Tag: Payment Cards

Country You Go, Banking You Find

If you have been following this blog for a long enough time, you probably know I “enjoy” writing about banks, or at least I end up doing that quite a lot, whether I enjoy it or not. Part of that it’s because I still find myself reason about money the way I did when I had my own company, and part of that because, well, I have opinions of what good banking looks like to me. Part of the reason why I have that opinion, is that I have seen a lot of what good banking is not, and it gives me material to keep writing.

Of course, I’m also lucky because I have at this point seen how banking works (or fails to) in multiple countries, and I can at least compare the point of view of an user in those contexts. I don’t have any idea how this works from the other side of the fence of course, as I have (thankfully) never worked for a financial institution. Not that I haven’t considered that (hey, I live in London after all), but then I remember that I would probably be finding that things are even more screwed up than I can see from the outside, and decide to put my savings into gold bullions — as it stands, I just keep getting depressed by everything tech, and been considering turning to opening a coffee store and bakery.

And I do mean it, when I say that different countries have… pretty much nothing in common when it comes to banks and banking — costs, services, expected behaviour and contacts. Some of it appears to be so entrenched culturally, that suggesting changing something would be probably considered heresy.

Italy

In Italy it is (or at least was) common for current accounts to have a monthly fee, although somewhat nominal, and this usually doesn’t include much more than a bank card. I used to have a cheques book — but only because at the time, my family used to use those for a lot of things. I think I only ever used once, and I’m not remembering what for.

Outbound wires were expensive back when I was using them, raising in price over time, and differed whether I would be wiring to the same bank or to a different one. Cashing in cheques was free, as long as they were in the same currency, while receiving inbound wires depended on both currency and source of the wire — when I was a contractor working for Google on ChromeOS, the invoice payments arrived in dollars, but from within Europe, and they didn’t cost me enough “to notice”; when I received the payments from another customer, they dropped hundreds of euro on the bank’s coffers — which is why I am happy that TransferWise exists now.

While Italy had early federated ATMs that allows you to access your money at any time, there is one thing that I have noticed is not common elsewhere: accessing ATMs outside of your bank’s own is generally a paid option. And I don’t mean that in the USA sense (that I’ll get to later) of ATMs that charge you a fee to use them — I mean that the bank will charge you a fee to use an ATM of a competitor. This got to the ironic part where, when visiting Italy after moving to Dublin, it was cheaper for me to use an Irish debit card to get some cash out of a machine, because my Italian bank didn’t have any ATM in an easily-reachable place for me to use. This might be annoying to me, but it’s a significant pain for people like my mother who don’t drive, and that need to be driven to another town to find a free machine.

Another interesting note about Italian bank cards is that, up until very recently, were not usable online. I think nowadays most banks have at least a paid option to give you a normal Visa or MasterCard debit card, but for a long time you ended up with cards that couldn’t be used online at all — even when they had 19 digits on them for the Maestro circuit. Indeed, back when I hit these issues I did ask whether I should have gotten a VPay (Visa’s answer to Maestro, before Visa Debit), but I was told that that would have been less accepted in Italy itself.

Credit cards are still uncommon — before bank cards could be used online, the vast majority of people I knew who made purchases on eBay would be using pre-paid cards (Visa Electron or MasterCard Debit), that you topped up for a fee. The most common one at least back then was issued by the Italian post (Poste Italiane), under the name PostePay — it was also one of the biggest scam targets for many, as many eBay sellers would pretend that the PostePay logo appearing on the announcements meant that they would pay directly to a pre-paid card, rather than through PayPal – a great scam, since eBay can’t see the money changing hands, and won’t protect you from fraudsters. At least they seem to have abandoned chip’n’sign.

On the other hand, direct debits have been a thing for a long while… although that became an issue when SEPA Direct Debit became a thing. Indeed, the old Italian direct debit system was advanced enough (and similar enough to the SEPA DD Core specifications) that it appears most banks and operators just re-used the same infrastructure, just changing the size of the fields used as parameters. This worked well as long as you were not trying something as silly as direct-debiting an Italian utility to an Irish bank account or vice-versa. And I know that because I tried.

To be honest, though, not everyone is using direct debits still. Before my parents split up and I started being the one paying for the bills, my father insisted on not using direct debits at all, and instead paid the bills at the post office — and since a number of times the bills arrived past due, we ended up paying quite a lot of money in interests. The pay-to-the-post-office thing is also a fairly standard concept of Italian culture, at least up to the ’90s. I don’t think any of my age-peers are doing that anymore, particularly because post offices are pain to get to: in many town you can only get to them in the morning, and not over the weekend.

Indeed we got to the point that a lot of banks offer (or at least used to offer) a postal payment service so you could put in your request for a postal payment online… and then receive the paper receipt by snail mail, because what they pretty much did was forwarding the request to a local post office, with batch-printed money order forms!

Ireland

Given the fact that Ireland is part of the EU, and thus SEPA, you may think that things are mostly the same between Ireland and Italy. You would be wrong.

First of all, bank accounts in Ireland are a mess to choose from, because none provides any decent service. The one account I was given when I landed, through Google on AIB, was one of the most commonly used one, and required €2500 in the account at every single day of the quarter, or otherwise it would charge you for each operation you took… including received wires. Note that this is a daily minimum and not an average-over-the-quarter, like the equivalent would be in Italy. And goes without saying that it’s a no-interests account, so you need to put some money “to sleep” to avoid being charged through the nose.

The last account I settled on was an Ulster Bank premium service account at €36/month. It actually paid for itself in terms of a lot less time spent dealing with straightening things out (after a horrible situation with KBC, I really wanted someone that could do that stuff for me). And it came with a secondary Sterling account (via Ulster Bank Northern Ireland — I still have that account!), as well as a savings account and credit card.

Thankfully, Ireland abandoned the country-limited bank card system called Laser before I immigrated, in favour of using more standard Visa Debit cards. With the exception of KBC that, as far as I know, was the only issuer of MasterCard Debit bank cards. A number of other non-bank services issued MasterCard Debit cards: Revolut, Curve, and An Post’s money exchange services — the latter being ironic given that An Post was the only place I knew of that did not accept MasterCard Debit cards, only Visa Debit.

As far as I know, none of the big banks issue bank cards that have fees to take money out of a non-bank-owned ATM, to the point that I never bothered to go anywhere else but the two Spar supermarkets around my place, when I needed cash.

Direct debit is the norm, although some system of postal payment is still present, and a number of bills would have the details printed on the bottom. Ironically, it’s because of that, that once I leaked my own credit card number. Overall, the Irish banking system appears to me fairly straightforward, with most payment being executed electronically, and widespread card acceptance.

An interesting note about direct debits is that, despite nominally being part of the SEPA Direct Debit Core system, they appear to be vastly region-locked. I had to threaten Tesco Bank (before they sold their business to AvantCard) to bring it up with the regulator when they refused to let me direct debit an account with a non-Irish IBAN, and Ulster Bank (Ireland) didn’t budge even then. A few of the utilities, also, appear to still be unable to change the direct debit dynamicall: you instead choose how much you want to pay, and then they will issue you a statement to show how much in credit/debit you are.

What I would say is still Ireland’s biggest problem when it comes to banking is the lack of competition. It’s the reason why Revolut actually works well there: there is no high-street competition and those who are used to different level of service will go straight to FinTech offers. My impression is that the reason for the lack of competition is that it relates to the way folks stick to the bank their parents used, something that I have encountered in Italy a lot as well.

England

I nearly titled this section United Kingdom, but then I realized that there are a few things that don’t quite work the same way throughout the country. Which is something that became very apparent when I transfered from Dublin to London: in the Workday interface, when it asked me for a “UK bank account”, I provided an Ulster Bank (NI) account number, and that had me wait for another two weeks (with a roundtrip to payroll to change my account on file), because Northern Irish bank accounts are not compatible with most English payment systems, it appears.

On the bright side, the competition between banks is fierce, although there are a number of “branded” accounts that consumers don’t always notice are operated by the same institution. There are also free-by-mandate bank accounts made available by a number of well-known banks, although that is becoming an increasingly limited space.

In my experience, this is one of the most consumer-friendly banking system, with payments between accounts, whether private or business, being free or nearly free, and direct debits being ubiquitous. The best of all is that so-called “Faster Payments” transfers appear on the credited accounts nearly instantaneously, in a matter of minutes if not seconds, without any surcharge. Italy does have similar fast payments, but in their case, it usually comes at an additional cost.

