If you have used a Visa card to make a purchase online lately you may have encountered a relatively new program, Verified by Visa . I've encountered it twice. The system is an interesting attempt by Visa to reduce online fraud and identity theft. It's a noble effort, but the user experience is unsettling, and the security implications are not exactly crystal clear.
Here's what happened to me, both times the Verified by Visa system was activated.
I was redirected away from the domain at which I was shopping, to a URL which was:
- not the domain where I was shopping,
- not the domain of the bank that issued my card
- not visa.com
Technorati Tags: phishing, adware, antivirus, botnets, hacker, malware, spyware, virus, Windows, worm
Comments
Thanks for the feedback. If anyone can point me to any good public sources of information on the background you describe, I would appreciate that.
One of the most attractive parts of online shopping to me is the reduced amount of hasle that comes with going to a shop and dealing with their minimum pay employees. With this Verified by Visa, this is an additional step in the payment process, that doesn't give any sense of security. I'm not patient enough to notice differences in design, but get very angry straight away, when asked to fill out the same details I just filled in in the previous page.
Another extremely annoying thing is that the concept of joint credit cards has not been taken into account at all. By the word "joint" I understand that there are two identical credit cards tied to the same account. Unfortunately I know of two banks that do not treat the cards as such - instead treat them as primary and secondary. And here comes the problem with Verified by Visa (and as it turned out, the automated menu answering system of the helpline). Whether or not the primary card finally is forced into joining (despite the implied "on voluntary basis") and registers, the secondary card is also forced to provide the additional identification. But this function is tuned to the primary card, so the response given by the Verify by Visa is that the birth date is invalid. The helpline responded with that I as a secondary card holder would have to use the details of the holder of the primary card. This doesn't really give the impression of security, on the contrary.
Finally, this function cannot be deactivated at all and changing to MasterCard will result in the same thing.
A brief search on the Visa web site did not result in any information on opting out of this as a card holder.
The issuing banks I use offer a Personal Authentication Message - in other words, they echo a message I've given to them in the past, so that I can be somewhat assured that the authentication page comes from someone authorised by my issuing bank.
Yes, someone could intercept that message (if it wasn't sent through SSL), or read it over my shoulder - but the goal here is to put responsibility for security where it belongs, in the hands of the cardholder and the issuing bank. If they choose not to authenticate one another securely, that should not become the merchant's problem, and in some respects, shouldn't be Visa's problem either.
If your authentication page looks phishy, that means you need to bug your issuing bank to make it less phishy, ideally by including some pre-shared information that allows you to feel comfortable that you are really talking to your issuing bank or their approved representative.
Yeah, Visa could regularly audit authentication pages, but then they could also regularly audit consumers' security practices. It just doesn't seem to make much sense.
My transaction with Tiger Airways was interrupted by this rubbish a couple of days ago. I think it did a popup. I hate popups. I refused to sign up during this transaction. Who knows what it was or where it came from! I skipped it at the time but the lousy thing said I'd be forced to do it next time.
I rang my bank, the said something like this did exist. I pointed out that I couldn't recognise the URL and thought it was a scam. We had some argument about the dangers of privacy where I said thanks to Australian federal privacy legislation my birth details are now sprayed over hundreds of systems and I've never been more vulnerable to impersonation.
When I eventually went to visa's own site to sign up (the Australian site didn't seem to let you and there was no contact us link), the process opened a new window with a domain I'd never heard of. Looks very phishy. The only thing that gave me any confidence was that the part where you typed in your card number was padlock verifed to usa.visa.com and the subsequent fishy address page where you put in your password had my bank's logo on it.
To add insult to injury, it would not
accept an easy to remember 6 letter password including a punctuation mark. No, it had to be between 8 and 16 letters with a number. So now I won't be able to remember it and will have to write it down. I'm sick of not being able to use passwords I can remember. All they need do is make sure it's not in the dictionary. This is a secondary authentication anyway!
Don't give up. Wells Fargo will come around to your way of thinking on this, if you persist. Since you didn't buy tickets on Arabian Airlines, insist that they investigate this further. Wells Fargo should be able to work with the airline to find out the names on the tickets, the dates of travel, etc. Then you can say something like, "I was here in your office, complaining about this, when the ticket says I was in the air on the way to Jordan" (or whatever). They may discover that the tickets were redeemed for cash in a location far from where you live (US based airlines don't do this any more, but overseas airlines might).
Best of luck to you.
The way I get it, the legit VBV or Mastercard's deal only ask for a password that you have previously set-up with them elsewhere. These pop-ups don't do that, they ask for ALL your personal information for a complete rip.
Beware folks, the Visa and Mastercard people don't really know what is happening or are hiding what they know.
If somebody knows of this being a local virus I need more info as AVG and Spybot show nothing in their sweeps.
I think it came up once right after I registered with VBV, but it hasn't come up since!!!
Apparently they don't like "verified by visa is rubbish" as the password either.
What a terrible job VISA has done setting up this program. I almost hope they lose tons of money with the scams that this program will generate. Hopefully they won't leave their customers liable. :(
Reading some other comments here I don't think mine was a scam, but I still don't feel safe ever using this verified by visa thing. Bad idea, Visa.
My card company says "the more cardholders that register, the more retailers will sign up to Verified by Visa". I'm morally obliged to not sign up.
So in conclusion when in doubt remove the CC, CCV and SSN and click finish or check out and see if the webpage is still connected to the authenticated sever. It should bounce you back and ask for the *required fields. If it does close browser and try again. :)