Our bank refunded it alright, though it took about a month, but the next week I received an SMS with a 3D Secure confirmation number for a similar payment, in HKD, with my own card (by the way, the only place we used both cards for payments was Taobao). I was able to call my bank which blocked the card and quickly issued me a new one. At least in this case it both saved us, our bank and some unknown online shop, time and money.
Also, I think the smart way to do 3D Secure is what capitainetrain.com does, they use it only for the first payment of a customer (and explain what's going to happen during the payment process) and all subsequent purchases don't go through it (since the customer has already been verified as being legitimate). It only works when you expect customers to come back regularly, though.
Using customers birthdate is indeed a very poor authentication mechanism, but even that is going to defeat the majority of fraudsters who are simply trying to bulk-authenticate a list of CC numbers. Personally, I don't give my real birthdate to any website unless they have a very good reason for knowing it.
My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers, etc.
But since the actual authentication mechanism is left up to the card issuer, there's nothing to prevent them using more advanced systems - like 2-factor authentication, hardware tokens, etc.
How can the bank know what any of the letters in your password are unless they are storing it insecurely?
It's not a good solution anyway. A phishing page could easily claim the entered password was wrong and ask for another one (starting at another offset). Most passwords are probably <= 9 characters, so you'd have the full password after 3 attempts.
Fishing attacks are difficult because the attacker would have to be able to determine which bank a card was issued by, and present the correct 3D secure interface specific to that issuer. Many issuers also add a customer-personalised image or message to the interface to further reassure customers of authenticity.
The only alternative I can think of is that they'd also create and store a hash of every possible three-letter combination based on your password which does not seem likely.
It works as follows:
- Merchant redirects me to his payment provider
- I enter my debit/credit card number into the payment provider screen
- I am redirected to my bank website, and am able to verify the URL (no iframes anymore!)
- My bank has two methods of verification: scanning a QR-code with the mobile banking app on my phone, or logging into the online banking website (with a Vasco DIGIPASS 836, which requires a debit card+pin to generate a OTP)
- I verify the amount and creditor in the mobile/online banking app, and sign the transaction with my mobile pin/digipass.
- I am redirected back to the merchant.
All in all, I think it costs me 30 seconds to complete the extra 3D-Secure steps when using my mobile banking app.
Everyone uses it now in the UK and you always get redirected to the exact same page. I expect it, it doesn't put me off buying.
So it's a bad objection to the system, because once everyone's using it, it becomes the norm. Yes, there will be a dip in conversions to begin with as consumers are scared by the new page, but it will recover. Some people's implementation sucks, but that's a different matter.
It's a complete flip of a coin whether the dodgy collection of forwards and cookies and iframes will go wrong somewhere, and such failures are always handled in the most user-hostile ways. I can completely understand why Amazon and so many other retailers just don't bother with it.
https://econsultancy.com/blog/3887-verified-by-visa-a-conver...
Visa's own documents now recommend only using Verified By Visa on transactions that look suspicious after running risk analysis, and cite that using it on all transactions was resulting in a 3 - 5% Abandonment rate in the UK.
"Higher conversion rates – following the implementation, abandonment dropped from over 4% to under 1%"
http://www.visaeurope.com/media/images/44933_visa_vbv_case_s...
Given how few sites actually implement it, it becomes a pain to use if you have to dig out the password or set it up on first use.
https://www.hackerneue.com/item?id=10235328
That redirect will kill conversion rates too, being redirected to a site you didn't expect claiming to be your bank but not matching its URL... of course it will freak some people out. Consider that some banks make the Verified By Visa password the customer's birthday (ie something easily researched) and you quickly realize it's a horrible system.