3-D Secure
From Wikipedia, the free encyclopedia
3-D Secure is an XML-based protocol used as an added layer of security for online credit and debit card transactions. It was developed by Visa to improve the security of Internet payments and offered to customers as the Verified by Visa service. Services based on the protocol have also been adopted by MasterCard, under the name MasterCard SecureCode, and by JCB International as J/Secure.
3-D Secure adds another authentication step for online payments. Merchants are encouraged to use 3-D Secure by higher coverage against fraud losses. When a merchant does not use 3-D Secure they are liable for fraudulent transactions even if the transaction was properly authorized.
3-D Secure should not be confused with the Card Security Code which is a short numeric code that is printed on the card.
Contents |
[edit] Description and basic aspects of the protocol
The basic concept of the protocol is to tie the financial authorization process with an online authentication. This authentication is based on a three domain model (hence the 3-D in the name). The three domains are:
- Acquirer Domain (the merchant and the bank to which money is being paid).
- Issuer Domain (the bank which issued the card being used).
- Interoperability Domain (the infrastructure provided by the credit card scheme to support the 3-D Secure protocol).
The protocol uses XML messages sent over SSL connections with client authentication (this ensures the authenticity of both peers, the server and the client, using digital certificates).
A transaction using Verified by Visa/SecureCode will initiate a redirect to the website of the card issuing bank to authorize the transaction. Each issuer could use any kind of authentication method (the protocol does not cover this) but typically, a password-based method is used, so to effectively buy on the Internet means using a secret password tied to the card. The Verified by Visa protocol recommends the bank's verification page to load in an inline frame session. In this way, the bank's systems can be held responsible for most security breaches.
The main difference between Visa and MasterCard implementations resides in the method to generate the AAV (Accountholder Authentication Value): MasterCard uses UCAF (Universal Cardholder Authentication Field) and Visa uses CAVV (Cardholder Authentication Verification Value).
[edit] Implementing the protocol
The specifications are currently at version 1.0.2. Previous versions 0.7 (only used by Visa USA) and 1.0.1 have become redundant and are no longer supported. MasterCard and JCB have adopted version 1.0.2 of the protocol only.
In order for a Visa or MasterCard member Bank to use the service, the bank has to operate compliant software that supports the latest protocol specifications. Once compliant software is installed, the member bank will perform Product Integration Testing with the Payment System Server before it rolls out the system.
[edit] ACS Providers
In 3-D Secure protocol, ACS (Access Control Server) is on the issuer side (banks). Currently, most banks outsource ACS to third party. This means the buyer's web browser shows unfamiliar domain names instead of the banks' domain names.
[edit] MPI Providers
Each 3-D secure transaction involves two simple internet request/response pairs: VEReq/VERes and PAReq/PARes. Visa and MasterCard don't license merchants for sending requests to their servers. They isolate their servers by licensing software providers which are called MPI (Merchant Plug-in) providers.
[edit] Merchants
The advantage for merchants is the reduction of "unauthorized transaction" chargebacks. The disadvantage for merchants is that they have to purchase MPI to connect to the Visa/MasterCard Directory Server. This is expensive (setup fee, monthly fee and per-transaction fee); at the same time it represents additional revenue for MPI providers. Supporting 3-D Secure is complicated and, at times, creates transaction failures.
[edit] Buyers/Credit Card Holders
The advantage for buyers is when his/her card is activated by 3-D Secure, a login/password must be provided. According to the current 3-D Secure protocol, MPI and merchants don't know this information, only the buyer's bank and ACS provider can validate it. This makes online payment safer than just AVS and CVV matching mechanism.
The disadvantages are that the current protocol is unfriendly to buyers when they see the web browser connect to unfamiliar domain names (MPI and outsourced ACS) and extra traffic delays. And of course the buyer has to remember a password. The password must contain at least two numbers, at least one uppercase letter and at least one lowercase letter. Previous passwords cannot be reused.
[edit] Criticism
The "Verified by Visa" system has drawn some criticism,[1] [2] [3] since it is hard for users to differentiate between the legitimate Verified by Visa pop-up window or inline frame, and a fraudulent phishing site. This is because the pop-up window is served from a domain which is:
- Not the site where the user is shopping.
- Not the card issuing bank
- Not visa.com or mastercard.com
Indeed, the Verified by Visa system has been mistaken by users for a phishing scam[4] and has itself become the target of some phishing scams[5]. The newer recommendation to use an inline frame (IFrame) instead of a popup has reduced user confusion, but at the cost of making it harder for the user to verify that the page is genuine in the first place—as of 2008, most web browsers do not provide a simple way to check the security certificate for the contents of an iframe.
Some card issuers also use Activation During Shopping (ADS)[6], in which cardholders who are not registered with the scheme are offered the opportunity of signing up (or forced into signing up) during the purchase process. This will typically take them to a form in which they are expected to confirm their identity by answering security questions which should be known to their card issuer. Again, this is done within the iframe where they cannot easily verify the site they are providing this information to—a cracked site or illegitimate merchant could in this way gather all the details they need to pose as the customer.
Cardholders who are not willing to take the risk of registering their card during a purchase, with the commerce site controlling the browser to some extent, can instead go to their bank's home page on the web in a separate browser window and register from there. When they go back to the commerce site and start over they should see that their card is registered. The presence on the password page of the Personal Assurance Message (PAM) that they chose when registering is their confirmation that the page is coming from the bank. This still leaves some possibility of a man-in-the-middle attack if the card holder cannot verify the SSL Server Certificate for the password page. Some commerce sites will devote the full browser page to the authentication rather than using a frame (not necessarily an iFrame, which is a less secure object anyway). In this case the lock icon in the browser should show the identity of either the bank or the operator of the verification site. The cardholder can confirm that this is in the same domain that they visited when registering their card, if it is not the domain of their bank.
When signing up for "Verified by Visa" in the USA the user is required to enter last 4 digits of their social security number. If the digits are incorrect, the user gets to try a different combination and the number of attempts is unlimited. This makes it theoretically possible to "guess" someone's last four social security digits, simply by trying all numbers from 0001 to 9999. Most if not all sites will lock an account out of registration, without blocking offline use of the card, after a small number of errors.
If the buyer has forgotten his or her password, he or she is allowed to create a new password and then continue with the transaction. In the UK, the information required to reset the password is: The card number, the three-digit card security code, the expiry date, the card holder's name, and the birth date of the card holder. Since the card holder's date of birth is the only additional piece of information required beyond that needed for a purchase without 3-D Secure, the buyer's password is, effectively, only as secret as his or her date of birth.
[edit] See also
- eCommerce
- Secure electronic transaction (SET)
- Merchant Plug-In (MPI)
[edit] References
- ^ antiworm: Verified by Visa (Veriphied Phishing?)
- ^ Industry lays into 3-D Secure - 11 Apr 2008 - IT Week
- ^ Verified by Visa scheme confuses thousands of internet shoppers | Money | The Guardian
- ^ Is securesuite.co.uk a phishing scam?
- ^ Verified By Visa Activation - Visa Phishing Scams - MillerSmiles.co.uk
- ^ http://www.visaeurope.com/documents/vbv/verifiedbyvisa_activationduringshopping.pdf Activation During Shopping
