Friday, April 30, 2010

Terrified by VISA


On many occasions already, I have been "burnt" by one new feature that VISA system is rolling out now: 3DS (3D-Secure). It is also known by name "Verified by VISA".
This feature involves a third-factor authentication - an additional password one should know in order to perform online transactions - but ONLY AT 3DS-ENABLED sites.
Sounds funny, isn't it? Does VISA think that I would 'prefer' to shop at the very sites that give me this nuissance? Here's my recap.
Of the three different sites that had this feature enabled, none of them really worked for me. I opened trouble tickets in all of respective companies' systems.

It took me few rounds to make sure the issue is not pushed into my issuer bank. Obviously, it's easier for a merchant to ask you try contacting your bank - then they don't have to debug the process and interact with different parties themselves.
OK I took that advice - not happy with results though.

The first thing that strikes you as a consumer, that once you enter you card details in a secured merchant's site, once the 3DS-enabled site determines that your card is a subject to that weird security experiment, they redirect you to a third-party site!
Without letting you know what's gonna happen. So, in my case, when I filled the card details and clicked "submit" i was struck by a pop-up window at obscure address (www5.arcot.com) which required me to re-enter my card details PLUS the 3DS password (which I did not have then).

Now, didn't this look exactly like phishing, to my unsuspecting eye?

OK I did some research and found out what that was about. Now, I needed the 3DS password. I called up my bank, and they were able to supply me one.
But still, the system just did not work!

Secondly, why would I need a separate password, when I have my PIN already?!?
Why not use that? Or my online banking password, which would be checked by sending request to my bank, not to a third-party, cloud-based, untrusted-by-me, server.

After some rounds of talking to the parties involved, I decided to
"opt-out" of this 3DS joke and called up my bank to do that.
They were unable to do that, quoting VISA as my contact point.
VISA did not do that favour to me either!

All I could do is switch to my other card. My credit MasterCard.

I am not getting a VISA for me next time.

No comments: