Blog Posts

Blog Archive

Why I Hate 3D Secure

By now everybody will have come across 3D-Secure, or to give it its trade names; "Verified by Visa" or "MasterCard SecureCode".

This is the system where as you click the Buy button on a website, you are magically transferred to your bank or card issuer. There you have to enter another password, your mother's maiden name or your shoe size. In theory it all seems straightforward enough but...

Each card issuer/bank has their own strength of password rules which means you end up creating a new, unique password that is instantly forgettable. Let's face it we all like to use the same password wherever we go. This way we end up writing it on a yellow sticky stuck to the side of our computers. Which is more secure?
When you jump to your bank you're not actually jumping to your bank. You're jumping to a third party service, like SecureSuite, where you enter your account and pin/password. I'm sure you'll all remember that our banks tell us frequently not to enter these details on any website other than theirs.
Sometimes the 3D-Secure service is embedded within a frame on the retailer's website. This prevents you from checking out their secure certificate (click the padlock) and ensuring they are who they say they are.

So, we're asked to give up our pins and passwords to a third party service we can't check out. Sounds more like a phishing scam than enhanced security!

You might be asking why this has happened? Well, when a card is used fraudulently it's the retailer who loses out. If a crook buys a new flat screen TV using your card, they get the TV and you get your money back. The retailer is a TV short with nothing to show for it.

If the payment went through 3D-Secure then the liability is shifted to the card issuer/your bank. This is why retailers, apparently, are in favour. However, we know from experience with Silkmoth's web retailers, there's anything from a 9% to 21% reduction in 3D-Secure sales because customers don't complete their sales. It's just too complicated/scary for them!

So the retailers still lose out and that's why I hate 3D-Secure. It's bad for everyone.

Posted: 10/12/2009 by Carl Dean (Technical Director) | with 5 comments

Filed under: 3d-secure

Comments

	Carl Dean (Technical Director)
	Hi James, I agree that PaymentSeal is a simpler process requiring fewer customer interactions and works without the need for yet another password. However, I don't see how it overcomes card fraud? The extra password required by the issuing bank in 3D Secure tries to overcome the issues of stolen card details. As such the fraud liability is shifted from merchant back to issuing bank. Does PaymentSeal shift liability from merchant to bank? Why would any merchant using hosted payment pages switch to PaymentSeal? If PaymentSeal was in place on a website would 3D secure still kick in if the card is registered? I'm guessing it would in which case it could get very frustrating for a customer. Carl
	09/04/2010 09:54:14
	Report abuse

	James Lin
	Hi Carl, PaymentSeal is the name of the method. My other choice was "End-to-End Payment Data Encryption for Online Transactions". There is no additional entities involved such as Visa's lookup directory nor the issuing bank's verification that poses as possible points of failure in a transaction (I've read postings about some bank's registration or verification page crapping out). PaymentSeal involves no more layer than current implementation: the shopper, the merchant, and the payment service provider. In actual implementation, the shopper would see a well branded payment service provider like WorldPay or Authoriza.net. I think if we call attention to the shopper that this trivial step (2 extra clicks) provides additional security at no cost, it would be an easy call to make.
	08/04/2010 19:25:15
	Report abuse

	James Lin
	Hi, This a proposal for payment service providers to implement. PaymentSeal is the name of the implementation (like 3D Secure). We do not participate in the transaction. In actual implementation, the pop-up would show the logo of a well-known payment service provider and the url also reflects that fact. You are not providing your card data to us, you are providing it to the payment gateway of the merchant who gets this data with current implementation anyways. So, essentially, you are reducing the number of people who sees your credit card in a transaction. Also, keep in mind that a payment gateway logically is better qualified to handle your credit card data than an average merchant.
	07/04/2010 19:14:26
	Report abuse

	Carl Dean (Technical Director)
	Hi James, PaymentSeal doesn't address any of the issues I have with 3D secure. In many ways it compounds them by adding another layer and another external website that the customer has to deal with. I appreciate that many people are reluctant to enter their card details into a website, but how many of those will be compelled to enter their card details into your site instead?
	07/04/2010 10:50:36
	Report abuse

	james lin
	Please take a look at this proposal: www.paymentseal.com It provides more protection for card holders without requiring registration and passwords. At the same time making the merchant PCI-Compliant. Your feedback on this method is greatly appreciated.
	06/04/2010 21:03:40
	Report abuse