Otherwise, the English system looks a lot like the Irish one, at least for now. Bank cards are issued usually on the VISA network, although I know of at least one bank issuing Mastercard debit cards. More recent ones stopped providing the embossed digits for the fully-offline usage, which is fair as the only place that I saw using those in the past few years has been a hotel in Tokyo.

Credit cards are an intersting story here. They are not expensive, honestly, but they are very, shall we say, selective. If you just moved into the country, you’re not going to get a credit card for a number of months, which is again similar to Ireland, although I did manage to get one relatively fast with American Express (which, of course, is not cheap by itself). Once you’re allowed to get a card, the price of it is usually recovered by cashback. Or you may choose to get one of the cards that cost nothing but don’t get a cashback at all. Personally, I decided to get two cards: Santander’s with generic cashback, and Amazon’s (by NewDay) with Amazon-only, points-based cashback; the former is paid back by the regular payments we have on it, and the latter was free, and adds up a few scores of pounds a year.

Compared to the time I spent there, the one thing that England appears to have that Ireland missed (and, as far as I know, so does Northern Ireland), is the concept of “retailer offers”. For those unaware of these, many banks include “selected offers” with their bank accounts or credit cards, which you usually need to explicitly opt into. The way you do that, is usually through their normal mobile banking app (or website), although I think a couple of banks have separate apps for those.

These offers are usually in the form of anything between 2% and 10% cashback for purchases over a certain amount up to a maximum. Depending on the bank, these are offered either in actual cash, additional “points”, or separate “rewards balance”. This is where things get interesting and complicated, because you end up having to keep in mind which card/account has a certain offer, and you end up then deciding which one to use to pay at a certain place depending on that.

To make the calculation more complicated, the rules are also different between these. My bank (Santander) has a single set of offers on the account, which applies to debit and credit cards alike. And if the offer is for “one-time”, it is consumed as soon as either me or my wife use the card for an eligible transaction. On the other hand, American Express applies the offers on the card, so both of us need to check our app for valid offers, and one-time offers can be used once per card (very useful for offers that instead of a percentage, give you back a fixed amount, like the yearly “Shop Small” week — fun fact: in the beforetimes, it confused a lot of waiters when we would decide to split the bill, particularly when our wedding rings are clearly visible). But at the same time, the banks’ offers can be combined with Airtime Rewards, so you win some, lose some.

Direct debits are another area that includes some calculation space, and some similarities with Ireland. The number of utilities using fixed direct debits is significantly lower, but it’s not entirely uncommon either. On the other hand, a few banks (including Santander) do apply cashback to (certain) direct debits. Or they may decide to give you perks as long as you have direct debits set up. This provides a gameable system: particularly when accounts suggest you can get perks as long as you have two direct debits, you can take a look at your periodic payments and, if they do allow PayPal, you can use then turn a periodic payment into a direct debit. For instance, you may have Spotify and Netflix as those direct debits.

My short version of an impression of the English banking system is of one that is perfect if you are a fan of strategy games or RPGs where you can spend a day just calculating the possible weapon/armor/enhancement combos. You can then decide to squeeze all possible combining offers, get the best exchange rate for each purchase, and so on. If you are not into these trickeries and calculations, well, you can still get a pretty much no frills account and be happy knowing that they are not really mugging you of a lot of money.

What is possibly the most annoying thing, is that the security of logging into the online banking options is fairly horrible. England (and Ireland too) is the home of “Please give us your 3rd, 7th, 38th character of your password” requests, which are horrible security theatre, and add nothing in terms of security, since transparent phishing proxies are not uncommon at all.

United States

For this country, I only have a passing knowledge of the banking system, since I have never lived there proper, but I do have a bank account, so I have experienced some of the workflows, and I can compare notes with a few people I know that have lived there.

The first thing everybody will tell you about US banking system, is that it still heavily relies on paper cheques. Yes, the same cheques that had the main spotlight in movies such as Catch Me If You Can (which in my opinion is a great movie, by the way). What has changed since the time of that movie is that there’s a lot of “virtual process” around cheques in the USA, something that I don’t think other countries have done, for good or bad.

So for instance, I have received myself a few US cheques (mostly as rebates for goods I bought in the USA); to cash them I didn’t have to wait for my next trip to the country: my bank (Chase) allows me to scan the cheques front and back with their mobile phone app and they consider that good enough that I don’t have to present the original to any one at all. I could literally take the cheques and frame them, if they had an emotional meaning for me (they don’t, and I didn’t). And I’m told that on the other hand, you can ask your bank to print out a cheque for you via their online banking, and they will post it out for you just fine. I’m sometimes scared by this strange paradox of still using cheques, but beside being reminded of the William Gibson quote («The future is already here, it’s just not very evenly distributed»), I can only shake my head and thank the luck that “my” banking system doesn’t require me to deal with this.

Electronic payment in stores appear to be also unevenly distributed. While I had no issue with paying by card in most places I’ve been to, in either California, Pittsburgh, or New York, there appears to be still a lot of services that are cash only. One of them, ironically, in Mountain View: Dana Street Coffee Roaster serves really good coffee, but I don’t usually keep cash at hand (except if I’m going to The New Mongolian Barbeque), which is why I usually just hang out at Red Rock unless I’m with a local.

There is also the elephant in the room, that only recently the United States have introduced chip-and-pin for points of sale around the country, and the last time I was there, a lot of them still didn’t support it. The reason for that appears to be related to the way point of sale devices are handled in the USA, where a lot of vendors actually bought the terminals, rather than renting them from a bank or payment processor. This is unlike Europe, where as far as I know, most banks will sign you up as a customers and provide you a leased terminal, which they take responsibility for updating and replacing as needed, which allowed the deployment of new technologies such as chip cards (with either PIN or signature) and NFC payments in a much shorter order than across the pond.

Payments, particularly consumer to consumer, are a mess. The whole concept of direct bank transfers is not something you can consider in the USA, with wire transfers costing $25 at both ends of the transaction (depending on banks and other rules). This may give a bit of context on why Silicon Valley appears to want to reinvent payments every year, with new methods to “attach money” through all kind of messaging platforms, and why people still attach themselves at the idea of bitcoin solving problems related to instantaneous transfers among peers.

On the other hand, online banking systems appear to be a lot more sensible when it comes to login security than European banks. Chase even supports proper password managers in their login both on the website and on the mobile app, which is unheard of in the countries I lived in here in Europe. And they even will use email for OTP rather than the silly SMS. It also appears that retailer offers exist in the USA as well. Chase is always trying to sell me a Dropbox subscription, with a 15% off (and TurboTax, although I don’t actually owe taxes in the US so that would not be particularly useful).

Conclusions

This is by no means a complete and detailed comparisons of all these banking systems. It is most definitely biased and partial, particularly given, as I said, I have not lived in the United States, but only experience it as a passerby.

I have not covered the different credit score systems of these countries (among other things because I do not have a credit score in the USA at all), nor I have talked about how to get loan or mortgages (the latter of which, I never tried getting anyway). All of these are extremely important components of a banking system and they, more than the services to consumers, should be considered when debating its health.

I just find this particular field interesting, and I think that reading more about other countries banking systems might get people to pay more attention to the horrible technological solutions they come up with. Nobody cares about cryptocurrencies for money transmission in Europe because SEPA means you can transfer money for fees that are pretty much nothing by comparison with your average crypto transaction. Noone had more than a passing interest in “attaching money to Gmail” outside of the USA.

I honestly open that in the future I’ll get to know more banking systems. It would mean indeed moving again, but I think it would be interesting to see different parts of the world, too.

Curve is giving “free” money away, again.

About a year and a half ago, I reviewed the Curve debit card, and I went back talking about it when talking about foreign transaction fees. If you don’t want to go back and read the whole set of text, I’ll give a very brief description: Curve is a proxy-card, that allows you to connect a bunch of other debit and credit cards, and to decide when you pay (or, critically, shortly after) which card you want to charge your expense to. It includes a few features such as some amount of free (or cheaper) transaction fee spend, but the “proxy” nature of the card is the selling (or not-really-selling as I’ll explain later) point.

