5 ms·

A solution that some banks provide is to enable a credit card for only transactions using 3-D Secure [1], in which you are expected to enter a 2FA code sent to

by maemre 10y ago

A solution that some banks provide is to enable a credit card for only transactions using 3-D Secure [1], in which you are expected to enter a 2FA code sent to your phone by the bank during transaction to a webpage of the bank that gets opened. Unfortunately, some (most) websites don't support 3-D Secure. I remember that almost all Turkish e-commerce sites I shopped supported it but almost none of the American sites supported it. [1]: https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure

egeozcan 10y ago
In Turkey, it became a requirement from nearly all banks supporting online transactions. I couldn't find out though if it was forced by BDDK (Turkish authority of banking regulation and inspection) though.
vxNsr 10y ago
Visa has this for large (ie >$1000) transactions. But I'm not sure if every online merchant is set up to make it work...
- sirn 10y ago
  This is most likely the merchant choose to enable 3-D Secure for large transactions so they're not liable for frauds. 3-D Secure flow is separate from the normal authorization flow and require the merchant (or payment gateway) to set it up. The merchant (or the gateway) is required to build or purchase an MPI from an approved vendors to make it work.
sirn 10y ago
Does your bank also reject all non 3-D Secure transactions? Unless this is the case, having 3-D Secure only benefits merchants as the liability will now be shifted from the merchant to the cardholder (e.g. the cardholder is now liable for fraud) while the (stolen) card can still be used for a non 3-D Secure payments.
- vertex-four 10y ago
  The liability is with the merchant for non 3D secure payments, just as it's with the provider for old stripe-and-signature payments even after the switch to chip-and-pin.
pvdebbe 10y ago
As a customer I hate these 2FA codes and online bank confirmations, common in the EU. I don't want to bring my bank passwords and whatnot with me if I want to make an online purchase with my CC!
- Kliment 10y ago
  As a customer they are also entirely to your disadvantage as in any 3dsecure transaction the customer is liable for unauthorized transactions as the assumption is they are the only ones with the ability to authorize. This makes disputing charges extremely difficult for the customer, and shifts liability from the bank and merchant to the customer end.
- Doctor_Fegg 10y ago
  Some banks appear to have lighter-touch 3D Secure than others. I switched to my current (UK) bank when my previous bank, HSBC, introduced a mandatory keypad for online banking: no way did I want to carry that around everywhere I might want to check my balance or transfer money. The bank I now use doesn't require a keypad for personal banking, nor a password for most 3D Secure transactions.
tyingq 10y ago
>almost none of the American sites supported it There's just not much incentive to support it. You have to make it optional, otherwise your conversion rate drops like a rock. And, if you make it optional, only a very tiny amount of customers ever use it...and the ones that do are VERY unlikely to be fraudulent users. Thus, the shift in liability isn't really an incentive. The only way it would work would be to make it 100% mandatory. The checkout path would be harder on customers, but they couldn't choose to go to a competitor's site that didn't require it.
- BillinghamJ 10y ago
  The actual way you do it in reality is to trigger it for a small percentage of high risk transactions. My company uses Ravelin for this - we feed them lots of data, they do some kind of machine learning, and they feed us back a recommendation. Depending on what recommendation we receive, we either let the transaction through without 3DS, block it completely, or only allow it with 3DS.
  - tyingq 10y ago
    I assume though, that you're still losing some number of conversions to legitimate customers that don't want to deal with 3DS.
    - BillinghamJ 10y ago
      A few, but it's a very small percentage, and the monetary loss of not requiring 3DS in these cases far outweighs the lost sales.
tgsovlerkhgsel 10y ago
Fortunately, merchants and banks have realized that requiring 3-D Secure results in an abandoned shopping card. I rarely use my CC online. Asking me for my 3-D Secure password means asking me to log into my bank and use a physical second factor to set a new password. Likewise, requiring 3-D Secure on my credit card makes me much more likely to pick a different payment method since I don't feel like doing the above. (Or rather, I might not even be carrying the phone/token needed for it.) Seems like someone has figured this out. I haven't seen a 3-D Secure prompt in a while. There's also no reason for me to like it: Without 3-D Secure, fraud is a minor hassle and I'll get my money back. With it, the bank may try to put the responsibility on me, even though I can't distinguish a real 3-D Secure page from a phishing page because they're all IFRAMEd per their official recommendations.
SocratesV 10y ago
3-D Secure doesn't always requests a 2FA code sent to your phone. Most that I've used are fixed passwords (and they ask you for the character at certain positions) while others will ask you for personal information that is rather easy to obtain. This is at least my experience. From the handful of cards I've used from different banks, only 1 used to send me a code via SMS. (this was in the UK)

by maemre 10y ago

egeozcan 10y ago

In Turkey, it became a requirement from nearly all banks supporting online transactions. I couldn't find out though if it was forced by BDDK (Turkish authority of banking regulation and inspection) though.

