Feeds

Merchants and punters cry foul over Verified by Visa

Resistance is futile

3 Big data security analytics techniques

The Verified by Visa system is becoming harder to avoid, even for those with real doubts about its effectiveness in combating fraud.

The experiences of Verified by Visa refusenik and Reg reader Steve reported in our earlier article on the system are being experienced by more and more Register readers.

Both Verified by Visa (VbyV) and MasterCard's equivalent SecureCode service are marketed as offering extra security checks to online purchases. Importantly, the schemes also transfer liability for bogus transactions away from merchants who use the system back towards banks (and perhaps ordinary e-commerce punters).

Online shoppers who buy goods and service with participating retailers are asked to submit a VbyV or SecureCode password to authorise transactions. These additional checks are typically submitted via a website affiliated to a card-issuing bank but with no obvious connection to a user's bank.

Punters aren't informed up front that a merchant has signed up to Verified by Visa. Sites used to authenticate a VbyV or SecureCode password routinely deliver a dialogue box using a pop-up window or inline frame, making it difficult to detect whether or not a site is genuine.

The appearance of phishing attacks hunting for Verified by Visa passwords are among the reasons some punters are wary of the technology.

Once obtained by fraudsters, either by direct phishing attack or through other more subtle forms of social engineering trickery, VbyV login credentials make it easier for crooks to make purchases online while simultaneously making it harder for consumers to deny responsibility for a fraudulent transaction.

Hole new dimension

The little-publicised mandatory use of the technology by some banks means that those with reservations have an uphill struggle to opt out of the scheme.

We say some banks because Verified by Visa and MasterCard SecureCode are considered to be competitive offerings. Different banks are taking a different approach to introducing and rolling out the technology, banking association APACS told us. That's in contrast to Chip and PIN, where it was clear up front that the technology would become compulsory with PIN codes replacing signatures as the main way of authorising purchases via plastic cards on the high street.

Both VbyV and SecureCode are based on 3DSecure, a name that hints at the introduction of some kind of three-factor authentication scheme. But unlike robust authentication techniques, hackers don't have a hardware token generating one-time passwords to worry about - it's just more of the same. And since card details + CVV number is no longer considered as secure enough then it's hard to see how card details + CVV number + VbyV login is any more robust.

An anonymous commenter to our original stories agrees:

Verified by Visa and Mastercard SecureCode are there purely to protect the banks, not the card holder. They offer zero additional protection to the consumer, but allow the bank to claim that transactions using purloined credit card credentials were really made by the card holder. It is as simple as that.

Reg Reader Stef backs up these concerns.

They [banks] consider the Verified by Visa to be invulnerable, so any claims that you have been ripped off will fall on deaf ears.

Visa declined to respond to our requests for stats on what percentage of banks have made Verified by Visa compulsory for cardholders, or details of figures on take-up of the technology by merchants. But it did provide a statement summarising the perceived benefits of the technology.

Visa does always recommend best practice when shopping online, such as Verified by Visa, and that cardholders are vigilant when using their card whether it be in traditional or online retailers. Verified by Visa is easy and quick for consumers to sign up to, and we believe most consumers and merchants welcome extra security measures designed to prevent fraud.

According to the latest statistics from banking association APACS late last month, more than 25 million UK-issued credit and debit cards are registered with either Verified by Visa or MasterCard SecureCode, a seven-fold increase over the last two years. Merchants that have signed up for the programme account for one third of the volume of UK e-commerce transactions.

Those unconvinced by arguments are having a harder job making purchases online. Steve, our original source, had problems with MDNA and Egg. Other readers have subsequently reported problems with several other banks that have introduced the scheme as compulsory including Smile, Alliance and Leicester Nationwide (as confirmed here) and First Direct.

Links from the securesuite.co.uk payment processing service website provide a fuller list of users of the technology.

Comments of one anonymous respondent to our original story are typical of those opposed to the scheme...

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.