In my previous posts, I have made two main points about Curve: the first is that they give away for free most of the useful features of the service, and the other that they make no real sense in the UK, as one of the possibly biggest selling points (the foreign transaction free nullification) is vastly irrelevant: most high street banks have some offering with no foreign transaction fee, and I still venture that Santander is the best UK offering for globetrotters who need to use their card in many different currencies. Despite my fairy pessimistic view of Curve’s business plans, it seems like the management is taking a different view — even FT Alphaville wrote about their marketing campaign.

Speaking of pessimistic view — I am a bit skeptical about their marketing of “100 Cards in One”. While it would be a great feature a few years ago, in 2019 most of my spending goes through my phone, with Google Pay. While I have half a dozen separate cards, most of them are compatible with Google Pay, so I don’t carry them with me. The ironic exception being my company card. As it turns out, this is something that Curve can help with: it now supports Google Pay, and on a business trip I can proxy my expenses to the company card.

Now, one claim on their website that appears to mostly hold true is «Your gateway to money for nothing.» Because they do appear to run lots of promotions that give you free money. Indeed, in the past week I received two email from Curve: one to announce that they would give me £5 if I just used my card at all (which I did, just to see if they pay up), and another to tell me that they are giving a “Christmas gift” for all their users to select three new retailers to get their 1% cashback from. All of this for a “Curve Blue”, which is their totally free tier.

Speaking of the 1% cashback, when I signed up last year, Amazon was not one of the options, or I would have taken it. It was this time, so I did that, under the impression that one way or another I do end up buying stuff off them often enough, and in the next three months I may get some value out of it. Despite this, their paid offer is still pointless: they charge you £9.99 a month, and to cover that on cashback alone you would have to spend £1000 a month from those three retailers. And no, I don’t think the Travel/Gadget insurances that they peddle with the offer mean anything else — there’s a doubling of how much free cash you can get from ATMs, but they appear to have closed the loophole that allowed you to withdraw cash and get loyalty points, or cashback, from a credit card, without incurring in cash handling fees.

So yeah, it looks like they do give money for nothing. Well, for some profiling data I guess. The obvious question is where that money comes from, given that the free offering is just compelling enough, and their paid offering are… in one word, overpriced. As I said in the previous post on foreign transaction fees, Santander offers their All in One Credit Card for £3 a month, and is also 0% foreign transaction fees and comes with a 0.5% cashback on all purchases; recovering that monthly fee requires “only” £600/month spend across any vendor (and not just three), and if you spend more you can probably pay for the travel/gadget insurance separately. And since it’s issued as a World MasterCard (rather than a Debit MasterCard), it also allows you to use some of the available perks worldwide, including some airports’ priority lane at security (as it turns out, that includes Venice Airport, which is very handy since that’s where we fly in and out for to see my family.)

And if you want to compare with the Curve Metal offering at £14.99 a month, well, Santander offers a World Elite Mastercard at the same price point, which comes with the same 0.5% cashback (although capped to nullify the monthly fee.) Despite not coming with the insurances (which again I don’t find particularly compelling, it does have a discount for Santander’s own offering. And it provides LoungeKey access just as well, except that you don’t have to pay the £20 per person entry fee. Being a World Elite card, it also comes with a bunch of other perks, including a Boingo subscription (not particularly compelling to me either, but worth noting.)

Anyway, if you are yet to make your Christmas purchases, and are interested in getting some more extra cashback with Curve, you can download the app from their website and if you want you can sign up with the code BG2G3 to get another £5 out of the magic free money card (and give me the same.)

Speaking of Foreign Transaction Fees

In the previous post about Revolut, I have left open a topic that I wanted to move to its own post: foreign transaction fees.

For those who are not acquainted with the terminology here, with foreign transaction fee I’m referring to the additional fee levied by banks and payment card companies when you incur expenses in a different currency than the one the card was issued for. Sometimes (particularly in UK and Ireland) this is referred to as an “overseas transaction fee” — which is confusing, particularly for Ireland, where the fee is applied for expenses in GBP (which is not overseas, but rather “up the road”), but not in EUR (which is mostly oversea).

This is a different cost incurred than the possible bad exchange rate that the financial institution may be applying, and it has nothing to do with the various DCC scams that you may run into when going to touristy destinations with a non-local card, although there is a link there: even online, services may suggest you to apply the charge in your local currency to avoid foreign transaction fees — as you can see in the linked post, that’s rarely a good idea, with a few exceptions (e.g. PayPal actually applies sane conversion fees in my experience, even if not the best ever).

These foreign transaction fees are set by the card issuers, and vary widely. I have seen cards with up to 6% “fex fees”, but that was back in Italy (why I say that will be clearer in a moment). In Ireland, with the exception of various fintech companies, the typical fex fees were of 2-3% — I was very happy with Tesco Banks‘s 1.75% fex fee (Tesco Bank no longer operates in Ireland.) In the UK, it appears most cards either have 0% fex fee, or 2.99% fex fee; there are a few divergences, but those two appear to be the most common options.

The reason why I am specifying this information with a country attached is that, in addition to telling you what the currency is, the mix of local-vs-foreign spend for the average person is also connected to the country. For instance, for my friends and family living in Italy, foreign transaction fees only exist when buying from foreign websites (or eBay), or when going on a “far” trip — Croatia and Switzerland being the closest countries that incur the fex fee. On the other hand, if you live in Ireland, you’ll probably have at least one recurring expense in GBP — depending on how Brexit is going to go this may change.

Indeed, for electronics you often need to look at the UK, rather than the continent — because of plugs, regulations, availability, etc. And quite a few eShops with presence both in the continent and the UK used to refuse you service from the European website, referring you to the UK one instead — this is another thing that may change after Brexit. There is a reason why, when discussing markets, most companies call it “UKI”.

I’m told that a similar situation exists for those living in Switzerland, and I can imagine this goes similar in the Nordics, given that Denmark, Sweden, and Norway have their own currencies as well, and likely a lot of services overlap.

In the UK (and again this may change after Brexit), you may very well never spend money outside of GBP because all the services exist within the country. Unless you’re an expat, in which case you’re probably still visiting the continent (Eurozone or not) fairly often, or may be paying for ongoing services (such as cellphone contracts) in that currency. This probably explains why the two sets of fex fee groups: if you’re part of the first group, you probably don’t need a card with no foreign transaction fees — while you really do in the latter case.

In my case, I have two credit cards: one from Santander, which I spoke of last time, with no foreign transaction fee, and an American Express with a 2.99% foreign transaction fee. I effectively spread the expenses on the two cards, depending on where I am — namely I try to use the Amex in the UK, and the Santander anywhere the other does not work. I could give up on the Amex, as the Santander is strictly a superset usage, but the perks provided by Amex are worth having. And that’s the most important thing: cards have perks, so you should probably consider those as well.

Thus the utility of fintech services like Revolut and Curve depend on the country you live in not just because it sets the band for foreign transaction fees, but also because they set the tone of foreign currency usage. In the UK, with the wide availability of debit and credit cards with no foreign transaction fees, their services are likely less useful than in other countries — except when it comes to perks. Indeed in the case of Curve, you would be able to keep most of the perks of a credit card, such as cashback, even if the card comes with a hefty foreign transaction fee. Except for Amex of course.

But is it convenient for you to pay for such a service? That’s another very good question. And to answer it, I’ll try to forget about the UK and go back to Ireland — mainly because here, as I now repeated a number of times, cards with no foreign transaction fee exists and you can just use one of those. Metro Bank has free current accounts with cards that come with cards without foreign transaction fees in Europe. Santander has a £3/month credit card with no foreign transaction fees, and 0.5% cashback. Halifax has a Clarity MasterCard that comes with no monthly fee, no foreign transaction fees (and of course no perks.)

But let’s go back to Ireland and take a look at the options. As I said the usual foreign transaction fee in the country was between 2% and 3%. In the case of Ulster Bank, the card I used to have had 2.75% foreign transaction fee. At which point would it have been cheaper for me to subscribe to Curve Black, at €9.99/month, rather than give Ulster Bank their fees? (And for simplicity here, I’m not talking about exchange rates; the exchange rate for their MasterCard is network-provided so it’s not at all bad, and in fact it’s comparable to Revolut’s.)

As most services would require a yearly commitment, we should consider the spend on an yearly basis too. This makes the cost €119.88, but we’ll call it €120 to make it easier to run umbers on them. Let’s just call the twelve cents a rounding error. If we’re ignoring the cashback options (as in Ireland there were none, beside Tesco Bank), the amount of foreign expenses you’d need to break even on Curve black with the foreign transaction fee noted above is about €4364 (divide the yearly cost by the foreign transaction fee). That’s the cost of fairly big vacation for a family (note that you can’t include flights in the vacation cost, as those would be billed by the currency of the country of origin, which is likely local).

