S wrote:

On Jun 19, 4:33 pm, David Woolley
wrote:
johannes wrote:

Depends on the internet retailer; some use it, some don't. I don't see any
problem with extra security.

As implemented, it doesn't add security, but does give the banks an
excuse to reject claims that your card was used fraudulently.

Exactly.

It could
be secure, if they taught people how to use the security in their
browsers properly and insisted that the form be served, unframed,
directly from a site with an SSL certificate for the bank. However
merchants like to present a seamless interface, where their payment
agents and banks don't appear overtly.

The confirmation phrase is snake oil. Anyone with your basic card
details can get it.

I could not agree more. In one case I only needed my birthday in
addition to my card number to set a new VbV password.

The popular use of DOB by many banks is REALLY stupid. Anyone determined
can find out.

Chris K wrote:
I spend ££££52 gazillion per year on web - Never really had problem

Of late Debit/Credit cards having been trying to persuade me to sign up
for some extra online security feature that will basically shorten my
life by one hour everytime i buy something

So far there has been a box saying "not at this time" - which i click,
finish my purchase and carry on with my otherwise pedestrian life

Just tried to buy game from Tesco, and after spending 3 weeks creating
new account and entering all my card details, etc, yaaaaaaaaaawn! i
tried to checkout and was greeted with:


"Authentication Required For Purchase"
"Your card can be registered now for Verified by Visa - a new, free
security service to help prevent unauthorised use of this card when
shopping online. It is required for this purchase, which cannot be made
without it."

"Complete the form below [...and die of boredom]"


Although the operative word is still in use here "card ****CAN*** be
registered"

It wont let me complete the purchase without completing the form - so in
fact they mean "card ****MUST*** be registered"

Slip of the tongue maybe - hope someone slips a mallet into the head of
the poster of this big brother message

Question: Is online verification now compulsory or still supposedly
optional?????????

It depends upon who issues your card. Some insist upon you using 3D
secure (Verified by Visa is one such scheme), some make it entirely
optional, while some allow you to defer it a certain number of times,
then insist upon it. However, anyone who does not choose to activate 3D
secure at the first opportunity is an idiot. If anyone gets hold of your
card details, they can create a password, lock you out of using your
card online and run up huge bills on your card. It is the online
equivalent of chip and PIN and any retailer who gets a 3D secure
verified card is very unlikely to question the purchase, as they are not
responsible if the transaction is fraudulent.

Colin Bignell

On 6/20/2010 10:55 AM, Nightjar "cpb"@ insertmysurnamehere wrote:
Chris K wrote:
I spend ££££52 gazillion per year on web - Never really had problem

Of late Debit/Credit cards having been trying to persuade me to sign
up for some extra online security feature that will basically shorten
my life by one hour everytime i buy something

So far there has been a box saying "not at this time" - which i click,
finish my purchase and carry on with my otherwise pedestrian life

Just tried to buy game from Tesco, and after spending 3 weeks creating
new account and entering all my card details, etc, yaaaaaaaaaawn! i
tried to checkout and was greeted with:


"Authentication Required For Purchase"
"Your card can be registered now for Verified by Visa - a new, free
security service to help prevent unauthorised use of this card when
shopping online. It is required for this purchase, which cannot be
made without it."

"Complete the form below [...and die of boredom]"


Although the operative word is still in use here "card ****CAN*** be
registered"

It wont let me complete the purchase without completing the form - so
in fact they mean "card ****MUST*** be registered"

Slip of the tongue maybe - hope someone slips a mallet into the head
of the poster of this big brother message

Question: Is online verification now compulsory or still supposedly
optional?????????

It depends upon who issues your card. Some insist upon you using 3D
secure (Verified by Visa is one such scheme), some make it entirely
optional, while some allow you to defer it a certain number of times,
then insist upon it. However, anyone who does not choose to activate 3D
secure at the first opportunity is an idiot. If anyone gets hold of your
card details, they can create a password, lock you out of using your
card online and run up huge bills on your card. It is the online
equivalent of chip and PIN and any retailer who gets a 3D secure
verified card is very unlikely to question the purchase, as they are not
responsible if the transaction is fraudulent.

Colin Bignell

I lost around 35% of sales when I turned it on - it's been off ever since!

"Nightjar wrote
... However, anyone who does not choose to activate
3D secure at the first opportunity is an idiot...

That's a bit strong. You could just as validly say:
"anyone who chooses to keep a card which is eligible
for 3D secure (whether activated or not) is an idiot".

"Nightjar wrote
... If anyone gets hold of your card details, they
can create a password, lock you out of using your
card online and run up huge bills on your card...

