Perhaps Jeff is referring to ECP’s ACH transactions, not Credit Card transactions.
I don’t know how much you guys know about ACH, but with your permission, I would like to shed some light on how banks authorize ACH transactions before answering the question.
Basically all you need to initiate an ACH deposit is enter your bank routing number, account number and bank’s and your address.
No password, no authontication whatsoever. All banks have different account numbering. Hence
1. there is no way for a processor to determine whether or not the account belongs to the person trying to initiate a deposit
2. not even a way to check if the account exists at all.
At least not in real-time. Only after 7 days one can be 100% sure that the transaction is succesful, provided that there was no decline sent from the bank during this time.
When we first added ACH to ECashPay, we authorized all ACH transactions, and posted declines after we received it. We wanted to add ACH asap, so we started with a simple system.
There were drawbacks: a lot of fraud, and things like Jeff mentions. Those are reasons why now all ACH accounts are first verified by microdeposit, and only then a user can make a deposit or withdrawal. This doesn’t guarantee that the transaction will be rolled back ofcourse, but it decreases the chances of this occuring.
ACH is an alternative to credit cards, but as far as security is concerned its even worse than credit card billing.