If you have a card that provides cashback, then things become more complicated, because you’d have to include the cashback in the calculation. If you’re curious the following formula will give you the number, making S the yearly subscription cost of the service, F the foreign transaction fee percentage, and C the cashback percentage:

(S + (S/F) * C) / F

For Revolut Metal, with their variable cashback, figuring out the number is a bit more annoying. But we’re also talking about 1% in the best case scenario (all non-European spend). So the basic number (€5673) only goes down to €5616. The 0.1% cashback option of all European spend is so minimal that it’s not worth calculating exactly.

So what should you do if you don’t usually spend that kind of money on foreign transactions? You can still use the Revolut and Curve and other fintech services without paying for them, and grab the best deal you can until they go bust. Or if you don’t want to bother, you can just spend on your normal cards, get your usual perks and ignore the need for no foreign transaction fees.

Indeed, if your options are spending on Curve attached to a debit card with no cashback and no perks, or spend on an American Express Platinum Cashback Credit Card, you would need to spend more than £5330 a year in foreign transactions for it to be worth it — and that’s assuming you don’t qualify for the higher tier. And this is probably the worst case scenario for the UK, for a non-zero foreign transaction fee card.

A review of the Curve debit card

Somehow, I end up spending a significant amount of my time thinking, testing and playing with financial services, both old school banks and fintech startups.

One of the most recent ones I have been playing with is Curve. The premise of the service is to allow you to use a single card for all transactions, having the ability to then charge any card underneath it as it is convenient. This was a curious enough idea, so I asked the friend who was telling me about it to give me his referral code to sign up. If you want to sign up, my code is BG2G3.

Signing up and getting the card is quite easy, even though they have (or had when I signed up) a “waitlist” — so after you sign up it takes a few days for you to be able to actually order the card and get it in your hands. They suggest you to make other people sign up for it as well to lower the time in the waitlist, but that didn’t seem to be a requirement for me. The card arrived, to my recalling, no more than two days after they said they shipped it, probably because it was coming from London itself, and that’s all you need to receive.

So how does this all work? You need to connect your existing cards to Curve, and verify them to be able to charge them — verification can be either through a 3Dsecure/Verified by Visa login, or through the usual charge-code-reverse dance that Google, PayPal and the others all use. Once you connect the cards, and select the currently-charged card, you can start using the Curve card to pay, and it acts as a “proxy” for the other card, charging it for the same amount, with some caveats.

The main advantage that my friend suggested for this set up is that you if you have a corporate card (I do), you can add that one to Curve too, and rely on that to not have to do the payback process at work if you make a mistake paying for something. As this happened to me a few times before, mostly out of selecting the wrong payment profile in apps such as Uber or Hailo, or going over the daily allowance for meals as I changed plans, it sounded interesting enough. This can work both by making sure to select the corporate card before making the purchase (for instance by defaulting to it during a work trip), or by “turning back time” on an already charged transaction. Cool.

I also had a hope that the card could be attached to Google Pay, but that’s not the case. Nor they implement their own NFC payment application, which is a bit disappointing.

Beside the “turn back time” feature, the app also has some additional features, such as the integration with the accounting software Xero, including the ability to attach a receipt image to the expense (if this was present for Concur, I’d be a real believer, but until then it’s not really that useful to me), and to receive email “receipts” (more like credit card slips) for purchases made to a certain card (not sure why that’s not just a global, but meh).

Not much else is available in the app to make it particularly useful or interesting to me, honestly. There’s some category system for expenses, very similar to the one for Revolut, but that’s about it.

On the more practical side of things, Curve does not apply any surcharges as long as the transaction is in the same currency as the card, and that includes the transactions in which you turned back time. Which is handy if you don’t know what the currency you’ll be charged in will be in, though that does not really happen often.

What I found particularly useful for this is that the card itself look like a proper “British” card — with my apartment as the verified address on it. But then I can charge one of my cards in Euro, US Dollars, or Revolut itself… although I could just charge Revolut in those cases. The main difference between the two approach is that I can put the Euro purchases onto an Euro credit card, instead of a debit one… except that the only Euro credit card I’m left also has my apartment as its verifiable billing address, so… I’d say I’m not the target audience for this feature.

For “foreign transactions” (that is, where the charged currency and the card currency disagree), Curve charges a 1% foreign transaction fee. This is pointless for me thanks to Revolut, but it still is convenient if you only have accounts with traditional banks, particularly in the UK where most banks apply a 3% foreign transaction fee instead.

In addition to the free card, they also offer a £50 (a year, I guess — it’s not clear!) “black” card that offers 1% cashback at selected retailers. You can actually get 90 days cashback for three retailers of your choice on the free card as well, but to be honest, American Express is much more widely accepted in chains, and its rewards are better. I ended up choosing to do the cashback with TfL, Costa (because they don’t take Amex contactless anyway), and Sainsbury’s just to select something I use.

In all of this, I have to say I fail to see where the business makes money. Okay, financial services are not my area of expertise, but if you’re just proxying payments, without even taking deposits (the way Revolut does), and not charging additional foreign transaction fees, and even giving cashback… where’s the profit?

I guess there is some money to be made by profiling users and selling the data to advertisers — but between GDPR and the fact that most consumers don’t like the idea of being made into products with no “kick back”. I guess if it was me I would be charging 1% on the “turn back time” feature, but that might make moot the whole point of the service. I don’t know.

At the end of the day, I’m also not sure how useful this card is going to be for me, on the day to day. The ability to have a single entry in those systems that are used “promiscuously” for business and personal usage sounds good, but even in that case, it means ignoring the advantages of having a credit card, and particularly a rewards card like my Amex. So, yeah, don’t really see much use for it myself.

It also complicates things when it comes to risk engines for fraud protection: your actual bank will see all the transactions as coming from a single vendor, with the minimum amount of information attached to it. This will likely defeat all the fraud checks by the bank, and will likely rely on Curve’s implementation of fraud checks — which I have no idea how they work, since I have not yet managed to catch them.

Also as far as I could tell, Curve (like Revolut) does not implement 3DSecure (the “second factor” authentication used by a number of merchants to validate e-commerce transactions), making it less secure than any of the other cards I have — a cloned/stolen card can only be disabled after the fact, and replaced. Revolut at least allows me to separate the physical card from my e-commerce transactions, which is neat (and now even supports one time credit card numbers).

There is also another thing that is worth considering, that shows the different point of views (and threat models) of the two services: Curve becomes your single card (single point of failure, too) for all your activities: it makes your life easy by making sure you only ever need to use one card, even if you have multiple bank accounts in multiple countries, and you can switch between them at the tap of a finger. Revolut on the other hand allows you to give each merchant its own credit card number (Premium accounts get unlimited virtual cards) — or even have “burner” cards that change numbers after use.

All in all, I guess it depends what you want to achieve. Between the two, I think I’ll vastly stick to Revolut, and my usage of Curve will taper off once the 90 days cashback offer is completed — although it’s still nice to have for a few websites that gave me trouble with Revolut, as long as I’m charging my Revolut account again, and the charge is in Sterling.

If you do want to sign up, feel free to use BG2G3 as the referral code, it would give a £5 credit for both you and me, under circumstances that are not quite clear to me, but who knows.

UK Banking, Attempt 2: Fineco Bank

So after a fairly negative experience with Barclays I have been quickly looking for alternatives. Two acquaintances who don’t know each other both suggested me to look into Fineco, which is an Italian bank also operating in the United Kingdom. As you can tell from their website, their focus is on trading and traders, but turns out they also make a fairly decent bank in and by themselves.

Indeed, opening the account with Fineco has been fairly straightforward: a few online forms, uploading documents to their identity verification system (very similar to what Revolut does, except using an Italian company that I already knew and was a customer of), and then sending £1 from a bank account that is already opened in your name. I found the forms also technically well-designed, particularly the fact that all the “I agree to” checkboxes automatically trigger JavaScript downloads of PDFs with the terms agreed, whether you clicked to read the agreement or not — I guess it’s a «No excuse, you have a copy of this» protection on their side, but it also made it very easy to archive all the needed information together with everything else I keep.

