Offline payment specifically allows double-spending. If you have offline payment, you don't need a ledger at all; you can just use PGP.

Even better, when you're back online the network will run a sanity check to protect against the evils of inflation.

(Note: inflation-check fees will vary between 0 and 100% per payee.)

I don't love the law, but having cash on its own is not grounds for seizure. Having expensive goods that you cannot explain how you managed to pay for is what they are targeting, according to your source.

This is basically a law that takes your expensive shit away if you are too stupid to launder your ill-gotten cash.

Add.: another poster suggested that someone had a bit of a laugh with you by saying it, which is also entirely possible. Basic joke.

Wow. What country is/was that?

No.

Swedish here, too.

Your impression is misguided. Maybe it's the norm in Stockholm, but 80% of the population live elsewhere. We do use cash and nobody thinks its suspicious to pay with cash, stop making stuff up.

I have barely used cash in 25 years. This doesn't mean anything at all. You're probably putting this solely in the context of using cash for significantly large purchases, e.g. higher 4 digit sum or above, or as in your example a craftsman who want to exempt it from his or her accounting. Nobody bats an eye at a person buying groceries, or some gadget for a couple of hundred, with cash.

You are spewing complete nonsense.

Here's some perfectly normal stuff I use cash for in sweden on the regular:

- flea markets

- strawberry stand by the road

- unmanned vegetable shop has a cash bin and a pay-for-what-you-take sign

I feel sorry for you and those people.

This is what people think of when someone "uses cash". Not hauling tens of thousands to buy a used car or to settle the bill for having your bathroom tiled, which would be cases I too would raise an eyebrow over.

It didn't have proper two-factor authentication when you just had to tap a button on the smartphone to approve a log-in or a bank transfer (and users didn't always tell which was which). Now it requires reading a QR code — which it should have done all the time.

AFAIK it still does not use any secure key storage on the smartphone, so if your phone gets rooted by an attacker, the attacker could gain access to your bank accounts. So far, frauds have been much easier to pull off, so criminals have not bothered to hack it. (that we know of)

EFTPOS is our national post of sale system, it has very low or no fees for any party involved. Merchants pay a fixed machine rental per month which can include unlimited transactions, or may have a per transaction fee of up to $0.20. Most individuals do not pay a fee for using EFTPOS and there’s normally no card fee, though some banks have accounts with fees that have other benefits (eg higher deposit interest rates to encourage saving).

Contactless goes via the standard card network extortion. Since 2022 the interchange rate has been capped by legislation which has helped merchants a lot, but the per transaction fee over the card network is still far higher than EFTPOS.

Contactless EFTPOS does exist in Australia - we share a lot of the underlying tech - but the banks won’t activate it here because they’d lose the interchange fees.

Online EFTPOS is starting to gain market share though, which is nice.

It is capped at $300 per card used and 200 transactions stored (I believe some large merchants can vary this, but not by much), it’s only for temporary failures not multi-hour outages.

You can quickly find information with your favourite search engine.

Can you use it without local ID/phone and with foreign bank account?

> My company requires me to send it a check for the amount I receive from the government for jury duty

That just sounds like something that shouldn't be allowed. I don't know the rules.

Most of these reasons just sound like fee-issues to me. I use a debit card (or Swish) to pay for everything and there's never a cheaper payment option. The fact that checks somehow cost less to use than debit/credit cards sounds ridiculous tbh, especially with all the added handling that must go into dealing with them (it just seems so inefficient).

- bank transfer

- bank transfer

- cash

- cash

- direct debit

- bank transfer or PAYE

- direct debit

- standing order (recurring bank transfer)

- direct debit

- card

- ? You pay your employer what you were paid for jury service? Bank transfer I guess, but also probably illegal

- would likely be deducted on payslip (because tax & accounting implications of below market value gift) or via a third-party that would most likely accept card

- free

I thought printed papers were all but dead even in the US and can't recall the last time I saw a stand or store where I could buy one. They faded away unceremoniously, like phone booths.

That there is enough money in it to motivate kids to get up in the morning still today I would never have guessed.

Also astonishing are the size and presence of the various fees! Around here a 5 dollar fee for invoicing is the highest I've seen, and it raises eyebrows even among the Mercedes/BMW crowd because everyone knows it doesn't cover any actual additional costs, so it's basically a scam. A way for companies to say "interest free" while still collecting interest.

Charities in Europe very much want an electronic donation, since the cost is far less than handling either cash or cheques. More importantly (I think), it also gives them much more opportunity to get a recurring donation.

Example UK prices (since cheques still exist there)

- Depositing cash, 70p per £100 deposited.

- Depositing cheque, 60p per cheque.

- Receiving one-off electronic payment, 10p.

