When paying online with a credit card, what is "3D authentication" and is it reliable?

Question

I tried making a purchase from http://www.laptop-batteries.ca/ but on the very last step the page reloaded with an error. A representative contacted me asking why I didn't complete the order and I said the webpage had an error and he said

use Credit card must pass 3d certification

and provided me with a link to do so (see addendum). Is this legit or am I being scammed? What is 3D authentication, is it like PCI compliance? I would really like to purchase a laptop power adapter because I live in Canada and other retailers (e.g. Amazon.com) charge a ton when shipping here.

Addendum: why is the following link not allowed?

hxxp://make%203D%20authentication,you%20can%20Look%20https://acs.onlinesbi.com/sbi/enrollment/enroll_welcome.jsp

Addendum 2: I'm not sure how I got the link above but here it is again https://acs.onlinesbi.com/sbi/enrollment/enroll_welcome.jsp

Answer 1

From Wikipedia:

3-D Secure is an XML-based protocol designed to be an additional security layer for online credit and debit card transactions. It was developed by Visa with the intention of improving the security of Internet payments and is offered to customers under the name Verified by Visa.

NOTE that your link is garbled, it might be that he is trying to redirect you to a fraudulent site adding a link into an html form to make you think you are going to your bank's website, but instead you are being redirected to a phishing website.

In your case they want you to go to: https://acs.onlinesbi.com/sbi/enrollment/enroll_welcome.jsp

But they seem to add something to the front which might redirect you to another website.

If you are indeed redirected to this website, check the URL and verify the certificate:

If you are not a customer of the SBI or you are not being redirected to this website with a valid certificate for the SBI as shown above then I would not continue anymore.

Answer 2

3D Auth is a system used by providers of cards that adds another factor of authentication by forwarding the user to an HTTPS page on which they are asked for a password, which is pre-set with their bank.

Reliability depends on the implementation - different banks work in different ways - but in all cases, an extra factor is a useful feature unless it inadvertently introduces an insecurity (by either opening security holes in the code, or by coaxing users to indulge in insecure practices like writing their 3DSecure password on their card or something like that.

Some banks implement 3DSecure for all transactions, some randomly, and some for certain amount thresholds. For example, NatWest (UK) uses it for all, Halifax (UK) only for amounts above a certain level, and HSBC seems to use a selective system that picks some transactions to authenticate this way - so security provided by 3DSecure varies.

EDIT: Misunderstood that you were a client, not sysadmin - If you're persistently getting validation errors with an ecommerce app you attempt to buy from, I'd try somewhere else, and review your online banking to check for unusual activity.