4 ms·
3DSecure and the Visa equivalent (don't remember the name) are not really what I meant by 2FA. To make a transaction: -add items to cart -enter card details
by anondon 10y ago
3DSecure and the Visa equivalent (don't remember the name) are not really what I meant by 2FA.
To make a transaction:
-add items to cart
-enter card details
-you are redirected to 3DSecure if it's enabled
-you are redirected to a page of your bank where you enter a One time Password(OTP). It's a simple 6 digit number sent to your mobile phone and is unique for every transaction.Enter OTP.
-transaction is confirmed.
So even if someone has my card details they can't make any transaction (unless they also managed to steal my phone).
Sorry if my original comment was not clear.
- bluesign 10y agoAlmost all banks i am working with implementing 3Dsecure like this
- anondon 10y agoThank you far clarifying, I was not sure if it was the same in the USA. Follow up question, how widespread is the adoption of 3DSecure in the USA and if it's not available, is it easy to get 3DSecure activated?
- davb 10y agoTwo of my banks do it a little differently. With Visa's process (Verified by Visa), I had to register a password for each card. A separate password from my internet banking password. When I try to use my card on a VbV site (maybe one in ten sites), I have to enter three random characters. So few sites require it that I don't remember the password and entering random characters from KeepassX is always a pain. I hate it when I see that VbV prompt. That's frustrating security and results in passwords that you use so infrequently they never get changed. I'd much prefer OATH TOTP or even an SMS based code (with a "I don't have my phone" option).
- codedokode 10y ago3DScure is usually optional. Some merchants might opt out of using it (but then they take the liability for fraud) so criminals can still use your credentials.