- Receiving a recurring electronic payment, 4p.

Edit: I've also seen it when paying on the cafe car while on train trips in Spain. Even without any cellphone/internet coverage they'll let you pay, but only with credit.

When a debit card prompts for a PIN, don’t enter it, press submit, and it runs as credit instead of debit, but functionally works the same as far as the card-holder is concerned. It might take slightly longer to settle, and the merchant likely gets charged higher fees, but it works just fine. When I got my first debit card 20+ years ago my bank specifically told me to select credit and using it, instead of using it with the PIN as a debit card.

These days I’ve noticed the systems tend to auto-prompt for the PIN instead of asking credit or debit. But skipping it functionally works the same as pressing credit used to.

I wouldn’t be so sure about that. In some payment situations you’re asked whether you’d like to have the transaction go through as debit or as credit—so those two must be different somewhere. And probably in more than just a bit in a packet, as, for example, paying with debit Visas or MasterCards (normal ones, not Electron resp. Maestro) in the Netherlands (where locals almost universally have credit cards) is something of a crapshoot.

And I guess if one has never seen these, I need to explain. In order to leave an impression on the carbon paper (I should probably explain that, too, huh?), a fair amount of pressure was needed (those old card imprinters didn’t require a gym membership, but a child could not operate one). That rolling pressure would eventually wear on the surface of the card, and turn the numbers white when the outer layer wore through.

IIRC, the merchant gets paid if hitting a credit limit or similar decline reason. The card holder then gets hit with a financial penalty (usurious interest rates, or extra charges). If the card has been stolen, it ends up in a big phonebook-like book for offline use (otherwise the merchant just called it in for big purchases).

If you mean chargebacks: I believe imprinters had card issuer liability for the longest time, at least as long as the transaction was under the (network-defined) "floor limit".

So if these were relatively low value transactions, the bank would simply not have any standing to decline payment.

If you had any interest in any topic you read about on the web or in a book, that was the only way to get things even if you had the money otherwise.

Btw, what typography magazine was it?

I think there was a limit of something like 60 days. At least my bank apparently refused all transactions that were settled too late.

I had a job which involved a lot of taxi trips, and when I cross checked 30% of the trips where never charged my account. I suppose they just filled up the glove box with old slips until they couldn't shut it. Hotels never failed.

Auth before capture doesn’t generally reduce interchange. What it primarily does is shift liability in the event of a dispute. If a chargeback is raised, and no auth happened, then the merchant simply looses immediately. They have no mechanism for fighting the chargeback. If they auth first, and got an approval, then it’s the banks problem in the event of a customer dispute. The merchant can reply to the chargeback by pointing out the valid auth they received from the bank, and the bank has to go pound sand.

You may see this as different “interchange” rates from a specific gateway. But that’s simply not true at the network level. The difference in pricing just exists so the gateways themselves can price in the additional risk associated with auth less captures, given the gateways are always on the hook, even if a merchant goes bust. The major networks force gateways to have funds kept in escrow that are guaranteed to cover any shortfall that might occur due to individual merchant failure, or failure of the gateway itself. That how networks make sure that zero real risk every accrues with them, they make everyone else put up huge stacks of cash to ensure that every virtual cent that’s in flight at any moment, is backed by a real cent in escrow somewhere.

The API call is labelled "sale", but it performs an auth and at the end of the day the system still generates a capture or settlement-style message.

The offline card was from a current account with an overdraft and also worked as a cheque guarantee card, for cheques up to £250 under the (discontinued ~2011) cheque guarantee scheme[0] and had a special hologram on the back. The retailer would watch you sign the cheque and write details about you, the card and any CCTV etc. on the back of the cheque. I imagine the offline behavior of the card was similar, and was a carry over from that.

The online card was from a basic account with no overdraft facility and acted a bit like a prepaid debit card.

[0] https://en.wikipedia.org/wiki/Cheque_guarantee_card

Not just a bit of a shift: Offline-preferred transactions are basically a thing of the past. EU rules have nothing to do with it (offline EMV is fully SCA compliant as well, as the chip can keep count, although it's a bit annoying to keep counters in sync if there's more than one); it's mostly for risk management and simplification reasons, I believe.

> The terminal has the transaction cryptographically signed using symmetric encryption with a private key

Offline transactions essentially always require card authentication as well, which requires asymmetric cryptography. (Otherwise, you could trivially forge valid-looking cards and offline terminals would be none the wise since they obviously don't hold the symmetric keys for every card issued; that would be way too risky).

When offline contactless payments first emerged in the U.K., there was a significant spike in unplanned overdraft usage and disputed transactions, as people rapidly realised it essentially worked as a free line of credit, up to £100 or £250 depending on your issuer.

