Feeds

Merchants and punters cry foul over Verified by Visa

Resistance is futile

Combat fraud and increase customer satisfaction

The Verified by Visa system is becoming harder to avoid, even for those with real doubts about its effectiveness in combating fraud.

The experiences of Verified by Visa refusenik and Reg reader Steve reported in our earlier article on the system are being experienced by more and more Register readers.

Both Verified by Visa (VbyV) and MasterCard's equivalent SecureCode service are marketed as offering extra security checks to online purchases. Importantly, the schemes also transfer liability for bogus transactions away from merchants who use the system back towards banks (and perhaps ordinary e-commerce punters).

Online shoppers who buy goods and service with participating retailers are asked to submit a VbyV or SecureCode password to authorise transactions. These additional checks are typically submitted via a website affiliated to a card-issuing bank but with no obvious connection to a user's bank.

Punters aren't informed up front that a merchant has signed up to Verified by Visa. Sites used to authenticate a VbyV or SecureCode password routinely deliver a dialogue box using a pop-up window or inline frame, making it difficult to detect whether or not a site is genuine.

The appearance of phishing attacks hunting for Verified by Visa passwords are among the reasons some punters are wary of the technology.

Once obtained by fraudsters, either by direct phishing attack or through other more subtle forms of social engineering trickery, VbyV login credentials make it easier for crooks to make purchases online while simultaneously making it harder for consumers to deny responsibility for a fraudulent transaction.

Hole new dimension

The little-publicised mandatory use of the technology by some banks means that those with reservations have an uphill struggle to opt out of the scheme.

We say some banks because Verified by Visa and MasterCard SecureCode are considered to be competitive offerings. Different banks are taking a different approach to introducing and rolling out the technology, banking association APACS told us. That's in contrast to Chip and PIN, where it was clear up front that the technology would become compulsory with PIN codes replacing signatures as the main way of authorising purchases via plastic cards on the high street.

Both VbyV and SecureCode are based on 3DSecure, a name that hints at the introduction of some kind of three-factor authentication scheme. But unlike robust authentication techniques, hackers don't have a hardware token generating one-time passwords to worry about - it's just more of the same. And since card details + CVV number is no longer considered as secure enough then it's hard to see how card details + CVV number + VbyV login is any more robust.

An anonymous commenter to our original stories agrees:

Verified by Visa and Mastercard SecureCode are there purely to protect the banks, not the card holder. They offer zero additional protection to the consumer, but allow the bank to claim that transactions using purloined credit card credentials were really made by the card holder. It is as simple as that.

Reg Reader Stef backs up these concerns.

They [banks] consider the Verified by Visa to be invulnerable, so any claims that you have been ripped off will fall on deaf ears.

Visa declined to respond to our requests for stats on what percentage of banks have made Verified by Visa compulsory for cardholders, or details of figures on take-up of the technology by merchants. But it did provide a statement summarising the perceived benefits of the technology.

Visa does always recommend best practice when shopping online, such as Verified by Visa, and that cardholders are vigilant when using their card whether it be in traditional or online retailers. Verified by Visa is easy and quick for consumers to sign up to, and we believe most consumers and merchants welcome extra security measures designed to prevent fraud.

According to the latest statistics from banking association APACS late last month, more than 25 million UK-issued credit and debit cards are registered with either Verified by Visa or MasterCard SecureCode, a seven-fold increase over the last two years. Merchants that have signed up for the programme account for one third of the volume of UK e-commerce transactions.

Those unconvinced by arguments are having a harder job making purchases online. Steve, our original source, had problems with MDNA and Egg. Other readers have subsequently reported problems with several other banks that have introduced the scheme as compulsory including Smile, Alliance and Leicester Nationwide (as confirmed here) and First Direct.

Links from the securesuite.co.uk payment processing service website provide a fuller list of users of the technology.

Comments of one anonymous respondent to our original story are typical of those opposed to the scheme...

SANS - Survey on application security programs

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.