 'subscribtions' with Amazon and don't know how they are going to defend themselves should I decide to challenge some transaction with my card provider because they have not asked for the CVV. I don't think that their agreement with Visa will help them, but again, I am no expert.

I'm just trying to help all understand how you get to this stage.

Thanks, you did clear the situation with Steam.

StevieJ

I don't see the point of retailers retaining credit card details.

Although the initial break-in by hackers was thought to be limited to just the Steam forums, Valve boss Gabe Newell has written to all Steam users to admit that it’s a lot more serious than that.

http://metro.co.uk/2011/11/11/credit-card-details-confirmed-stolen-from-steam-216011/

pmartin86

It probably too late for this now, after you having accused them of breaking the law when they haven't and all that, but perhaps a softer approach with steam would have worked. I've been a user of Steam since back in the early days, around 2005, and I have never had any reason to mistrust them or believe thieve acted anything other than fairly. My only time where I accidentally purchased a game I didn't want (Added to basket, changed my mind and forgot to remove it before purchasing another game at the same time) I E-Mailed them explaining the situation They checked that I hadn't activated the game, removed it from my account and give me the value in "credit" towards another game. Certainly not the actions of a company behaving fraudulently, rather the actions of a comany saying "hey, we know you messed up, you know you messed up, but we'll help you out here anyway!"

Regards
Paul