Stephen2 wrote:
Has anyone used this system and did it work? Recently I made an online
payment to tmobile through my tmobile account. Part of the way through
the process the Mastercard Securecode window popped up and prompted me
for some details. At first I thought it was a scam or some phishing

On what basis did you decide it was not? I suspect you will find that
you were talking to some non-EEC system with no obvious connection with
Mastercard. At least that is the case if you try and pre-register for
Verified by Visa, and, I'm pretty certain, Securecode. What I don't
know, but suspect, is that that is still the case when you subsequently
get verified.

Chances are that it was legitimate, but see my recent, "Verifying Vefied
by Visa" thread.

thing. Anyway, I continued along and it told me I had failed

If you provided existing credentials, not pre-registered for Securcode,
there is a serious usability problem with security implications. You
should change the credentials you gave to it, on the system to which
they really belong.

authentication, however the payment still went through.
Now o2 are using the same system but my payment didn't get through
when I failed authentication this morning.

Does the Securecode system offer any advantage over the previous
method of online payment. Seems a total pain to me.

I've deferred registering with VbV and I haven't used Mastercard online,
for a long time, but, does the system authenticate itself to you, and
does that authentication depend on a shared secret, but not pass it over
the wire? If not, it is vulnerable to a man in the middle attack, and
you need to check the SSL certificate and ignore the way it
authenticates itself to you.

Unfortunately, the number of people who know enough to challenge the
authenticity of these systems is so small that they can't get beyond the
first line support people.