A default is also a decision
A small card fraud, read with a risk analyst's eyes. Whoever doesn't take on a risk shouldn't make it the customer's default.
Today, by chance, my wife was hit by fraud on her Nubank virtual card. About 300 reais in five transactions to some generic Uber Eats account, in under twenty minutes. Even after we blocked the card, we kept getting notified of new attempts.
What caught my attention is that the fraud happened on the virtual card, through the debit function, with no PIN. For us the impact was small: bad, but manageable. But it worried me to find so many similar complaints about online debit transactions without a PIN on virtual cards.
In what world is it reasonable to leave a virtual card open to debit payments without a PIN? Is that a feature or a bug? Is it too much to ask for a lower-risk default, instead of enabling every new virtual card as “debit and credit, no PIN”, with no option to turn debit off?
A debit transaction isn’t as simple to reverse as a credit one, especially for spending whose pattern is hard to recognize, like delivery apps.
If the company doesn’t take on the risk of a fraudulent debit transaction, it’s counterintuitive to make that risk the customer’s default. Every default is a decision about who carries the risk.