6

People talk about making pins stronger, making the card manufacturing techniques stronger. But, in Russia when you want to open a debit card, for example, the banks ask you to assign your phone number by default so every online transaction would require SMS verification.

I have read that in America, there is no SMS verifications on cards, so it is really easy for hackers to steal a card number and then find a proxy and just go and shop the hell out of the card. Why is there no mandatory rule on phone assigning to the card?

  • Even US banks and ceditcard corporations are in the process of requiring multi-factor authentication. Apparently this is a slow migration. – Yorick de Wid Sep 5 '16 at 14:36
  • 1
    @YorickdeWid it is a way too slow, and i dont see a reason why, in terms of a coding it is no so hard to do, the main thing is just an agreement with mobile operators. The USA have most powerful banking system in the world and they cant pull this out for like 10 years already? – Vlad Sep 5 '16 at 15:28
1

A different solution is being deployed in the US for both debit and credit which mirrors to a certain degree a solution that has been in place for much of the EU. Credit and debit cards include a chip that is inserted into a card reader, generating a single-use payment credential that, if intercepted, generally cannot be reused.

Why this system and not another? Historical dynamics and inertia. The US has long had a system where the card, or card + PIN, functioned as a bearer credential. To introduce a new model where the user has to actively verify transactions using a second factor like SMS would require cooperation on the part of retailers, card brands, banks, cell network providers, not to mention users.

Of course there have long been card brands that on exceptional transactions would ask for the customer to call them, or will call themselves, to confirm. But this is the exception, far from the rule. The thing is that as much as it makes the news, fraud is simply not that common in the US, even under the card swipe system. It impacts no more than a single digit fraction of transactions.

  • While true, this doesn't affect SMS confirmation of online purchases. – Bobson Sep 6 '16 at 2:44
0

There are similar security measures available for online purchases in the US.

Verified by Visa and MasterCard SecureCode each protect online purchases, in slightly different ways.

Verified by Visa is the more flexible one:

With Verified by Visa, issuers can analyze and risk score e-commerce purchases to identify potentially fraudulent transactions. Cardholders can be asked for a password or be sent a text message with a dynamic one-time passcode to verify transactions and prevent e-commerce fraud.

MasterCard SecureCode simply requests a secondary PIN which the cardholder has previously chosen:

Once you've registered and created your own private SecureCode, you will be automatically prompted by your financial institution at checkout to provide your SecureCode each time you make a purchase with your registered credit card or debit card at a participating online merchant. Your SecureCode is quickly confirmed by your financial institution and then your purchase is completed. Your SecureCode will never be shared with the merchant. It's just like entering your PIN at an ATM.

Both require the card issuing bank to be a participant, and as mentioned before, not all banks participate.

  • I'm pretty sure the merchant has to add support as well, which is the bigger hurdle. – Bobson Sep 6 '16 at 2:43
0

Cards were not designed for on-line transactions, but only for physical ones. They are now correctly protected for that use.

e-commerce began before the banks and card systems (Visa, Mastercard...) were organized for. By default, an on-line transaction is a non validated agreement between a client and a provider. In French law, the risk is on provider side because the bank has no validated order from the account owner.

The only reliable system would be strong authentication with a personnal certificate, but it is feeled as much too complex and hard to set up, so card companies are using a second authentication factor with a mobile phone. But even the Secured by Visa system is not that secured: if one steals à woman'handbag, chances are that it contains a bank card and the associated mobile phone. And as many people are uneducated concerning information security, few phones are protected...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.