I should note here that it looks like Fineco’s target audience is Italian expats in the UK explicitly. It is common for most services to “special case” their local country as the first entry in the country drop-down, and then add the rest in alphabetical order. In the case of Fineco, the drop-down started with United Kingdom and Italy for all the options.

One of the good thing about this bank being focused so much on trading is that the account is by default a multicurrency one, similar to TransferWise Borderless Account. Indeed, in addition to the primary Sterling account, Fineco sets you up right away with accounts in Euro, Swiss Francs, and US Dollars, all connected to the same login. And in addition to this, they offer you the choice between a Sterling debit card, an Euro credit card, or both (for a reasonable fee of £10/yr). The two debit cards that are connected to the respective currency accounts (and no card is available for Francs or Dollars), and there are no foreign transaction fees for the two. While Revolut mostly took care of my foreign transaction fees, it’s always good to have a local debit card with a much higher availability, particularly as ATM access for Revolut has a relatively low monthly limit.

One of the interesting details of these currency accounts is that they all have Italian IBAN and BIC (with a separate SWIFT routing number, of its parent group UniCredit). For the main Sterling account, UK-style Sort Code and Account Number are available, which make it a proper local account.

This is actually very useful for me: for the past four years I have been keeping my old Italian account open, despite it costing me a fair bit of money just in service, because I have been paying the utilities for my mother’s house. And despite SEPA Direct Debit having been introduced over two years ago, the utilities I contacted failed to let me debit a foreign (Irish) account. Since I left Ireland, and the UK is not a Euro country, I was afraid I would have to keep my Italian account open even longer, but this actually solved the problem: for Italian utilities, the account is a perfectly valid Italian account, as for the most part they don’t even validate the billing address.

An aside: Vodafone Italy and Wind 3 Italy are still attached to my Tesco credit card, which Tesco Bank assures me I can keep using as long as I direct debit it into an Euro account anywhere. They even changed my mailing address to my new apartment in London. Those two companies insist that they only ever accept Italian credit cards, but they accepted my Irish credit card just fine before; in the case of Vodafone, they have an explicit whitelist of the BIN (for whatever reason), while Wind couldn’t get a hold of the concept that the card is Irish at all. Oh well.

Speaking of direct debits and odd combinations, while I should have now managed to switch all the utilities, including the council tax, to direct debit on this new account, I had some trouble doing the setup with Thameswater, the water provider in my area. If I tried setting up the direct debit online, it would report Fineco’s sort code (30-02-48) as invalid. The Sort Code Checker provided by the category association says it’s valid and it works for everything beside the cheque and credit clearing (which is unneeded). I ended up having to call them and ask them to override the warning, but they have not sent me confirmation that they managed. This appears to be a common “feature” of Thameswater — oh and by the way their paper form to request the direct debit was a 404 response on their website. Sigh.

The UI of the bank (and of their app) is much more information-dense than any other bank I’ve ever used. It’s not a surprise when you consider that they their target audience is investors and traders. It does work well for me, but I can see how this would not be the most pleasing interface for most home users. The only feature I have been unable to find yet in the interface is how to set up standing orders – I contacted them this weekend and will see what they say – so for the moment I just set up a few months worth of rent as scheduled payments, which work just as fine for the moment.

The Android app supports fingerprint authentication (unlike Barclay’s) and does not come with its own NFC payment system. Unfortunately the debit cards also appear not to be enabled for Android Pay, which is a bit of a shame. They also don’t leverage the app to send notifications, but they do send free SMS for new offline1 transactions happening on the debit card, which is great.

All in all, I may have found the bank I was looking for. It’s not a “cuddly” bank, but it appears to have what I need and it appears to work for my needs. With a bit of luck it will mean by Q1 I’ll be done with all the other bank accounts in both Ireland and Italy, and finally it’ll be simpler to keep an eye onto how much money I have and how much of it is spent around the place (although GnuCash does help a bit there). I’ll keep you all posted if this changes.

  1. Confusingly enough, a transaction happening over the Internet is an “offline” transaction. The online/offline is referred to the chip for chip’n’pin cards. If the chip is connected to a terminal that is in turn connected to the bank, that’s an online transaction. Otherwise it’s offline. If you read or type the number manually, it’s also offline.
    [return]

UK Banking, Attempt 1: Barclays

You may remember that back in August, I tried opening a NatWest account while not living in the UK yet, and hit a stonewall of an impossible declaration being required by the NatWest employees. I gave up on setting up a remote account, and waited to open one once I got in the country. Since the Northern Irish account seemed to be good for all I needed to do (spoiler: it wasn’t), I decided to wait for the Barclays representative to show up on my official starting date, and set up a “Premier” account with them.

The procedure, that sounded very “special” beforehand, turned out to just be a “Here is how you fill in the forms on the website”. Then, instead of sending you to a local branch to get your documents copied and stamped (something that appears to be very common in the British Isles), they had three people doing the stamping on a pre-made copy of the passport. Not particularly special, but at least practical, right?

Except they also said it would take a few day for the card, but over a week to have access the online banking as they need to “send me more stuff”. The forms were filled in on Monday, set up by Tuesday, and the card arrived on Wednesday, with the PIN following on Thursday. At that point I guessed that what else they told me to wait for was a simple EMV CAP device (I did not realise that the Wikipedia page had a Barclays device as an example, until I looked to link it over here), and decided to not wait, instead signing up for the online banking using my Ulster Bank CAP device, which worked perfectly fine.

On the Friday I also tried installing the Barclays app on my phone. As you probably all noticed by now, looking for a new app from the Play Store is risky, particularly when banking is involved, so I wanted to get a link to it from their website. Turns out that the Barclays website includes a link to the Apple App Store page for their app, but not for the Google Play one. Instead, the Play Store badge image is not clickable. Instead the option they give you is to provide your phone number and they will send you a link to the app as a text message. When I tried doing so, I got an error message suggesting to check my connection.

The reason for the error became apparent with developer tools open: the request to send the SMS is sent to a separate app running on a different hostname. And that host has a different certificate than their main website, which at that point was expired for at least four days! Indeed, since then, the certificate has been replaced with a new one, an EV certificate signed by Entrust, rather than Symantec as they had before. I do find it slightly disconcerting that they have no monitoring on the validity of the certificates for all of their websites, as a bank. But let’s move on.

The online banking relies heavily on “PINSentry” (that is, CAP) but doing so it makes it fairly easy to set up most things, from standing orders to transfers and changes of address. Changing address to my new apartment was quite straightforward, and it all seemed good. The mobile app on the other hand was less useful at first. The main problem is that the app will refuse to do much for the first ten days, because they “set it up” for you. I assume this is a security feature to avoid someone to get access to your account and have the app execute the transactions instead of the website. Unfortunately it also means that the app is useless if your phone dies and you need to get a new one.

Speaking of the mobile app, Barclays supports Apple Pay, but they don’t support Android Pay, probably because they don’t have to. On Android, you can have a replacement app to provide NFC payment support, and so they decided to use their banking app for the payments as well. Unfortunately the one time I tried using it, it kept throwing errors, and asked me to login, with network connection. I don’t think I’ll use this again and will rather look for a bank that supports Android Pay in the future.

Up to here everything sounds peachy, right? The card arrived, it worked, although I only used it a handful times, to buy stuff at IKEA and to buy plane tickets where Revolut would push an extra £5 due to it running on the credit card circuit1, rather than the debit card one.

Then the time came for me to buy a new computer, because of the one ““lost”” by the movers. Since Black Friday was around the corner, and with it my trip to Italy, I decided to wait for that and see if anything at all would come discounted. And indeed Crucial (Micron) had a discount on their SSDs, which is what I ended up ordering. Unfortunately, my first try to order ended up facing a Verified by Visa screen that, instead of trying to get more authentication factors for myself, just went on to tell me the transaction failed, and to check my phone for messages.

Indeed, my phone received two text messages: one telling me that a text message would be sent to confirm a transaction, and one asking me whether the transaction was intentional or not. After confirming it was me doing the transaction, I was responded to try the transaction again in a few minutes. Which I did, but even if this went through the Verified by Visa screen, PayPal refused the payment altogether. Trying to order directly through Crucial without using PayPal managed to get my order through… except it was cancelled half an hour later because Crucial could not confirm the details of the card.

