3 ms·
For cardholder not present transactions there's 3D Secure[1], which sits in the middle of online transactions. Customers fill in their details on the merchant's
by jon-wood 12y ago
For cardholder not present transactions there's 3D Secure[1], which sits in the middle of online transactions. Customers fill in their details on the merchant's site, then redirect to a service run by their card provider which asks for some form of authentication that only the provider knows about, and then a token is passed back to the merchant which can be used to authenticated the transaction.
Much as in store transactions which aren't conducted with Chip & PIN transfer liability to the merchant, online transactions without 3D Secure will also transfer liability, giving merchants a potentially hefty incentive to verify the customer's identity.
[1] http://en.wikipedia.org/wiki/3-D_Secure http://en.wikipedia.org/wiki/3-D_Secure
- josephlord 12y agoI hate this model. Try to buy something get redirected to a 4th party (not the retailer, buyer or the bank / card issuer) and get asked to enter private secret information. It teaches all the wrong things about security.
- vertis 12y agoIn the Australian Commonwealth Bank's implementation, this is a code that they SMS to my phone. No personal details, just MFA. Works pretty well. Edit: Also, it isn't a 4th party, the bank runs the service themselves.
- josephlord 12y agoI'd be happy with that but it doesn't match the experience I have with the my credit card (or my debit card but I barely use that at all).