3-D Secure

In the 3-D Secure protocol, the ACS (access control server) is on the issuer side (banks). Currently, most banks outsource ACS to a third party. Commonly, the buyer's web browser shows the domain name of the ACS provider, rather than the bank's domain name; however, this is not required by the protocol. Dependent on the ACS provider, it is possible to specify a bank-owned domain name for use by the ACS.

Each 3-D Secure version 1 transaction involves two Internet request/response pairs: VEReq/VERes and PAReq/PARes.[7] Visa and Mastercard do not permit merchants to send requests directly to their servers. Merchants must instead use MPI (merchant plug-in) providers.

The system involves a pop-up window or inline frame appearing during the online transaction process, requiring the cardholder to enter a password which, if the transaction is legitimate, their card-issuing bank will be able to authenticate. The problem for the cardholder is determining if the pop-up window or frame is really from their card issuer when it could be from a fraudulent website attempting to harvest the cardholder's details. Such pop-up windows or script-based frames lack any access to any security certificate, eliminating any way to confirm the credentials of the implementation of 3-DS.

The Verified-by-Visa system has drawn some criticism,[11][12][13][14] since it is hard for users to differentiate between the legitimate Verified-by-Visa pop-up window or inline frame, and a fraudulent phishing site. This is because the pop-up window is served from a domain which is:

• Not the site where the user is shopping
• Not the card issuing bank
• Not visa.com or mastercard.com

In some cases, the Verified-by-Visa system has been mistaken by users for a phishing scam[15] and has itself become the target of some phishing scams.[16] The newer recommendation to use an inline frame (iframe) instead of a pop-up has reduced user confusion, at the cost of making it harder, if not impossible, for the user to verify that the page is genuine in the first place. As of 2011, most web browsers do not provide a way to check the security certificate for the contents of an iframe. Some of these concerns in site validity for Verified-by-Visa are mitigated, however, as its current implementation of the enrollment process requires entering a personal message which is displayed in later Verified-by-Visa pop-ups to provide some assurance to the user the pop-ups are genuine.[17]

Some card issuers also use activation-during-shopping (ADS),[18] in which cardholders who are not registered with the scheme are offered the opportunity of signing up (or forced into signing up) during the purchase process. This will typically take them to a form in which they are expected to confirm their identity by answering security questions which should be known to their card issuer. Again, this is done within the iframe where they cannot easily verify the site they are providing this information to—a cracked site or illegitimate merchant could in this way gather all the details they need to pose as the customer.

Implementation of 3-D Secure sign-up will often not allow a user to proceed with a purchase until they have agreed to sign up to 3-D Secure and its terms and conditions, not offering any alternative way of navigating away from the page than closing it, thus suspending the transaction.

Cardholders who are unwilling to take the risk of registering their card during a purchase, with the commerce site controlling the browser to some extent, can in some cases go to their bank's home page on the web in a separate browser window and register from there. When they return to the commerce site and start over they should see that their card is registered. The presence on the password page of the personal assurance message (PAM) that they chose when registering is their confirmation that the page is coming from the bank. This still leaves some possibility of a man-in-the-middle attack if the cardholder cannot verify the SSL server certificate for the password page. Some commerce sites will devote the full browser page to the authentication rather than using a frame (not necessarily an iFrame), which is a less secure object. In this case, the lock icon in the browser should show the identity of either the bank or the operator of the verification site. The cardholder can confirm that this is in the same domain that they visited when registering their card if it is not the domain of their bank.

Mobile browsers present particular problems for 3-D Secure, due to the common lack of certain features such as frames and pop-ups. Even if the merchant has a mobile web site, unless the issuer is also mobile-aware, the authentication pages may fail to render properly, or even at all. In the end, many analysts have concluded that the activation-during-shopping (ADS) protocols invite more risk than they remove and furthermore transfer this increased risk to the consumer.