At this point I tried topping up my Revolut account with the same card, and… it didn’t go well either. I tried calling them then, and they could only tell me that the problem was not theirs, and that they couldn’t even see the requests from Revolut, and they didn’t stop any other transactions, giving the fault to the vendor. The vendor of course blamed the bank, and so I got stuck in between.

Upon suggestion from Revolut on Twitter, I tried topping up by UK bank transfer. At first I got some silly “security questions” about the transfer (“Are you making this transfer to buy some goods? Is someone on the phone instructing you to make this payment?” and so on), but when it supposedly completed, I couldn’t see it in the list of transactions, and trying again would lead to a “technical problem” message. Calling the bank again has been even more frustrating because the call dropped once, and as usual the IVR asked me three times for my date of birth and never managed to recognize it. It wasn’t until I left the office, angry and disappointed, that the SMS arrived telling me to confirm if it was really me requesting the transfer…

The end result looked like Barclays put a stricter risk engine in place for Black Friday which has been causing my payments to not go through, particularly not from the office. Trying later in the evening from my apartment (which has a much more clear UK-based geolocation) allowed the orders to go through. You could say that this is for my own protection but I do find this particularly bothersome for one reason in particular: they have an app!

They could have just as easily sent a push notification to my phone to confirm or refuse the transaction, instead of requiring me to be able to receive text messages (which is not a given, as coverage is not perfect particularly in a city like London), in addition to me knowing my access code, having my bank card with me, and knowing its PIN.

At the end of the day I decided that Barclays is not the bank for me, and applied to open an account with Fineco which is Italian and appears to have Italian expats in the UK as their target market. Will keep you posted about it.

  1. But I found out just the other day that the new virtual cards from Revolut are actually VISA Electron, rather than MasterCard. This makes a difference for many airlines as VISA Electron are often considered debit cards, due to the “Electronic Use Only” limitation. I got myself a second virtual card for that and will see how that goes next time I book a flight.
    [return]

Shame Cube, or how I leaked my own credit card number

This is the story of how I ended up calling my bank at 11pm on a Sunday night to ask them to cancel my credit card. But it started with a complete different problem: I thought I found a bug in some PDF library.

I asked Hanno and Ange since they both have lots more experience with PDF as a format than me (I have nearly zero), as I expected this to be complete garbage either coming from random parts of the file or memory within the process that was generating or reading it, and thought it would be completely inconsequential. As you probably have guessed by the spoiler in both the title of the post and the first paragraph, it was not the case. Instead that string is a representation of my credit card number.

After a few hours, having worked on other tasks, and having just gone back and forth with various PDFs, including finding a possibly misconfigured AGPL library in my bank’s backend (worth of another blog post), I realized that Okular does not actually show a title for this PDF, which suggested a bug in Dolphin (the Plasma file manager). In particular Poppler’s pdfinfo also didn’t show any title at all, which suggested there’s a problem with a different part of the code. Since the problem was happening with my credit card statements, and the credit card statements include the full 16-digits PAN, I didn’t want to just file a bug attaching a sample, so instead I started asking around for help to figure out which part of the code is involved.

Albert Astals Cid sent me the right direction by telling me the low-level implementation was coming from KFileMetadata, and that quickly pointed me at this interesting piece of heuristics which is designed to guess the title of a document by looking at the first page. The code is quite a bit convoluted, so I couldn’t at first just exclude uninitialized memory access, but I couldn’t figure out where it could be coming from, so I decided to copy the code into a single executable to play around with it. The good news was that it would give me the exact same answer, so it was not uninitialized memory. Instead, the parser was mis-reading something in the file, which by being stable meant it wasn’t likely a security issue, just sub-optimal code.

As there is no current, updated tool for PDF that behaves like mkvinfo, that is print an element-by-element description of the content of a PDF file, I decided to just play with the code to figure out how it decided what to use as the title. Printing out each of the possible titles being evaluated showed it was considering first my address, then part of the summary information, then this strange string. What is going on there?

The code is a bit difficult to follow, particularly for me at first since I had no idea how PDF works to begin with. But the summary of it is that it goes through the textboxes (I knew already that PDF text is laid out in boxes) of the first page, joining together the text if the box has markers to follow up. Each of these entries is stored into a map of text heights, together with a “watermark” of the biggest text size encountered during this loop. If, when looking at a textbox, the height is lower than the previous maximum height, it gets discarded. At the end, the first biggest textbox content is reported as the title.

Once I disabled the height check and always reported all the considered title textboxes, I noticed something interesting: the string that kept being reported was found together with a number of textboxes that are drawn on top of the bank giro credit system — The Wikipedia page appears to talk only of the UK system. Ireland, as usual, appears to have kept their own version of the same system, and all the credit card statements, and most bills, will have a similar pre-printed “credit cheque” at the bottom. Even when they are direct-debited. The cheque includes a very big barcode… and that’s where I started sweating a bit.

The reason of the sweat is that by then I already guessed I made a huge mistake sharing the string that Dolphin was showing me. The reference to pay up a credit card is universally the full 16-digits number (PAN). Indeed the full number is printed on the cheque, and as the “An Post Ref” (An Post being the Irish postal system), and the account information (10-digits, excluding the 6-digits IIN) is printed on the bottom of the same. All of this is why I didn’t want to share the sample file, and why I always destroy the statements that arrive, in paper form, from the banks. At this point, the likeliness of the barcode containing the same information was seriously high.

My usual Barcode Scanner for Android didn’t manage to understand the barcode though, which made it awkward. Instead I decided to confirm I was actually looking at the content of the barcode in an encoded form with a very advanced PDF inspection tool: strings $file | grep Font. This did bring up a reference to /BaseFont /Code128ARedA. And that was the confirmation I needed. Indeed a quick search for that name brings you to a public domain font that implements Code 128 barcodes as a TrueType font. This is not uncommon, particularly as it’s the same method used by most label printers, including the Dymo I used to use for labelling computers.

At that point a quick comparison of the barcode I had in front of me with one generated through an online generator (but only for the IIN because I don’t want to leak it all), confirmed I was looking at my credit card number, and that my tweet just leaked it — in a bit of a strange encoding that may take some work to decode, but still leaked it. I called Ulster Bank and got the card cancelled and replaced.

Which lessons I can learn from this experience? First of all to consider credit card statements even more of a security risk than I ever imagine. It also gave me a practical instance of what Brian Krebs advocates for years regarding barcodes of boarding passes and similar. In particular it looks like both Ulster Bank and Tesco Bank use the same software to generate the credit card statements (which is easily told not to be the same system that generates the normal bank statements), which is developed by Fiserv (their name is in the Author field of the PDF), and they all rely on using the normal full card number for payment.

This is something I don’t really understand. In Italy, you only use the 16-digits number to pay the bank one-off by wire, and instead the statements never had more than the last five digits of the card. Except for the Italian American Express — but that does not surprise me too much as they manage it from London as well.

I’m now looking to see how I can improve on the guessing of the title for the PDFs in the KFileMetadata library — although I’m warming up to the idea of just sending a patch that delete that part of the code altogether, and if the file has no title, no title is displayed. The simplest solutions are, usually, the better.

Opening a bank account in the UK

As I foretold in the post where I announced my move, here is the first of the rants with the problems of moving to the UK.

The banking system of the UK, which is already a complicated pain in most countries, appears to be even more complicated. One of the problem is that almost all debit and credit cards have a nearly 3% foreign transaction fee. For those wondering what foreign transaction fees are, they are fees levied on payment executed using a currency different from the “native” currency of the card/account. The term “foreign” is often a misnomer in Europe since within Eurozone transactions may be “foreign” but there is no fee connected, since it’s a single market. Of course this does not apply for UK accounts, as the Sterling is only used in the one country.

This makes it worse than the equivalent 1.75% foreign transaction fee of my Tesco Credit Card, since that would not apply for any expenses incurred in most of the European continent. So I really need to find a good alternative to that.

Of course, there already is Revolut, which I spoke of before. This provide a bank account equivalent and a prepaid MasterCard that has no foreign transaction fees. Unfortunately this has a couple of limitations. The first is that this is a prepaid card, rather than a credit card. And this matters.

