Hacker News Reader

Comment by eddd-ddde | Hacker News Reader

I've never had to authenticate with a bank for using a card? Is this common for you?

MFA is required in the EU:

https://en.wikipedia.org/wiki/Strong_customer_authentication

Really interesting, here in Mexico I think that's unheard of, what I have to use is a digital card with a dynamic 3 digit cvv that's generated on my app.

That’s functionally equivalent.

It's 3ds, I don't know if it's because of some regulation but with my current (european) bank it's always compulsory.

And a credit card I've got recently also asks for a second code, after the 3ds code.

The regulation for this is PSD2.

https://en.wikipedia.org/wiki/Payment_Services_Directive

By the way, the last time I checked using 3ds means that it's "impossible that the transaction was fraudulent" and thus you can't cancel it

Yep, that's why it caught on by shop despite being a friction.

I've heard it presented more as that the merchant isn't on the hook for a chargeback because they did the "best practice" in terms of preventing it.

Yikes, what happens if you've had your devices/credentials stolen? Are you held liable for the transaction without recourse?

What actually happens is with 3DS: a merchant gets liability shift. Liability resides with the issuer then. Whether you as a customer can be held liable for damages depends on your jurisdiction and when you report your devices / credentials stolen.

> it's always compulsory

No, it's the shop that decides actually. More and more accepts do direct payments from card numbers without additional checks, by the way.

Pretty common in Europe these days, due to PSD2 regulation.

I have a Mastercard branded card issued by the Dutch quasi-monopolist (ICS). Every time I have a transaction with a merchant with ties to NL, they force me to do 2FA using their crappy app.

I have no words to express how much I hate this.

When I use my AMEX card online it sometimes does an extra "validation" step but as I recall I don't have to interact with it. It's probably checking location, etc, and deciding if further validation is necessary.

Have never seen that with VISA or MC.

Years ago I had to do that sometimes, but I haven't gotten prompted to authenticate my credit card with my bank in quite a long time. I thought maybe it just went out of style, but I guess some people still use it.

I'm in the US, and for some purchases I have to. There's like an iframe in which I have to log into my credit card account, and approve the transaction.

I'm not sure what triggers it.

If the bank fears the charge is fraudulent sometimes I've had to do it. But normally I don't.

If its the 'verified by visa' thing, it is in fact optional and you can cancel out of the wizard

Reply on news.ycombinator.com