In some cases, 3-D Secure ends up providing little security to the cardholder, and can act as a device to pass liability for fraudulent transactions from the bank or retailer to the cardholder. Legal conditions applied to the 3-D Secure service are sometimes worded in a way that makes it difficult for the cardholder to escape liability from fraudulent "cardholder not present" transactions.[19]

Banks and merchants may use 3-D Secure systems unevenly with regard to banks that issue cards in several geographic locations, creating differentiation, for example, between the domestic US- and non-US-issued cards. For example, since Visa and Mastercard treat the unincorporated US territory of Puerto Rico as a non-US international, rather than a domestic US location, cardholders there may confront a greater incidence of 3-D  Secure queries than cardholders in the fifty states. Complaints to that effect have been received by Puerto Rico Department of Consumer Affairs "equal treatment" economic discrimination site.[20]

The newest variant of 3-D Secure, which incorporates one-time passwords, is a form of software-based strong customer authentication. However, the legacy variant with static passwords does not meet the European Central Bank's (ECB) January 2013 requirements.

3-D Secure relies upon the issuer actively being involved and ensuring that any card issued becomes enrolled by the cardholder, making it very much an issue-focused solution.

The ECB has mandated in its January 2013 requirements 'Security for Internet Payments'[21] that all transactions acquired within the Single Euro Payment Area (SEPA) must be authenticated using strong customer authentication by 1 February 2015. This mandate by the ECB, and supported by the European Commission's Second Payment Services Directive Mk2 (PSD2), is intended to provide a level and technology-neutral playing field within SEPA to foster eCommerce, mCommerce and supporting technologies, including competitive forms of strong customer authentication.

As 3-D Secure relies upon issuer advance involvement and enrollment of cards, acquirers cannot rely upon 3-D Secure to meet their acquiring side authentication requirements, until such time as 3-D Secure has a meaningful enrollment approaching 100% of all cards issued.

This, in turn, makes 3-D Secure a weak solution for the acquiring side strong customer authentication requirements, particularly as 3-D Secure is not available on the 25 smaller card schemes recognized by the ECB. 3-D Secure must also be implemented for each card scheme to which it is to be applied, generally on a case-by-case basis, unless a specialist integration company is used.

Thus, acquirers may be faced with either accepting cards that are not enrolled and susceptible to fraud, or, to reject such cards until a means of strong customer authentication is available. As acquirers and payment gateways are liable for fraud on their networks from 1 February 2015, unless they have strong customer authentication in place, it is unclear what impact the ECB's requirements will have on SEPA eCommerce.

Acquiring side authentication differs from issuing side authentication, in that cards are enrolled upon being acquired as part of a transaction, rather than requiring to be a pre-enrolled following issue. Acquiring side authentication can thus enroll cards progressively on-demand, achieving an effective enrollment rate of 100%. Card enrollment and authentication can thus be at the same time.

Examples of acquiring-side authentication include PayPal's patented 'verification'[22] method, where one or more dummy transactions are directed towards a credit card, and the cardholder must confirm the value of these transactions. The iSignthis patented[23] method uses the transaction value at the point of sale, such that the sales amount as agreed between the eMerchant and cardholder, is split into two (or more) amounts, with the first amount being a randomly generated value, and the second value being the balancing amount between sales amount and the random value.

Both of these methods rely upon the cardholder accessing the account associated with the credit card and confirming the value of the random transaction in order to prove that they are the owner of the account. PayPal's method, however, does not specifically relate to a transaction between an eMerchant and cardholder, so unless it is augmented with another process that relates directly to a transaction, the method is not a form of strong customer authentication as is thus not an alternative to 3-D Secure.[24]

A proposal to make 3-D Secure mandatory in Australia was blocked by the Australian Competition and Consumer Commission (ACCC) after numerous objections and flaw-related submissions were received.[25]

Some countries like India made use of not only CVV2, but 3-D Security mandatory, a SMS code send from a bank and typed in browser when you are redirected when you click "purchase" to payment system or bank system site where you type that code and only then the operation is accepted. Nevertheless Amazon can still do transactions from other countries with turned on 3-D Security.[26]