Verified by Visa (VBV)
Verified by Visa helps prevent people using your details without your
permission. And it’s good for retailers who want to make sure their
customers are protected.
When you complete your payment with Verified by Visa, your bank is
able to make additional security checks to ensure your card details
have not been compromised. Your bank wants to make sure that it’s
really you making the purchase before they authorise the payment.
After all, nobody would expect to take cash out of an ATM without
using their PIN. Your bank wants to give you the same high standards
of protection on the internet as well. VISA
As I understand the legacy payment system using CVV, exclusive, only requires three things: Card Number, Expiry Date and CVV. Anything else should not matter. However, this is why Verified by MasterCard and Verified by Visa came about, to mitigate this attack vector.
What do they do with my personal information which are not my banking card information?
This can relate to the individual countries money laundering laws. Equally, this could be for their records, to detour fraudsters from committing fraud. As I understand, credit card (MagStripe and CVV) is not particularly difficult. Although, this is not a huge issue for the customers as authorisation hold is performed. Could the legacy system have been better, yes!
Is it their own policy or an international banking policy?
If approached by the police, then they have records:
- Card details
- 'Owner name'
- Transaction time and date
What happens if I just put James Bond born in 1980 living in 9000 South Pole Street, South Pole instead of my personal information (as long as my banking card information is correct)?
If a legacy payment system is used, then this should work. This is difficult to make a statement about because individual companies do not publish the source code for their antifraud systems. Hence, some conjecture with reverse engineering needs to be done here. But, this is why VBV and VBMC exist. To make this type of fraud more difficult.
So, the company's anti-fraud system should check:
- Does our personal information match the card details?
- Should additional verification be performed?
- Is the email address domain from a 'blacklisted' domain?
In England, Anti Money Laundering Acts, require companies to validate each user with: government issue ID, utility bill, and sometimes a webcam chat. Before their account is marked as 'verified'. This is behaviour is seen with exchanges, LocalBitcoins encourages this model.