Homebase are bastards

Actually I would have been perfectly happy with that arrangement, but I can see that other people might not have been.

Of course, that was my point. It was an example of the type of fraud which could be avoided by forcing refunds to go to a customer's card.

Well, walking out of the store with a trolley full of goods and no receipt would be a great deal more risky than having a receipt "proving" the goods had been paid for with cash. It seems easy enough to process a refund through a till while no-one's looking because they're all busy doing the same thing, in other words it's not necessarily as open as you think, it's easy to do surreptitiously. If no-one actually performs thorough checking to make sure every processed refund actually corresponds to an item in the pile of returned goods, which are likely all just to go to the bargain basement, this could be very tempting for the refunds staff.

OK, I guess that's a fair point. But I'm still not convinced that's the reason why they have the system in the first place. I still think it's far more likely that their IT staff are a bunch of fuckwits who don't have the wit to design a system that makes things easier for the customers while maintaining reasonable levels of security.

Adam

Perhaps you could smooth talk your way into the job!

It's the sort of thing that tends to get left out, because no-one actually thought to put it in the spec they gave to the designers.

Mark

As a general principle, refunds on card payments do have to go back to the card rather than being made via some other method (such as cash or cheques). That's a rule imposed by the card companies, who usually cite the money laundering regulations as a reason for it (as it stops someone buying things with a stolen card, then getting a cash refund after the card stops working, thus ending up with untraceable cash and no awkward goods to have to store and/or fence).

The issue here, though, is whether an exchange counts as a refund. This is a separate matter, and the card companies certainly don't insist that an exchange must be treated as a refund and new purchase. That's the retailer's decision, and not all of them do. It's not necessarily even the case that Homebase do - we've assumed that they do, as we can't see any other reason why they might need the original card in order to process an exchange, but they could well have some obscure reason of their own that hasn't occurred to us. But whatever the reason, it's their reason, not one that's imposed on them by a third party.

Mark

At 11:10:23 on 02/01/2008, snipped-for-privacy@gmail.com delighted uk.finance by announcing:

Yes. The refund transaction needs to be authorised in the same way.

"Alex" wrote

I've always wondered - why do they need the customer to sign / enter PIN for a refund, anyway?

You can understand needing authorisation to 'debit' a card, but what's the point in getting the customer's authority (signature or PIN) to put the money back?! [Surely it should be the shop, not the customer, giving authorisation for the refund...]

At 11:59:04 on 03/01/2008, Tim delighted uk.finance by announcing:

Money laundering regulations, presumably.

"Alex" wrote

Eh? How can putting money back to *exactly* where it first came from, be money laundering?

It wouldn't have been "laundered" at all!

Quite. Try this instead:

Think of the bank account as being like a strongbox without a coin slot such as you might find in a piggy-bank. You need to unlock and open it not just if you want to take stuff out but also when putting it in. The PIN does the unlocking.

"Ronald Raygun" wrote

Ah, but a credit/debit card is more like the strongbox *with* the piggy-bank-style coin slot : ... you don't need to unlock it to put money back!

For instance, a merchant can refund your card through PayPal *without* your express authorisation. How do they do that, if there is no "coin slot"?

At 14:18:34 on 03/01/2008, Tim delighted uk.finance by announcing:

CNP transactions don't require the cardholder to sign or enter their PIN, for obvious reasons. Merchants performing these transactions have alternative processes to follow.

"Alex" wrote

Yes, of course, but that still leaves the question as to *why* those "alternative processes" require the customer to 'authorise' a refund. The CNP example that I gave simply shows that Ronald's "slotless strongbox requiring unlocking" idea is invalid.

So - what *is* the reason for needing the customer's signature / PIN for a refund (ie, why is that requirement within the "alternative processes" that you mentioned)? [We can see (above) that "money laundering" isn't valid...]

At 10:13:31 on 04/01/2008, Tim delighted uk.finance by announcing:

How can you see that "money laundering" isn't valid? How does the card (or issuer) know that the money being put back is the same money that was taken out?

"Alex" wrote

Well, Ronald agreed with my comment that "It wouldn't have been 'laundered' at all!" when he said "Quite" above - and he's a clued-up kinda guy...

"Alex" wrote

Eh? "Money" in this context is just numbers in computers, after all!

Anyway, to throw your own question back at you, how would "... the card (or issuer) know that the money being put back is the same money that was taken out...", if it was a *CNP* transaction, and the customer didn't give a signature / PIN?

If a refund *could* constitute money laundering, wouldn't that mean that it's OK to money launder with CNP transactions? :-(

At 11:39:32 on 04/01/2008, Tim delighted uk.finance by announcing:

Money in virtually every context these days is just numbers in computers. I'm not sure how that's relevant.

To clarify a little further, I'll add that *reversals* require no cardholder authorisation.

My idea is not necessarily invalid. After all, I'm "a clued-up kinda guy" (you're so kind)!

Your example doesn't really clobber my idea. We could just say that CNP uses a separate "private" slot (or back door) to gain access.

"Ronald Raygun" wrote

Hmmm. CNP appears to be much more "public" than CP - why would that less secure system (CNP) have a special key to a 'back door', without the more secure systems also having access to it...?