Merchants and punters cry foul over Verified by Visa
Resistance is futile
The Verified by Visa system is becoming harder to avoid, even for those with real doubts about its effectiveness in combating fraud.
The experiences of Verified by Visa refusenik and Reg reader Steve reported in our earlier article on the system are being experienced by more and more Register readers.
Both Verified by Visa (VbyV) and MasterCard's equivalent SecureCode service are marketed as offering extra security checks to online purchases. Importantly, the schemes also transfer liability for bogus transactions away from merchants who use the system back towards banks (and perhaps ordinary e-commerce punters).
Online shoppers who buy goods and service with participating retailers are asked to submit a VbyV or SecureCode password to authorise transactions. These additional checks are typically submitted via a website affiliated to a card-issuing bank but with no obvious connection to a user's bank.
Punters aren't informed up front that a merchant has signed up to Verified by Visa. Sites used to authenticate a VbyV or SecureCode password routinely deliver a dialogue box using a pop-up window or inline frame, making it difficult to detect whether or not a site is genuine.
The appearance of phishing attacks hunting for Verified by Visa passwords are among the reasons some punters are wary of the technology.
Once obtained by fraudsters, either by direct phishing attack or through other more subtle forms of social engineering trickery, VbyV login credentials make it easier for crooks to make purchases online while simultaneously making it harder for consumers to deny responsibility for a fraudulent transaction.
Hole new dimension
The little-publicised mandatory use of the technology by some banks means that those with reservations have an uphill struggle to opt out of the scheme.
We say some banks because Verified by Visa and MasterCard SecureCode are considered to be competitive offerings. Different banks are taking a different approach to introducing and rolling out the technology, banking association APACS told us. That's in contrast to Chip and PIN, where it was clear up front that the technology would become compulsory with PIN codes replacing signatures as the main way of authorising purchases via plastic cards on the high street.
Both VbyV and SecureCode are based on 3DSecure, a name that hints at the introduction of some kind of three-factor authentication scheme. But unlike robust authentication techniques, hackers don't have a hardware token generating one-time passwords to worry about - it's just more of the same. And since card details + CVV number is no longer considered as secure enough then it's hard to see how card details + CVV number + VbyV login is any more robust.
An anonymous commenter to our original stories agrees:
Verified by Visa and Mastercard SecureCode are there purely to protect the banks, not the card holder. They offer zero additional protection to the consumer, but allow the bank to claim that transactions using purloined credit card credentials were really made by the card holder. It is as simple as that.
Reg Reader Stef backs up these concerns.
They [banks] consider the Verified by Visa to be invulnerable, so any claims that you have been ripped off will fall on deaf ears.
Visa declined to respond to our requests for stats on what percentage of banks have made Verified by Visa compulsory for cardholders, or details of figures on take-up of the technology by merchants. But it did provide a statement summarising the perceived benefits of the technology.
Visa does always recommend best practice when shopping online, such as Verified by Visa, and that cardholders are vigilant when using their card whether it be in traditional or online retailers. Verified by Visa is easy and quick for consumers to sign up to, and we believe most consumers and merchants welcome extra security measures designed to prevent fraud.
According to the latest statistics from banking association APACS late last month, more than 25 million UK-issued credit and debit cards are registered with either Verified by Visa or MasterCard SecureCode, a seven-fold increase over the last two years. Merchants that have signed up for the programme account for one third of the volume of UK e-commerce transactions.
Those unconvinced by arguments are having a harder job making purchases online. Steve, our original source, had problems with MDNA and Egg. Other readers have subsequently reported problems with several other banks that have introduced the scheme as compulsory including Smile, Alliance and Leicester Nationwide (as confirmed here) and First Direct.
Links from the securesuite.co.uk payment processing service website provide a fuller list of users of the technology.
Comments of one anonymous respondent to our original story are typical of those opposed to the scheme...
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
COMMENTS
Inadequate Security on All card Txns
The issue is that the various organisations, APACS, Banks, Card issuing companies, IT Solutions Companies and retailers are all looking at this seperately.
The retailers do everything at the cheapest possible cost, the banks say it is the retailers problems, VISA and Mastercard say that it is down to the banks and APACS tries but fails to bring them all in together.
Fraud has improved in the customer present world and despite peoples ranting, chip and pin has improved things however this has been marred by stupid short cuts being taken by both the banks and the retailers. Also nothing at the time of implementation was done about the user experience which is not good!
VBy V and 3D Secure have been put into place to look at on-line fraud and theoretically to protect the consumer. It Fails!!!!!!
I would advise people only to use sites that they know and trust and where you have confidence in the e-tailer. Also only deliver items to your registered address - That cuts out fraud. Some sites will do more checks e.g. against electoral role. It is only through the application of common sense and other interrogation of personal data that we can cut online fraud. Not VByV or 3D Secure which is basically useless!
Don't like it myself
Whenever I've been confronted by the VbyV screen I've declined to sign up, I'm not comfortable with inputting the personal information they ask for.
The only effect to me has been that I now pay my council tax and BT phone bill using the automated telephone CC system, rather than a website.
If Amazon UK, or my web hosting provider start requiring it, I suspect I'll opt to pay by cheque.
Good solutions need not be mandated
A solution if it works need not be mandated. We should all be wary of anything thats forced.
Its high time that the UK competition office take a look at this monopolistic practice by the big card schemes of imposing ineffective solutions onto the market. There are other more effective solutions. This awful practice of ramming a solution (because you can) must end in order to finally bring QUALITY solutions and products into the market !
If UK had effective consumer protection agencies, mandated solutions would not stand a chance. The best thing to do, I believe - is to REPORT the card schemes to the UK competition office.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM Implementer’s Checklist
Steps to Take Before Choosing a Business Continuity Partner
