4 ms·

Isn't this solved with 3-D Secure ? Many websites (at least in the EU) implement it and if mandatory, it's impossible to buy something without 2FA (either by SM

by Faaak 3y ago

Isn't this solved with 3-D Secure ? Many websites (at least in the EU) implement it and if mandatory, it's impossible to buy something without 2FA (either by SMS, phone app, ...)

alsodumb 3y ago
That’s not the case in US. It’s kinda funny, but the only time Chase and Amex credit cards asked me for 2FA (I didn’t even know they had 2FA) was when I used them to purchase some things in Indian website through local payment provider (Razorpay).
- lotsofpulp 3y ago
  I have seen it multiple times at BestBuy.com and HomeDepot.com, and probably others.
bonzini 3y ago
"banks (usually American ones) will happily accept transactions that have incorrect full name, invalid CVV / CVC, wrong expiration date, only partial billing address provided, with incorrect ZIP code. All of the above is still not enough to trigger a 3D secure authorisation" The solution indeed is to write manual rules to trigger 3D secure.
- selimthegrim 3y ago
  I’ve seen verified by visa triggered a few times for online purchases
  - __MatrixMan__ 3y ago
    ... Which is hell if you're in a country where your sim card doesn't work and your bank requires sms 2fa.
    - alexvoda 3y ago
      Then it's a good thing that many banks in the EU now have 3DSecure validation through the phone app instead of SMS
      - Detrytus 3y ago
        What if you lose your phone? In my country banks only allow you to use one phone for mobile authorization, so you can't even have a backup phone. I really wish 3DSecure was optional so I can turn it of when going to foreign vacation.
        pas 3y ago
        On a vacation I have my card (and can use PIN auth), the issue is usually online transactions ("card not present", ie. vPOS transactions).
        iggldiggl 3y ago
        … and it already brings us halfway to the point where you can't buy a new phone if you don't have a phone already.
        ec109685 3y ago
        I hardly use an iPad, but take it with me for this reason.
    - orangepurple 3y ago
      My US bank requires SMS 2FA and SMS works for free because I am connected to Wifi. I have VoWiFi enabled. My US phone plan is with a budget carrier I only pay $15 a month for voice, sms, and data.
- radicality 3y ago
  Even more funny is that in USA, the actual amount charged to the card is mutable. Take for example when you go to a restaurant and give your card, it's charged, and then you write out with a pen a tip amount, which at some future point gets added on to your charge.
  - Detrytus 3y ago
    But there are laws about that: you authorize tip with your signature, if they charge you more than you authorized, they can get in trouble. Don't see the issue here.
- zer0x4d 3y ago
  The author is wrong about this. Banks don't choose to accept incorrect name, invalid CVC, invalid exp date or wrong billing address. It's up to the user (in this case him) to enable CVC Check and AVS in his payment processor to fail payments that don't pass this check. It's also up to him/Stripe to implement 3D secure and trigger it. https://stripe.com/docs/disputes/prevention/verification#cvc-check https://stripe.com/docs/disputes/prevention/verification#cvc...
  - zaroth 3y ago
    From your link; “Radar includes a rule to block any payments that fail the CVC verification check, which you can enable or disable within the Dashboard (this doesn’t affect payments where the CVC check couldn’t be performed).” Also; “…Support for both types of AVS checks varies by country and card issuer (for example, certain countries don’t use a postal code or some card issuers don’t support street address verification)” So it appears there are cases where these checks can be enabled on your Dashboard, but skipped by Stripe or not actually performed by the issuer, I’m thinking like for prepaid cards?
swarnie 3y ago
We're talking about an industry who proudly announced instant bank to bank payments last week like 2003 has just arrived in the colonises. Don't expect speed or creativity in the US banking sector.
dahwolf 3y ago
Enabling 3-D secure on all transactions leads to lower conversion rates, therefore typically a hybrid model is used where its enabled/disabled per transaction whether it is needed based on a risk score.

by Faaak 3y ago

Isn't this solved with 3-D Secure ? Many websites (at least in the EU) implement it and if mandatory, it's impossible to buy something without 2FA (either by SMS, phone app, ...)

alsodumb 3y ago

That’s not the case in US. It’s kinda funny, but the only time Chase and Amex credit cards asked me for 2FA (I didn’t even know they had 2FA) was when I used them to purchase some things in Indian website through local payment provider (Razorpay).

lotsofpulp 3y ago
I have seen it multiple times at BestBuy.com and HomeDepot.com, and probably others.

bonzini 3y ago

"banks (usually American ones) will happily accept transactions that have incorrect full name, invalid CVV / CVC, wrong expiration date, only partial billing address provided, with incorrect ZIP code. All of the above is still not enough to trigger a 3D secure authorisation" The solution indeed is to write manual rules to trigger 3D secure.

selimthegrim 3y ago
I’ve seen verified by visa triggered a few times for online purchases
- __MatrixMan__ 3y ago
  ... Which is hell if you're in a country where your sim card doesn't work and your bank requires sms 2fa.
  - alexvoda 3y ago
    Then it's a good thing that many banks in the EU now have 3DSecure validation through the phone app instead of SMS
    - Detrytus 3y ago
      What if you lose your phone? In my country banks only allow you to use one phone for mobile authorization, so you can't even have a backup phone. I really wish 3DSecure was optional so I can turn it of when going to foreign vacation.
      - pas 3y ago
        On a vacation I have my card (and can use PIN auth), the issue is usually online transactions ("card not present", ie. vPOS transactions).
        iggldiggl 3y ago
        … and it already brings us halfway to the point where you can't buy a new phone if you don't have a phone already.
      - ec109685 3y ago
        I hardly use an iPad, but take it with me for this reason.
  - orangepurple 3y ago
    My US bank requires SMS 2FA and SMS works for free because I am connected to Wifi. I have VoWiFi enabled. My US phone plan is with a budget carrier I only pay $15 a month for voice, sms, and data.
radicality 3y ago
Even more funny is that in USA, the actual amount charged to the card is mutable. Take for example when you go to a restaurant and give your card, it's charged, and then you write out with a pen a tip amount, which at some future point gets added on to your charge.
- Detrytus 3y ago
  But there are laws about that: you authorize tip with your signature, if they charge you more than you authorized, they can get in trouble. Don't see the issue here.
zer0x4d 3y ago
The author is wrong about this. Banks don't choose to accept incorrect name, invalid CVC, invalid exp date or wrong billing address. It's up to the user (in this case him) to enable CVC Check and AVS in his payment processor to fail payments that don't pass this check. It's also up to him/Stripe to implement 3D secure and trigger it. https://stripe.com/docs/disputes/prevention/verification#cvc-check https://stripe.com/docs/disputes/prevention/verification#cvc...
- zaroth 3y ago
  From your link; “Radar includes a rule to block any payments that fail the CVC verification check, which you can enable or disable within the Dashboard (this doesn’t affect payments where the CVC check couldn’t be performed).” Also; “…Support for both types of AVS checks varies by country and card issuer (for example, certain countries don’t use a postal code or some card issuers don’t support street address verification)” So it appears there are cases where these checks can be enabled on your Dashboard, but skipped by Stripe or not actually performed by the issuer, I’m thinking like for prepaid cards?

swarnie 3y ago

We're talking about an industry who proudly announced instant bank to bank payments last week like 2003 has just arrived in the colonises. Don't expect speed or creativity in the US banking sector.

dahwolf 3y ago

Enabling 3-D secure on all transactions leads to lower conversion rates, therefore typically a hybrid model is used where its enabled/disabled per transaction whether it is needed based on a risk score.