16

An online company from which I regularly buy goods apparently recently upgraded their security policy.

Let's say I bought something for 73,31€. As usual this company uses 3D-Secure for the checkout process and will actually process the payment only upon shipment a few days later.

The shipment confirmation email contained a strange notice I could translate as follow:

  • Amount ordered: 73,31 €

Within the framework of the reassurance of the online payments we proceeded to the following operations:

  • Amount charged on your credit-card: 73,41 €
  • Amount credited on your credit-card: 0,10 €

The amount additionally charged appears to be random and varies from a few cents to a few euros.

I'm wondering what threat are they protecting against?

  • They received the payment, so they got the money.
  • They used 3D-Secure for a relatively low amount, so the transaction is largely covered by the bank in case of fraud.
  • It seems they are checking that the card used for the payment can also process credit, maybe a way to detect prepaid or onetime payment cards, but again: what's the point since they got the money? By the way they also had to create a new page for the users of such cards a few weeks after deploying this system, "Due to technical restrictions" as they stated it.

I just do not understand the threat they are trying to avoid, or maybe is it just some security theater made to impress customers with some crappy but unique security measure?

Improve this question
15
  • 5
    I would not be very happy with a company that does bookings like that. Now my bookkeeper can't find the 73.31 payment in my records, and has to handle two transactions for each payment. And the tax auditor will ask me what all those 0.10 micropayments are doing in my transactions.
    – user13695
    Commented Oct 26, 2015 at 11:00
  • BTW Within the framework of the reassurance of the online payments we proceeded to the following operations Weird language. What country is that company based in?
    – user13695
    Commented Oct 26, 2015 at 11:03
  • 1
    @Jay It always used to be as you describe: they take the full payment through 3DS to place a hold on the funds, and collect them once they ship. If it weren't their "explanation", I would just think of some issue with the total amount causing a 0.10 refund, but since they clearly state this is for security reasons, I cannot keep myself of wondering which security they are talking about...
    – WhiteWinterWolf
    Commented Oct 26, 2015 at 13:34
  • 1
    @WadihM.: The amount is variable (from 0.10 to 2.00), and it is not to prevent the use of prepaid or single-use card number as they had to create a dedicated page for people using them ("Due to technical restrictions"...). I wrote to their support but never had any reply on this subject (while I used to have quick reply for common order issues, so they clearly chose to ignore my question). I strongly think this is just some kind of very poor security theater, and I cannot tell if they are still using it since I now stopped using their services.
    – WhiteWinterWolf
    Commented Feb 2, 2017 at 14:27
  • 1
    If the amount is variable from 0.10 to 2.00 they could use the actual amount charged as a way of confirming they are speaking to the correct person and not an impostor in a customer service situation. For example they charge Alice 73,51 and credit her ,20 whereas they charge Bob 73,61 and credit him ,30. In a customer service situation the operator could ask Alice to specify the amount charged on her bill and if "she" says "73,61" they would know they are not talking to Alice. Similarly, a completely naive impostor would guess the charge would be 73,31 not 73,51.
    – hft
    Commented Oct 27, 2017 at 0:34

2 Answers 2

Reset to default
6
+50

Answering my own question to be able to flag it as answered and prevent it from popping up from time to time: this measure appears as a plain example of security theater.

Here are the elements leading me to this conclusion:

  • I asked their support teams then reason behind this change: while they were usually quick to answer more usual questions I never received any answer to this one.

  • The change was apparently clunky and not well thought: they had to add a special functionality to allow onetime and prepaid cards to bypass this measure a few weeks after enabling this system as, obviously, a section of their customers weren't able to proceed with the payment step anymore.

  • This process is exclusive to this website: this a good thing to impress their customers but, from a technical point-of-view, this does also mean that no one else ever wanted or felt the need of such a system. It never takes long for new and genuinely efficient security-related ideas to spread, under one form or another.

  • This process is directly noticeable by the end user, which is required for an effective security theater measure.

  • I never saw any advantage to this measure, neither did any of the other Security.SE contributors for the two last years.

If anyone has some knowledge which could change this conclusion, feel free to add your own answer, but after two years I think I can safely put this one in the security theater bin, alongside with other ideas resulting from "pseudo-security as a marketing argument", "you hired a too zealous security intern/company" and "we need to justify our budget".

Improve this answer
2
  • Your 5th point "directly noticeable" is a bit convoluted (note that is also cyclic). A visible real security measure would be a good selling point to.
    – user13695
    Commented Jan 16, 2018 at 19:52
  • @JanDoggen: My point here was more how security theater implies visibility (that's the whole point of it). As you say this doesn't work the other way around.: visibility doesn't imply security theater. But the lack of visible signs is usually a good indication that the measure is not there for theatrics.
    – WhiteWinterWolf
    Commented Jan 28, 2018 at 16:51
-1

I think I might throw some light on this matter. Some countries have strict laws for money laundering. By crediting back, they are making it sure that the card is not a onetime payment card/giftcard/prepaid card, as this cannot be traced back to the user, who is purchasing the item. Moreover, it can also be used to make sure, that in case the card is stolen, the authorities can trace back the user.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .