While making online by Debit/Credit card, instead of using OTP (received on mobile), one can use a 3D secure code (verified by visa or mastercard) which is know to user. Should this qualify for two factor authentication (as all details are what you know category but not from what you have or what you are categories)? Secondly, in case of compromised system (hacked computer) this will lead to total compromise (no forward secrecy). I know OTP through mobile is not always available (no network or network congestion problems) but using this scheme is not adding any security (in case oh co-existing adversary i.e hacked machine). Please comment.

1 Answer 1


No, asking for a password or secret answer via 3D Secure is "something you know" and not another category of authentication as the cardholder data (number, expiration date, code) could also be "something you know". To qualify for "something you have" it will need to be verified in real time.

Applications such as Google Authenticator and 2FA dongles can work offline so they would work in a situation where mobile reception is poor.

Although 3D Secure is not two factor authentication, it can add security as the 3D secure details are not sent to the merchant themselves with the rest of the cardholder data. They are often sent directly to an authentication authority such as Arcot, and then they return a code to the merchant indicating if the 3D secure details were correct and that the card processor will take on the liability for any fraud rather than the merchant. Having said that, the current implementation leaves a lot to be desired. Often the Arcot authentication page, although it is HTTPS, is loaded within an IFrame within the merchant's website, not allowing your average user to check the address bar to verify where their 3D Secure answers are being sent.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .