Feeds

Net shoppers bullied into being Verified by Visa

When voluntary means mandatory

Providing a secure and efficient Helpdesk

One card issuer, MBNA, told Steve that you are only able to avoid enrolling by clicking "not at this time" three times. His main card is held with Egg but unfortunately his attempts to make himself understood by the bank have floundered.

"Every person I speak to has either said that the system is optional, or that they don't know whether the system is optional or not.

"They have taken my complaint to be 'Verified by Visa is insecure' but my complaint is that I have chosen NOT to enrol, since I do not believe it makes me any more secure. But because of the fraud prevention system my card is blocked every time I choose not to enrol in Verified by Visa."

Steve is constantly having to unlock his card because of his doubts over the system. Worse still he's never quite sure which merchants are signed up to the scheme.

"This seems like a strange way to implement a voluntary system. On most of the retailers' websites there is no clue that you are about to be challenged by Verified by Visa until you attempt to complete the transaction. This means that you trigger the "fraud protection" unintentionally. And when you have located a retailer who doesn't require Verified by Visa to complete a purchase, you can't because your account is on hold.

3rd Man's Goodwill said that uptake of Verified by Visa by both merchants and consumers is low. "Customers don't like it because they get taken to a third-party website to enter their information. They have a new password to remember. How it's implemented varies from bank to bank," he explained.

Worse still, in some cases resetting the password is all too easy. Fraudsters know this and go after these credentials which, once obtained, make it harder for consumers to deny responsibility for a fraudulent transaction. Phishing scams posing as Verified by Visa sites have sprung up targeting these login credentials. "We like to support anything that aims to cut plastic fraud but Verified by Visa is flawed. MasterCard SecureCode works in much the same way and is no better," Goodwill added.

Or as Steve puts it, "Frankly, I feel like I am being bullied into accepting a system which is as flawed as Chip and PIN. At least they had the decency to make Chip and PIN mandatory so we knew where we stood."

®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.