From: <yl2200@columbia.edu>
  To  : <cpc@emoglen.law.columbia.edu>
  Date: Sun, 01 May 2005 23:41:30 -0400

paper two

Dear all:

Here is my second paper.
Actually, it's a reaction inspired by the discussion between Prof.
Moglen and Camden.
I would like to know your opinions to my argument.

Yu-Ting Lin

---------------------------

WHO BEAR THE COST OF FRAUD ˇV A STRATEGY TO FORCE VISA & MASTERCARD
TO EMPHASIZE MORE ON THE FRAUD RISK
By Yu-Ting Lin

Professor Moglen once talked about the credit-card fraud and the
weak protection of card numbers.  Camden posed a question that:
since the two main credit associations have already announced the
ˇ§Zero-Fraud Policyˇ¨, then why bother?  But to think further, does
ˇ§zero-fraud protectionˇ¨ truly protect consumers from bearing the
fraud cost or just release VISA and MasterCard from the ongoing
pressure from consumers and government without paying the fraud
bill actually?
In the past few decades, the discussions were focused on the
consumer protection, which was related mostly to the consumer
liability of fraud risk.  TILA is the legislative product of the
concerns of consumer credit protection, limiting consumersˇ¦
liability to a ceiling of $50.  In 2000, Visa and MasterCard took a
step further to announce ˇ§zero-fraud-liabilities protectionˇ¨, and
everyone was satisfied with their generous policy.  Visa &
MasterCard were then released from the consumer groups and
government because there was a consensus that they already took all
the fraud risk.  Nevertheless, I canˇ¦t help but wondering who would
eventually be the last one to bear all the costs.
If we review the structure of credit-card transactions, we would
find that there are two end-users in the credit-card system; the
consumer as the cardholder and the merchant on the other end. 
There are also the intermediary banks and card associations
processing the transactions and charging fees for the services. 
While appreciating the generous policy that VISA and MasterCard
offer, we should at the same time find out who the actual bearer of
the fraud cost is.  Is it Visa and MasterCard, the banks, the
cardholders or the general consumers in the economy?
It is unrealistic to expect credit-card companies to bear the whole
fraud cost while providing zero-fraud-liability to cardholders. 
Thus, how they transfer or distribute the fraud cost would be an
interesting question.  They may recover the cost from cardholders
by raising the annual interest and card-usage related fees. 
However, losing market competition and the pressure from consumers
and related authority will arise if higher rates and fees are
imposed.
What about passing the fraud cost to merchants?  There is a rule in
Visa and MasterCardˇ¦s bylaw, prohibiting merchants from charging
additional fees for using credit-card as payment instrument.  This
provision functions in two ways.  For consumers, when they purchase
with credit-cards, they donˇ¦t have to bear additional cost, though
credit-card is among the most expensive payment instruments, but
benefit from delayed-payment without interest, convenience of
no-need-to-bring-cash, and etc.  Thus, consumers would favor the
use of credit-card while purchasing.  On the other hand, the
merchants are confronted with the customersˇ¦ demand to accept
credit-card transactions even when VISA and MasterCard charge them
high fees for using their services.  Nowadays, the merchants donˇ¦t
have any option but to accept credit-card transactions since
majority of consumers enjoy the convenience of credit-card
payments.  Barred by the ˇ§no-additional-chargeˇ¨ requirement from
VISA and MasterCard, will the merchants passively shoulder the high
service fee for accepting credit-card transaction?  The answer is
negative.  Merchants will raise the price of every items slightly
just enough to cover their cost without attracting consumersˇ¦
complaints.
Consequently, VISA and MasterCard successfully transfer the fraud
cost to the merchant and the merchant in turn transfer the cost to
all customers.  As a result, the general consumers in the economy,
inclusive of people with anti credit-card attitude, bear the
credit-card transaction cost as well as the fraud cost.
 Professor Moglen suggests one solution to provide more protection
to customerˇ¦s card number, to offer the customers the right to
change the card numbers anytime they want.  However, this would
raise the implementation issue of how can we persuade the Visa and
MasterCard to adopt this solution?  To abolish the
ˇ§no-additional-charge provisionˇ¨ through legislation or
regulation might be a practical strategy.
By lifting the bar of imposing additional charge to credit-card
transaction, merchants have the power to set different rules
according to the payment instruments used.  For the credit-card
transaction, if the merchants pay high transaction fee to VISA and
MasterCard, they can charge customers additional fee for making
credit-card payments.  With additional fee charged, those people
who really need to use credit-card as payments or who donˇ¦t mind
paying extra to enjoy the benefits of using credit-card will still
use credit-card as payment instrument, while most people may choose
to pay by cash or check for small amount transactions.  People will
make payment decisions based on the cost and benefit analysis, and
not simply using credit-card as payment with every transaction. 
Confronted with downward sloping usage rate, VISA and MasterCard
may be motivated to devote more efforts to monitor the credit-card
usage and putting more controls on the credit-card fraud.
Furthermore, VISA and MasterCard would be reluctant to transfer the
fraud cost to merchants.  This is because if they do so, the
merchants may transfer the cost to the customers making credit-card
payments.  Visa and MasterCard will in turn eventually suffer from
the loss of credit-card transaction amounts.  Therefore, they would
tend to internalize the fraud cost and would have more incentives to
adopt efficient and effective solutions to reduce the fraud cases,
for example, to offer customers the options to change card number
anytime at request.
There are several approaches VISA and MasterCard can adopt to
control the fraud risk and reduce the fraud cost.  However, under
current provision, credit-card companies may not have motivations
to find solutions, since they can easily transfer the fraud costs
to the merchant without the fear of losing transaction amounts. 
Consequently, all the consumers in the economy bear the cost.
Developing plans to control the fraud problems is the first step
towards a right direction.  But, what we urgently need is to make
another step to figure out a way to force or motivate VISA and
MasterCard to adopt the plans.  In my opinion, abolishing the
ˇ§no-additional-charge provisionˇ¨ through legislation or authority
efforts might be an effective strategy to force VISA and MasterCard
to put more emphasis on this problem and internalize the fraud
cost.


-----------------------------------------------------------------
Computers, Privacy, and the Constitution mailing list