In particular, hotels and car rentals (though I don’t have a license, which means I don’t use the latter) generally require you to use a credit card, because they pre-authorize a higher amount of money than you’re meant to pay at the end. if you were to do that with Revolut, you’ll end up with more money locked in for a number of days until the complete charge happens. Since at least in one case I had multiple hundreds euro locked in a pre-authorization of a credit card for two weeks, it’s not the kind of experience I would like to repeat out of habits. Most hotels would allow you to provide a different credit card for deposit and payment, that would mean I could use a normal credit card at check-in time, and then just settle the account with Revolut, but you can imagine that this is not really very handy, particularly at busy hotels during conferences, or if I’m checking out in a hurry because I’m late for my flight.

So I started looking for various options of 0% foreign transaction fee cards, and I identified two cards in particular that fit my requirements, one from Barclays and one from NatWest. Both are premium cards that cost extra money, or require you to have a more expensive bank account, but a quick calculation shows me that I will probably make up the difference in price reasonably easily. And between the two, I focused on the NatWest, because it is part of the same group (RBS) as my current Irish bank, and I was hoping that they would make signing up for it easier.

I couldn’t be more wrong. Even though I’m a customer of Private Banking at Ulster Bank (ROI), they couldn’t help me to set up a UK account at all. It took them one full month to find the name of a colleague of theirs I could contact in London, who then pointed me at the Global Employees service that was supposed to help me. A month after that, I still have no bank account in London, because the process requires my employer to provide a document stating not only my transfer salary, but in no irrevocable terms that the transfer will happen, and how much time I’m meant to spend in the UK.

This is clearly impossible. First of all, since my employer does not own me, I can always change my mind, and leave the company before my transfer finalizes, so they will never declare that there is no chance I would do that (despite the fact that I don’t want to do that and I want the transfer to go through). Secondly, nobody can tell how much time I’ll be spending in the UK. It may be that I’ll live there for the rest of my life, or it may be that I will leave before the two years from Article 50 terminate, because they would make my life impossible, or the crashed economy would make it infeasible for me to keep living in the country.

Both declarations are not really possible to provide, and the fact that the assigned contact has been contacting my HR department multiple times even though they told her twice at least that I’m the only one who can request that information have at the end ticked me off enough that I might try once to escalate this to a supervisor, but otherwise will just stop considering NatWest a feasible banking option, because the last thing I want to do is dealing with drones.

Revolut Review: a traveller’s best friend?

Update 2019-03-24: A few years later, I have some concerns about Revolut, so after you read this post, I will suggest you to read Is Revolut Still a Good Thing?.

Given the amount of words I have spent on payment cards you would expect that since starting to use Revolut last year I would have already written about it. But almost every time I started writing about it, something else changed that made some of my points moot. I think it’s time to break silence.

For those who have not heard yet, Revolut is an UK company that fits into the current profile of FinTech companies. It all starts with a mobile app, that allows you to sign up for their service, which effectively is an “electronic wallet” (or bank account). When you confirm identity, you can get sent a physical MasterCard payment card for a smallish fee (the fee was not present when I signed up – which is why one of the things that confused me when I suggested this to friends, the other being that it appears to be different country by country).

While at first sight this might look like one of the many prepaid debit cards that exist across most of Europe, the most famous of which, in Italy, would be PostePay, it turns out to have a number of technical differences. The first of which is that the card is a MasterCard Prepaid, rather than a MasterCard Debit, which has both good and bad sides to it: it can be used where debit cards usually can’t (e.g. hotels), but it also can be charged extra (e.g. by Ryanair).

The main advantage over the classical debit (or credit) cards is that the company built the payment system as a mobile-native platform, rather than bolting on mobile apps as an afterthought like effectively any other consumer bank I have used. In particular, the security of the card is tied to the app itself: from the app itself you can configure the card, allowing or disallowing transactions made with the magnetic stripe, the contactless payment, or “online” (card not present), as well as whether you want to allow ATM withdrawal, and whether you want to make use of Revolut’s Location Security feature – which is honestly my favourite feature.

This feature relies on the fact that the phone’s location is known to the company through the app, and they can take that into account when they decide to approve or reject a transaction. In most cases, this is exactly what you want. When my Tesco Bank credit card got skimmed, the fraudulent transaction that had them notice was made in New York, while I Was peacefully sleeping in Dublin. Unfortunately this feature is still a bit fragile, and relies on you having connection when you travel, and sometimes it takes more time than you’d like to realize that you have been travelling. For instance I had to disable location security to enter the DLR from London City Airport, after landing (for those who don’t know the airport, it takes less then 10 minutes walking from landing to public transport).

The good thing is that all these settings take effect immediately if you have Internet connection on your phone, so in most places in Europe, where the transaction happens with you holding, or eyeing, your card, it’s easy to just open the app, disable location security, and retry the transactions. In the USA, though, things are more interesting, as in most restaurant you just give the card to a waiter and they’ll run the transaction for you at the till. And if you have a mistake in the way the terminal is set, so that paying at, for the sake of example, a Mexican restaurant in Pittsburgh would appear as coming from Columbo, then you’re going to have a bit of a headache.

In addition ot the security features, the other reason why the Revolut card is a good fit for travelling is that they offer a 0% foreign transaction fee, and so-called interbank rates for converting to whichever currency you have your balance in (it supports euro, sterling, US dollars, and, added between me writing the draft and posting this, Swiss franks and Polish złoty). This is an improvement over the 1.75% of Tesco Bank and 2.75% of Ulster Bank (approximate, this is the rate for VISA cards; since my Ulster Bank card is MasterCard the fee is variable, and it’s more complicated to calculate).

The interbank rates are very hard to judge, but I have some data points, although for now mostly biased. When I went to London last, in April, I used at different places both my Tesco Bank card and Revolut, so I can compare the rate that they gave me: £0.8569 for Revolut vs £0.8531 (effective, exclusing transaction fee, alternatively £0.838 as declared by Tesco Bank in the statement, which includes the transaction fee). This is biased, since both cards are actually UK-based, so Sterling might not be the right currency to compare on. I’ll be able to compare Chinese Yuan Remibi next month, when the Tesco Bank statement arrive. The other comparison I was able to make was with my company card by Citi, but that’s unfair. For what it’s worth, it’s within reasonable variation, sometimes with Revolut standing on the better side.

If I have such a bright opinion of the service, then why did I not write about this before? As I said, there has been a few things that changed, and a few snags, that got me wary about writing about it too quickly. The first problem is that Revolut’s start looked a lot like Number 26 (now N26), the German bank that promised very similar features, although with a different setup. In particular, I don’t remember them having location-based security features, but on the other hand, they did give you a full IBAN you could use to wire money to directly, or issue SEPA Direct Debit against, assuming your provider was happy to accept said requests.

This is a problem particularly when you realize how bad a job they made of security (those particular problems addressed since then, but t’s still hard for me to trust them). But as the talk points out, it was an obvious answer to say “Well, okay, but I only keep €50 on it”; the same answer I could have given Revolut. Except that N26 first, and now Revolut, both allow you to ask for credit. And that makes the accounts a much more interesting target. I really wish Revolut had an option to say “I don’t want credit, please never provide credit to this account” – but alas that’s not the case right now.

There are more issues. In at least one case, I got scared and pissed at Revolut because after a payment at Red Rock, the exchange rate, the charge in dollars and the charge in euro did not match at all. Indeed the value of the charge in euro was almost double the dollars, which made no sense! Some bickering on Twitter about it, we could confirm the problem is that the Red Rock payment terminal does a pre-auth for the base total of the receipt, and then confirms the transaction with the amount including the tip. The Revolut app knows to update the total in euro with the settled amount, but it does not know to update the amount in dollars, unless you logout and log back in. Which requires you have access to your phone number to receive SMS. I noticed this during my trip in January; the bug was still present in April, when I visited London.

There is another problem with aesthetics. Since the names of credit card charges are usually difficult to decipher, as they appears to be still written in the same flat-file format as made popular by AS/400, the app tries to give you an easier tell of what a given charge is. The internal tracking of the transaction type is translated to one out of a handful of options such as Shopping, Groceries, Travel and Transportation, and the logo of a recognizable vendor is provided to make it easier to tell who’s charging you. This works great for things like Starbucks or McDonald’s, but it’s a bit less useful for Amazon, as it’ll bundle marketplace, Comixology and other third party Amazon Payments, but you can survive. The problem is that sometimes it’s completely wrong.

I assume the problem is that they do some fuzzy matching, as different pathways through the same charging entity may appear differently; that is the case for sure of Amazon, but as I also found out, of Uber, even within the same country. Starbucks and McDonald’s have at least the excuse of using different processors for different stores or at least countries.

