Hacker News Reader

Comment by TheOtherHobbes | Hacker News Reader

UK banks sometime sends payments to a separate verification page which either returns automatically or asks further security questions.

I don't think this form is going to work with those banks.

A couple of takeaways:

1. This has been a standard problem for twenty years now. Why are designers and developers still having to reinvent the wheel?

2. Reinventing the wheel is really hard. If you want to support international trade, card and address formats are a non-trivial problem. It's easy to get something 90% right, but those edge cases will kill you and piss off your customers.

I suppose in an ideal world the card industry could think about standardised industry-approved forms with international support and customisable CSS. Maybe they'll get around to it in another twenty years or so.

Considering the incredible size of the financial industry, its inability to create efficient friction-free payment systems is shameful.

View on HN

> UK banks sometime sends payments to a separate verification page which either returns automatically or asks further security questions.

Ahh, 3D Secure/Verified By Visa/MasterCard SecureCode.

It really needs to die right now. Basically it teachers consumers to fill in random iframes on merchant sites.

And the fact that the card industry thinks 3D Secure is secure or in any way a good idea is why they'll never make standardised forms.

The worst thing about these programs is the liability shift. Normally the merchant is left on the hook for fraudulent transactions.

With VbV and 3DS that liability passes back to the credit card company. Since the credit card company doesn't want that liability, and obviously there are no security holes in their system, then only one person can be responsible for not taking adequate care of their card and security details. Yep, you the consumer (read your small print).

Hence, by signing up for any of these programs as a consumer, you are shooting yourself in the foot.

Added to which, the program has been shown to be insecure, since if you hold the card in your hand (i.e. you skimmed the card), you can/could simply choose to reset your password: http://www.alphr.com/realworld/373768/the-security-hole-in-v...

Thing is it is very difficult to not be signed up for 3D Secure/VbV/SecureCode. I've had friends who have gone through ludicrous arguments with banks to get them opted out from 3D Secure.

I have been unable to be opted out from 3D Secure. It just doesn't seem to be possible. The argument the credit card companies usually use is that they aren't forcing it on us; it's the merchants, who set a flag in the transaction saying they require it.

If you know how to opt out of it, I'd love to know.

It does seem to work that way, I'm sure I've signed up for Verified by Visa but I've only had to use it once or twice. Which makes me happy, because I hate it.

A friend of mine told me his bank let him opt out. He just pestered them a lot.

The implementation is up to the bank. My banks use 2-factor authentication solutions for 3DSecure (one has you put the chip in a special reader, the other uses a mobile app)

https://www.flickr.com/photos/kalleboo/2486214902

Yes - and if you look at the source URL (mostly hidden if they use an iframe, or sometimes visible if they do a complete page redirect), then the hostname is often a completely unrelated, unintelligible name that no-one would associate with either the shop or the card company. These are exactly the websites that you should NOT trust!

Worse than that, it's all bounced through a site called securesuite.co.uk. Take a look:

https://securesuite.co.uk/

Impressed?

"Please type in a whole load of other personal information" Nope! I get a good feeling of petty bureaucratic victory every time I see a site bounce in and out of Verified by Visa since I persuaded my bank to opt me out.

It is basically up to merchant what to implement. I ever developed a site (in team) for South East Asia customer. Singapore law and Indonesia law are pretty much have freedom in it. You can choose 2D / 3DS. Yes, the different is pretty clear: who will responsible for the fraud. For 2D, merchant is responsible for fraudulent transaction -- and merchant can be charged back; while in 3DS the merchant will free from chargeback (hey you have been notified via two-factor authentication, so it is your fault, customer!)

Meanwhile, in Malaysia, all credit card transaction must be in 3DS.

My UK bank (Lloyds) cannot handle non ASCII symbols in the address fields for IBANN payments. Drives me crazy every time as most places I make payments to have at least a few å or ë letters in them. How someone could create such a form without testing it on a bunch of international addresses is boggling.

It's in their interests to make it inefficient. Payment gateways are a large source of revenue for banks. An efficient, friction-free payment system would likely make these payment gateways redundant, and hence, remove a revenue stream for banks.

This is why people use payment gateways.

Even in the UK when using payment gateways (by which I presume you mean PayPoint/Protex/WorldPay etc and you're a "merchant") you still, in many cases, need to use 3D Secure/VbV/SecureCode if you wish to remove being the liable party for fraudulent card use.

Reply on news.ycombinator.com