The cynic in me says, "What are the bank's goals with their approach to security?" The 3D Secure stuff (Verified by Visa/MasterCard SecureCode) -- as commonly

The cynic in me says, "What are the bank's goals with their approach to security?" The 3D Secure stuff (Verified by Visa/MasterCard SecureCode) -- as commonly implemented, anyway -- seems to be directed towards transferring liability for fraudulent transactions away from the banks towards the merchants without actually doing anything to increase security. VbV/MCSC pretty much trains users to accept man-in-the-middle attacks by asking users to provide a password to an iframe served from a totally unrelated domain (arcot.com for HSBC UK currently, and securesuite.co.uk previously if memory serves). If a merchant -- or an attacker between the user and the merchant -- MITMs the VbV flow, how will the user be able to tell? HSBC (in the UK) have recently given me a physical token for my personal internet banking service, which is used to both log in to their service and to authenticate specific transactions. This is a bit of an inconvenience -- I can't log in to my bank account with just the credentials stored in my grey matter any more -- but a great big step in the right direction. Now, if only they could apply this to their VbV/MCSC authentication too, or allow me to use my phone as the physical token instead of having another bit of plastic to carry in my wallet... If my email or Facebook account is ever compromised, I'll be very unhappy -- I have a fair amount of private, personal information in both locations. If my bank account or credit cards are ever compromised, I'll consider it a more-or-less inevitable consequence of the way the system is designed and simply something to be accepted... but I really don't relish convincing the bank of this!