More concering is the way they handle the breakdown by vendor in their Spending Analytics feature. The feature itself is actually pretty cool, and gives you an idea of how much you’re spending where, although for me that is only a very partial figure, as it does not factor in the other three cards and three accounts where other charges happen. The problem is not that, the problem is with companies such as PayPal, Square, or iZettle. These are intermediaries that don’t usually let their customers set the whole charge line, but rather only allow personalizing the suffix of the line. Most of these use the asterisk symbol (*) as the separator, so you have things like PAYPAL *STEAM GAMES or PAYPAL *PLAYSTATION.

What happens is that Revolut bunches together the “sub-vendors”, which is consistent with their fuzzy matching. Unfortunately they do not drop the suffix, just showing Square or Iz (they do that for PayPal), but they actually show an unrelated sub-vendor, probably the first charge they saw from the intermediary with the given charge type. Oops.

Finally I have one more concern, for now. While the card security is clearly improved by the location awareness, and the ability to enable/disable various payment options – including, finally, the contactless payments! – it appears Revolut did not actually set limits on how much vendors are allowed to charge you over contactless. As it happens, most terminals have limits imposed by the banks, which are often lower than the customer limits, or at best equal to them, but Revolut does not appear to have such. In Ireland, that limit would be between €25 to €35 depending on the bank, when using a physical card (Apple Pay and Android Pay use the same protocol but are considered different); in the UK, that would be £25 to £40.

I got very confused when in Hong Kong I bought my usual Starbucks souvenir mugs and a bearista, for a total of just shy of HK$500, and a contactless payment worth €57 was approved by Revolut with no issue! After contacting them on Twitter they said the limits are per-country, and quoted a CAD $100 limit in Canada. I asked them if they can provide a table of limits, so one can decide whether to leave contactless enabled or not in a card when they travel, but they have to look into it. The limit in Hong Kong appears to be around HK$1000, which is around €117, almost double the Canadian one.

This is of particular importance for a card that declares itself Sterling, by default, because it was not even three years ago that the foreign currency vulnerability got published in almost all the papers (including the Daily Mail, but I won’t link to that). And the fact that Revolut does not appear to have a proper published plan to deal with this bothers me more than a little bit.

All in all, I’m fairly happy with the service. I ended up getting an extra virtual card, which I use online almost exclusively for Amazon (but I have used it for other things including the China Eastern flights to Hong Kong, particularly as Tesco Bank refused the transaction). I calculated that just in the 1.75% foreign transaction fees on my Amazon UK orders (remember: the is no Amazon Ireland), the €6 fee was being paid off quickly.

Update 2019-03-24: continue by reading Is Revolut Still a Good Thing?

Debit and credit cards in the USA

Credit Cards
Photo credit: Sean MacEntee

I know it’s a long time now, maybe an year or two, but I still remember clearly that after one of the many card data breaches in the US – maybe Target’s – I ended up exchanging comments with some Americans on the difference between debit cards and credit cards. Turns out that for people who never had to face that choice before, it’s not obvious why would anybody pay with a debit card at a store such as Target, rather than a credit one. So it might be worth writing it here, given that I talked about credit cards before. But be warned that this is pretty much limited to the United States, so if you’re not interested, feel free to skip.

So first of all, what’s the rokus about credit versus debit? The main difference between the two, on an user point of view, is the protection: in the case of fraudulent transactions on a credit card, most issuers will revert the charge and block the card without costing money to the consumer — who’s going to eat that loss depends on a number of different factors including, as of recently, whether the bank issued an EMV card, and whether the point-of-sale used the chip to execute the transaction. On the other hand, fraudulent charges on a debit card are usually a loss for the cardholder.

So generally speaking, if you have a choice, you should pay with a credit card. Which is generally not what vendors want, as they would prefer you pay with a debit card (it costs them less in fees). As much as I feel for the vendors – I had my own company, remember? – the inherent risk of breaches and the amount of PoS malware makes it sadly a consumer protection choice.

But the relative ease to get debit and credit cards is also a factor. Getting a debit card is trivial: you walk into a branch, ask them to open a new account, give them enough information about yourself, and they will mail you a debit card. They won’t look into your financial data – including your credit score – because they are not giving you credit, they are just giving you a mean to access the funds you deposited at their bank.

This, among other things, means that you can get a card number in the US without being a resident: if you’re a non-resident in the US, but you have a permanent address of some kind, such as an office or a friend’s, you can just enter a branch and open an account with a US bank. They’ll need your documents (passport, and another credit/debit card with your name, or another non-photo ID), and a proof of address in your country of residence, but otherwise it’s usually a quite pleasant experience.

To provide more information on the topic: since you’re not a resident and you’re not working illegally in the US, you’re not receiving a fixed paycheck on your US account, which means that most fee-waiving programs that count on you receiving a given direct credit per month won’t apply to you. Instead you should look into fee-waiving by the deposited amount — Bank of the West has a minimum deposit of $1000, which is the lowest I have seen, but when I asked them they tried to send me from Sunnyvale to San Francisco to open an account; the Chase next door was happy to have me as a client, even though their minimum deposit is $1500.

If you plan on transferring money often between the two accounts, you probably want to use a service like Transferwise, that converts currencies and transfer funds between USD, EUR, GBP and other currencies at a much cheaper rate than most banks, and definitely much cheaper than the banks that I have.

But things get complicated if you want a credit card, even more so if you want a rewards credit card, such as Amazon’s, or any airline or hotel chain — which generally wouldn’t be very useful to foreigners as most countries with the except of Ireland have some card that you can get, American Express being the worst case.

To get the most common credit cards in the US you need to be in the credit system somehow; you probably want to have some credit history and a rating too. If you’re resident in the US, they will find you up through the Social Security Number (SSN), but it’s more complicated for non-residents (unless they were at some point residents of course).

In either case, the simplest form of credit card you can request is a secured credit card — which is essentially a glorified debit card: you pay the bank an amount, and then then make that amount available to you as a credit line. The main difference between this and a debit card is that it does have the protections of a credit card. It also allows you to build up credit score, which is why it’s usually the choice of card for immigrants and young people who don’t have a history at all. They generally don’t come with any kind of rewards system.

Immigrants here include techies, by the way. Even when working for big companies in the Silicon Valley, the lack of a credit history means you have to build it up from scratch. I know some of my American acquaintances were surprised that it’s not as easy as showing your employment information to get credit.

Not all banks provide secured credit cards though. In particular when I asked Chase just the other day, they told me to try with the nearby US Bank or Wells Fargo – both walking distance – and I seem to recall that Bank of America does it as well. The idea is that you’ll use a secured card for at least an year to build up positive history, and then get a proper, better credit card after that. And that’s why you need a SSN to correlate them.

What I said up to now would imply that you have no option to get a credit card if you, like me, are just a visitor who happens to be in the States every few months. That is not strictly true: the requirement for the SSN is a requirement for an identifier that can be reported across multiple banks and with the IRS; there is another identifier you can use for that, and it’s the ITIN. This non-resident identification number has some requirements attached, and it’s not exactly trivial to get — I have unfortunately no experience with getting one to retell yet. It is usually assigned by filing a US tax return, which is not something you want (or need) to do if you’re a foreigner. Especially because it usually requires a good reason, such as having an ebook published and having Amazon withhold 30% of the royalties for US taxes, when a treaty exists between the US and your country of residence.

I do indeed plan to look into how to declare my royalties properly next year to Ireland, and file a US tax return to get the (cents) back — if nothing else to request an ITIN, and with it a rewards credit card. After all, a lot of the money I spend ends up being spent in the US, so why not?

Well, to be honest there are a bunch of reasons why not. You risk getting audited by either or both of your country of residence and the USA — and for the USA there is no way to escape the IRS, or they wouldn’t consider only two things certain. You have paperwork to file, again for both countries, which might be unwieldy or complex (I have yet to look at the paperwork to file with Irish authorities, they are usually straightforward). And you end up on the currency market; right now between EUR and USD it’s pretty stable and doable, but if you don’t keep an eye out it’s easy to screw it up and ending up wasting money just on the exchange. So it’s still an investment in time.

Myself, I still think it’s likely it’s going to be a good idea to try to get an ITIN and a proper credit card, since I come to the States every few months between conferences and work travel. But I won’t make any suggestions to anybody else. Your money, your choice.