Hacker News Reader

Comment by cjg_ | Hacker News Reader

Online transactions using Visa's 3DSecure/Verified by Visa or MasterCard SecureCode will shift liability to consumer though.

View on HN

I think 3DS may work better in Europe, but here in the U.S., it just doesn't.

It requires the use of a password, and adds additional steps to the checkout process. You can't really make it mandatory on your store, as conversions/sales would crumble. So, you make it optional.

If it's optional, only the most security conscious customers end up using it. Those are the customers with the lowest risk of having their card info stolen, and the most likely to report it quickly if the info is stolen.

So it adds more protection around a tiny fraction of your sales...the sales that were already very unlikely to be fraudulent.

It doesn't make any notable change to "the cost of online fraud in the US is 100% on the merchant/seller".

Why would 3D-Secure work better in Europe than in the United States? I fail to understand that from reading your comment.

Yes, it requires extra authentication (My issuing bank has chosen password as the auth - some others use the bank code boxes for One Time Tokens). All online stores that I routinely buy from in Sweden and in Europe have 3D-Secure turned on. The only exception I've encountered is an airline.

The customers don't get to choose - it's not optional for customers. It's optional for merchants/shops. If they however disable 3D-Secure: They're liable though.

Are you sure about that? The Verified by Visa site says that the liability shift is to the card issuer, not to the consumer:

https://usa.visa.com/run-your-business/small-business-tools/...

Ah yeah, but many issuers push it down to the consumer, basically the same case as when you've given the card PIN away.

I don't think this is true. So many shops these days sell fulls (inc SSN, DOB) at reasonable prices, some including even VBV/MSC passwords; you can filter by non-VBV/MSC as well, making VCV/MSC useless.

And if you really know where to look, the ability to look up someone's SSN will only cost you a buck or two.

Reply on news.ycombinator.com