Nowadays, when someone is making an online payment, the associated bank often requires an authentication step.
As far as I know, there are mainly two ways to do this:
- SMS Verification. The Bank sends an SMS to the client with a specific code that should be stated on the authentication web page.
- Indicate the date of birth. Instead of entering a code, the authentication web page only requires the date of birth of the client.
It seems that the second version is less secure than the first one, as the date of birth is an information that can be found easily from the fact that people provide it on many websites.
So why banks do not only use the SMS verification instead? Does it imply some protocol complications?