An online company from which I regularly buy goods apparently recently upgraded their security policy.
Let's say I bought something for 73,31€. As usual this company uses 3D-Secure for the checkout process and will actually process the payment only upon shipment a few days later.
The shipment confirmation email contained a strange notice I could translate as follow:
- Amount ordered: 73,31 €
Within the framework of the reassurance of the online payments we proceeded to the following operations:
- Amount charged on your credit-card: 73,41 €
- Amount credited on your credit-card: 0,10 €
The amount additionally charged appears to be random and varies from a few cents to a few euros.
I'm wondering what threat are they protecting against?
- They received the payment, so they got the money.
- They used 3D-Secure for a relatively low amount, so the transaction is largely covered by the bank in case of fraud.
- It seems they are checking that the card used for the payment can also process credit, maybe a way to detect prepaid or onetime payment cards, but again: what's the point since they got the money? By the way they also had to create a new page for the users of such cards a few weeks after deploying this system, "Due to technical restrictions" as they stated it.
I just do not understand the threat they are trying to avoid, or maybe is it just some security theater made to impress customers with some crappy but unique security measure?