2

I tried making a purchase from http://www.laptop-batteries.ca/ but on the very last step the page reloaded with an error. A representative contacted me asking why I didn't complete the order and I said the webpage had an error and he said

use Credit card must pass 3d certification

and provided me with a link to do so (see addendum). Is this legit or am I being scammed? What is 3D authentication, is it like PCI compliance? I would really like to purchase a laptop power adapter because I live in Canada and other retailers (e.g. Amazon.com) charge a ton when shipping here.

Addendum: why is the following link not allowed?

hxxp://make%203D%20authentication,you%20can%20Look%20https://acs.onlinesbi.com/sbi/enrollment/enroll_welcome.jsp

Addendum 2: I'm not sure how I got the link above but here it is again https://acs.onlinesbi.com/sbi/enrollment/enroll_welcome.jsp

  • Would you be so kind to include the HTML version of the email by adding them into encoded tags? – Lucas Kauffman Nov 19 '13 at 9:50
  • Have you read that link more closely, it contains two seperate urls, one of which is a 3DSecure link, as mentioned in Lucas' answer, and of which is using an obscured protocol, and contains a plaintext message, urlencoded. I think the chances are that this is a settings problem, and you needed to put the 3DSecure in correctly, but have added it to the end? Possibly? – Owen Nov 19 '13 at 9:51
  • @LucasKauffman I don't understand what you mean – Celeritas Nov 19 '13 at 10:00
  • Well the link you provided is garbled, I want to see the original. – Lucas Kauffman Nov 19 '13 at 10:19
  • @LucasKauffman I added the link again. I have no clue how it got garbled the first time. – Celeritas Nov 19 '13 at 10:36
4

From Wikipedia:

3-D Secure is an XML-based protocol designed to be an additional security layer for online credit and debit card transactions. It was developed by Visa with the intention of improving the security of Internet payments and is offered to customers under the name Verified by Visa.

NOTE that your link is garbled, it might be that he is trying to redirect you to a fraudulent site adding a link into an html form to make you think you are going to your bank's website, but instead you are being redirected to a phishing website.

In your case they want you to go to: https://acs.onlinesbi.com/sbi/enrollment/enroll_welcome.jsp

But they seem to add something to the front which might redirect you to another website.

If you are indeed redirected to this website, check the URL and verify the certificate:

enter image description here

If you are not a customer of the SBI or you are not being redirected to this website with a valid certificate for the SBI as shown above then I would not continue anymore.

1

3D Auth is a system used by providers of cards that adds another factor of authentication by forwarding the user to an HTTPS page on which they are asked for a password, which is pre-set with their bank.

Reliability depends on the implementation - different banks work in different ways - but in all cases, an extra factor is a useful feature unless it inadvertently introduces an insecurity (by either opening security holes in the code, or by coaxing users to indulge in insecure practices like writing their 3DSecure password on their card or something like that.

Some banks implement 3DSecure for all transactions, some randomly, and some for certain amount thresholds. For example, NatWest (UK) uses it for all, Halifax (UK) only for amounts above a certain level, and HSBC seems to use a selective system that picks some transactions to authenticate this way - so security provided by 3DSecure varies.

EDIT: Misunderstood that you were a client, not sysadmin - If you're persistently getting validation errors with an ecommerce app you attempt to buy from, I'd try somewhere else, and review your online banking to check for unusual activity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.