My 8 year old just bought a £150 app on our ipad!

WTFH

albionrovers wrote: »

Again, then why the Apple refund?

Because of the amount of bad publicity - some people on here believe that Apple have been fined in the UK by the ombudsman for this, but that's not the case. They are trying to prevent misinformation being spread and get a bit of good publicity out there about them. I doubt some on here would ever believe that, though.

warehouse

isofa wrote: »

I think Apple have been very fair, it's a flawed system, but perhaps not letting kids loose without properly locking things down would help.

They have been fair, and I have my refund. Perhaps Apple setting the defaults to a little more secure setting would be better and prevent such issue for others would be a good way forward. All they need to do is confirm the registered card security number, it's really as easy as that, but they don't. Why not?

warehouse

kronenbourg wrote: »

everyone is jumping on the 'it was my childs fault ' bandwagon these daysi dont have any sympathy for anyone irresponsible to let there child loose on an ipad or any other internet enabled device unsupervised
you hear it all the time and then they have the cheek to blame apple or google or whoever except themselves
any parent who does this should have they apple account suspended , then see how many kids are blamed

I think you have this wrong, it's quite clearly Apples default settings and card storage policy that is the issue here.

Apologies for not being as perfect as you.

warehouse

WTFH wrote: »

I don't agree with it either - but it is the standard MSE line.

I do have an issue with children using devices not meant for them (this is not a dig at you in particular), and think that Apple would make life easier for themselves if they only sold the product to responsible adults. Make the iPhone & iPad over 18s only and make sure that the AppleID belongs to the bill payer.
If the kids want something to play games on, get them a Samsung or a Nintendo.

We took the kids on a 4 hour flight last Summer, this is when these devices come into their own. Everyone assumes that it's just games played on them, but they are a great resource for learning, for movies and music. More schools have ipads and the educational apps you can get are exceptional.

With some of the horrific spelling and grammar I see throughout MSE maybe more people should be purchasing "learn to spell" apps?

warehouse

Come on, what's the matter with you lot. I haven't been accused of...

Being a bad parent
Leaving my kids exposed to all sorts
Having fat kids
Causing global warming

...for at least 20 minutes. Has the internet broken?

albionrovers

I hear whispering ....

WTFH

warehouse wrote: »

Come on, what's the matter with you lot. I haven't been accused of...

Causing global warming

...for at least 20 minutes. Has the internet broken?

Daily Mail readers believe that climate change is a myth created by scientists and other lefties.

Are you a bad parent to fat kids?
Have HOUSE PRICES in your street gone down since you moved in?
Are you FOREIGN, or do you know anyone who is foreign?
Do you think there are BENEFITS in owning an iPhone?

warehouse

WTFH wrote: »

Daily Mail readers believe that climate change is a myth created by scientists and other lefties.

I was in Poland on Monday, (no, not a cheap laborer undercutting honest British workers visiting home), and the snow has only just started. They are saying that the snow is coming later every year now, and that this year it is so late that they are sure something is up with the climate.

securityguy

warehouse wrote: »

By default card AND security number details are stored ready for use next time, .

Storing the CV2 (the three digit, four digit on Amex, security code) is absolutely forbidden under all circumstances by payment industry compliance rules. You're not even allowed to put them to disk temporarily while processing the transaction: if a merchant puts the CV2 anywhere other than RAM while processing transactions and get caught doing so, they are at serious risk of either losing their ability to take cards or being forced to accept substantial additional costs in doing so.

What happens in fact is that the first time you make a purchase, the merchant (here Apple) passes over the whole bundle of identifying information, including the CV2 and (in some cases) your address. They get back an approval from the card issuer. The merchant is taking a fairly small risk on the card being fraudulent: their merchant agreement will say "provided you pass us the full bundle, we'll indemnify you against the card being stolen".

Thereafter, the merchant can (at their choice, risk and agreement with their card processor) simply charge further transactions to the card without passing all the extra information over. They know that user xyz used card 1234 successfully to deliver stuff to 1, Second St, Third Town and didn't get a chargeback raised, so it's a reasonable risk to let them do it again. They don't get the same indemnity from the issuer, so if it goes wrong it's more of the merchant's risk.

But most merchants will have statistics for the "abandoned carts" problem (how often people put stuff in their trolley and then leave the website without paying), and will reckon the small risk of being caught by a user contesting the payment is worth it to get people who completely want to buy, but don't have their card with them, or are in a hurry, or give up because of the 46 screens it takes to provide all the information are too boring. So they take the risk on accepting payment without the CV2 in order to smooth the order process. For most people, that's the right trade off.

Personally, although I know my machines are nailed down a lot harder than the typical system, and I check certificates with a trained eye, I still find typing the CV2 into a web page pretty scary. There is _much_ more risk for most people in providing the CV2 for each transaction than allowing the above process to happen.

securityguy

warehouse wrote: »

They have been fair, and I have my refund. Perhaps Apple setting the defaults to a little more secure setting would be better and prevent such issue for others would be a good way forward. All they need to do is confirm the registered card security number, it's really as easy as that, but they don't. Why not?

Because any reasonable security risk assessment would conclude that the problems they open up by processing the CV2 on every transaction are substantially greater than using the non-CV2 path, and that by forcing people to type the CV2 code each time they will lose far more sales than the small saving in fraud pay-outs. So handling the CV2 on every transaction is lose/lose: it increases risk, and reduces sales.

It's like the issue of being able to get through 20 quids' worth of payments on Paywave/Contactless without needing to supply a PIN. Not having to type the PIN into an untrusted device, while potentially being watched by a camera, in order to buy a cup of coffee is a good thing.