This quite quickly caused issuers to push up prices on offline transactions, which made them less appealing to merchants - add to that that people were talking about them being a hotbed of fraud, and merchants err away from offering them, PCNs start dropping the capability due to lack of demand, and here we are today.

That said, I still don't think that that's too common – building out cabin Wi-Fi for card authorizations only is probably not worth it, given how hard it is to get away with fraud in an environment where every seat has a passenger name to it, and that name is often verified by the airline or government at the airport or at boarding time.

I didn't try it on an active card, though, and I suppose the problem solves itself by time.

Take a debit card for example. It's connected to a bank account, and cannot give credit. Garmin must be taking some of the risk on board, since the bank or card provider do not.

There's also the fact that anecdotally people are reporting different spend limits. On a thread I saw one person claim that £30 was their limit and another saying "My largest payment so far on the watch has been £275"

My thinking is that in this day and and age, unless something bad really happens (war, volcanic erruption), the chances of using a card for offline transactions for an extended period of time are very close to zero.

it's okay

there's already some fraud, waste, loss, inefficiencies, accidents (packages lost, chargebacks by mistake, package arrives weeks later)

....

that said the chips have some physical protection, it's not trivial to clone them

and the chip has a variable where it stores how much more you can use without online confirmation

of course, these are cheap protective measures, but to crack it you would need more effort probably than the total credit that's assigned for offline spending

Both payment cards and merchant terminals (essentially also using embedded or removable smartcards) are tamper-resistant and hold symmetric keys only known to the payment scheme or issuer.

The terminal essentially creates a cryptographic secure channel between two smartcards, and they transactionally agree to decrement the balance on one, and increment the one on the other correspondingly.

The really neat thing is that this theoretically even works without the need for central accounts, and is as such very privacy friendly. (Practically, even just one key leaking would have catastrophic consequences though, and to detect whether that has happened, systems usually aggregate all transactions asynchronously and check money movements for plausibility.)

They're increasingly common here in Portugal, at least.

Those systems all perform online auths at the gate, they don’t rely on offline transactions at all.

Asymmetric encryption is used to prove the identity of the card itself, I.e. prove it’s a real card owned by a real issuer. But it’s not used to sign the transaction itself.

Transaction cryptograms, the cryptographic blob that’s built using data like transaction amounts, method of customer authentication etc only use symmetric encryption. The produced cryptogram itself is then also signed using an asymmetric key, but the asymmetric and symmetric blobs are distinct entities and processes separately by the card network.

Now this is the really important, and completely non-obvious part. Only the symmetrically encrypted transaction cryptogram is sent over the card network to the issuer. All of the asymmetric parts are only used locally by the terminal for validation, then thrown away. So the data produced by the card that is actually stored and eventually sent to the issuer can’t be used for cryptographic non-repudiation, because there’s no mechanism for the merchant to prove using only the transaction cryptogram, and public keys, that a specific transaction was signed by a specific card issued by a specific issuer.

This may seem very strange from a technical perspective, but only because people think that the technical elements of card networks is what prevents fraud. In reality fraud, at least between network participants, is entirely prevented using legal contracts, escrow accounts, and the simple fact that the benefit of abusing the technical measures to commit fraud is simply not worth the consequences. Being a network participant requires you to put millions of dollars in escrow, and be a large enough company that you can realistically move millions of dollars in transactions everyday. Fraud between companies at that level is solved using very expensive lawyers, the technical measures only need to provide enough evidence of tampering to stand up in a court of law, where everyone is under oath, and at risk of personal repercussions for perjury. There is no need for them to be completely fool proof, it’s much easier to just depose the engineers who were ordered to circumvent the technical controls, under threat of prison time, than it is to get every network participant to adopt some complex cryptographic non-repudiation scheme to protect against scenarios that don’t actually occur in reality.

As for the meantime: I still did have my bank's ID chip with me as a backup, so I could have used online banking to make a transfer to myself with something like Western Union, and crossed my fingers that my bank wouldn't require verification by phone for this suspicious transfer. That would have gotten me some cash at least within the course of the next day, but my friend helped me out, so it didn't come to that.

Without friends around, though, and one or two more unfortunate circumstances piled on, I really don't know. It's unsettling to realize how little it takes to be forced to sleep in the streets.

Though Amex are currently in dispute with the Netherlands who believe the caps do apply to them. I don't think a final judgement has been made yet.

I really hope you're getting paid to pretend to be this gullible to the most basic of the credit-card companies schemes.

Theres still a very good reason to use them - buyer protection.

I use a Virgin Atlantic reward card and have it set to pay off automatically, never running up debt. It both protects me as a buyer, and has the benefit of taking ~£500 off annual family holidays, and gives me a free companion seat in the process, effectively halving the price for one of the passengers.