vxNsr 10y ago

Visa has this for large (ie >$1000) transactions. But I'm not sure if every online merchant is set up to make it work...

sirn 10y ago
This is most likely the merchant choose to enable 3-D Secure for large transactions so they're not liable for frauds. 3-D Secure flow is separate from the normal authorization flow and require the merchant (or payment gateway) to set it up. The merchant (or the gateway) is required to build or purchase an MPI from an approved vendors to make it work.

sirn 10y ago

Does your bank also reject all non 3-D Secure transactions? Unless this is the case, having 3-D Secure only benefits merchants as the liability will now be shifted from the merchant to the cardholder (e.g. the cardholder is now liable for fraud) while the (stolen) card can still be used for a non 3-D Secure payments.

vertex-four 10y ago
The liability is with the merchant for non 3D secure payments, just as it's with the provider for old stripe-and-signature payments even after the switch to chip-and-pin.

pvdebbe 10y ago

As a customer I hate these 2FA codes and online bank confirmations, common in the EU. I don't want to bring my bank passwords and whatnot with me if I want to make an online purchase with my CC!

Kliment 10y ago
As a customer they are also entirely to your disadvantage as in any 3dsecure transaction the customer is liable for unauthorized transactions as the assumption is they are the only ones with the ability to authorize. This makes disputing charges extremely difficult for the customer, and shifts liability from the bank and merchant to the customer end.
Doctor_Fegg 10y ago
Some banks appear to have lighter-touch 3D Secure than others. I switched to my current (UK) bank when my previous bank, HSBC, introduced a mandatory keypad for online banking: no way did I want to carry that around everywhere I might want to check my balance or transfer money. The bank I now use doesn't require a keypad for personal banking, nor a password for most 3D Secure transactions.

tyingq 10y ago

>almost none of the American sites supported it There's just not much incentive to support it. You have to make it optional, otherwise your conversion rate drops like a rock. And, if you make it optional, only a very tiny amount of customers ever use it...and the ones that do are VERY unlikely to be fraudulent users. Thus, the shift in liability isn't really an incentive. The only way it would work would be to make it 100% mandatory. The checkout path would be harder on customers, but they couldn't choose to go to a competitor's site that didn't require it.

BillinghamJ 10y ago
The actual way you do it in reality is to trigger it for a small percentage of high risk transactions. My company uses Ravelin for this - we feed them lots of data, they do some kind of machine learning, and they feed us back a recommendation. Depending on what recommendation we receive, we either let the transaction through without 3DS, block it completely, or only allow it with 3DS.
- tyingq 10y ago
  I assume though, that you're still losing some number of conversions to legitimate customers that don't want to deal with 3DS.
  - BillinghamJ 10y ago
    A few, but it's a very small percentage, and the monetary loss of not requiring 3DS in these cases far outweighs the lost sales.

tgsovlerkhgsel 10y ago

Fortunately, merchants and banks have realized that requiring 3-D Secure results in an abandoned shopping card. I rarely use my CC online. Asking me for my 3-D Secure password means asking me to log into my bank and use a physical second factor to set a new password. Likewise, requiring 3-D Secure on my credit card makes me much more likely to pick a different payment method since I don't feel like doing the above. (Or rather, I might not even be carrying the phone/token needed for it.) Seems like someone has figured this out. I haven't seen a 3-D Secure prompt in a while. There's also no reason for me to like it: Without 3-D Secure, fraud is a minor hassle and I'll get my money back. With it, the bank may try to put the responsibility on me, even though I can't distinguish a real 3-D Secure page from a phishing page because they're all IFRAMEd per their official recommendations.

SocratesV 10y ago

3-D Secure doesn't always requests a 2FA code sent to your phone. Most that I've used are fixed passwords (and they ask you for the character at certain positions) while others will ask you for personal information that is rather easy to obtain. This is at least my experience. From the handful of cards I've used from different banks, only 1 used to send me a code via SMS. (this was in the UK)