They can do that even if you *have* activated 3D secure,
as long as they know your DOB (they just say they've
forgotten your password, and reset a new one).

"Nightjar wrote
... It is the online equivalent of chip and PIN...

No it's not, because you can't bypass C&P by
just using details printed on the card & DOB...

In message , Maria
wrote

I lost around 35% of sales when I turned it on - it's been off ever since!

I often abandon purchases if these "verification" pages take too long to
come up or if they look more suspicious than usual.

I have an on-line account associated with my credit card that allows me
to change any details and make payments etc. Nowhere on the site is
there a facility for setting up a password or other information required
for the verification pages. If the credit card companies are not
interested in allowing customers to go to known and trusted site to
configure this extra information then it tells me they are not really
interested in this security measure.
--
Alan
news2009 {at} admac {dot} myzen {dot} co {dot} uk

Tim wrote:
"Nightjar wrote
... However, anyone who does not choose to activate
3D secure at the first opportunity is an idiot...

That's a bit strong. You could just as validly say:
"anyone who chooses to keep a card which is eligible
for 3D secure (whether activated or not) is an idiot".

There is a significant difference between a security feature not being
offered by the card issuer and not using one that is.

"Nightjar wrote
... If anyone gets hold of your card details, they
can create a password, lock you out of using your
card online and run up huge bills on your card...

They can do that even if you *have* activated 3D secure,
as long as they know your DOB (they just say they've
forgotten your password, and reset a new one).

A bit difficult to get that from a card cloning device though.

"Nightjar wrote
... It is the online equivalent of chip and PIN...

No it's not, because you can't bypass C&P by
just using details printed on the card & DOB...

Well, if you prefer, the card issuers state it is the online equivelant
of chip and PIN. From a retailer's point of view, both transfer the cost
of fraudulent transactions to the card issuer.

Colin Bignell

Maria wrote:
....
I lost around 35% of sales when I turned it on - it's been off ever since!

3D secure is complusory for any merchant who accepts Maestro.

Colin Bignell

In message , "Nightjar
\"cpb\"@" wrote

Well, if you prefer, the card issuers state it is the online equivelant
of chip and PIN. From a retailer's point of view, both transfer the
cost of fraudulent transactions to the card issuer.

Surely it's an attempt to pass the cost back to the individual customer?
If a Verified by Visa screen has had the correct information entered it
must have been done by the card holder.

--
Alan
news2009 {at} admac {dot} myzen {dot} co {dot} uk

On 19 June, 15:23, "Chris K" wrote:
I spend ££££52 gazillion per year on web - Never really had problem

Of late Debit/Credit cards having been trying to persuade me to sign up for
some extra online security feature that will basically shorten my life by
one hour everytime i buy something

So far there has been a box saying "not at this time" - which i click,
finish my purchase and carry on with my otherwise pedestrian life

Just tried to buy game from Tesco, and after spending 3 weeks creating new
account and entering all my card details, etc, yaaaaaaaaaawn! i tried to
checkout and was greeted with:

"Authentication Required For Purchase"
"Your card can be registered now for Verified by Visa - a new, free security
service to help prevent unauthorised use of this card when shopping online.
It is required for this purchase, which cannot be made without it."

"Complete the form below [...and die of boredom]"

Although the operative word is still in use here "card * *****CAN***
be registered"

It wont let me complete the purchase without completing the form - so in
fact they mean "card * * ****MUST*** * be registered"

Slip of the tongue maybe - hope someone slips a mallet into the head of the
poster of this big brother message

Question: Is online verification now compulsory or still supposedly
optional?????????

P.S. Oh yeah - cancelled the purchase and bought game from play.com instead

Each time I was told I had to do this I simply went to a trader that
didn't buy into this game. Now, without exception, I am no longer
asked to verify the card. Clearly the retailer is not pleased when
customers give up the purchase in preference to compling with further
invasive security measures.

Turk182

Alan wrote:
In message , "Nightjar
\"cpb\"@" wrote

Well, if you prefer, the card issuers state it is the online
equivelant of chip and PIN. From a retailer's point of view, both
transfer the cost of fraudulent transactions to the card issuer.

Surely it's an attempt to pass the cost back to the individual customer?
If a Verified by Visa screen has had the correct information entered it
must have been done by the card holder.

As I pointed out earlier, if the legitimate card holder has not set up
3D secure, then anyone who gets the card details, for example by
cloning, then that person can set up the 3D secure password and have all
subsequent transactions verified.

While it is very much less common to come across suspicious transactions
since 3D secure came in, it still does happen and sometimes with full
authorisation of the card.

Colin Bignell