From the article, it sounds like they are working in using an existing fraud detection service, would be interesting to see what goes into that sort of service.
Presumably, it would at least involve implementing "Verified by Visa", which protects online transactions by requiring a password or PIN.
Mastercard and Amex have equivalent services, and these are all widely implemented by websites and card issuers in Europe and other countries.
I suppose they are not so widely deployed in the USA or Japan, but at the very least, you'd protect yourself against fraud involving cards issued in countries that do use it.
I'm obviously not an expert, but is there a way to require someone to enter the pin that they use when they buy something in person? (I also found the following FAQ from the link you gave amusing "Why do we need Verified by Visa? Hasn’t Visa been taking my security seriously before?")
> is there a way to require someone to enter the pin that they use when they buy something in person
A PIN can be required for "cardholder present" transactions in most of the world. Some combination of card issuer, transaction processor and merchant decide at what value transactions may proceed without a PIN — e.g. a train company's actual loss from a fraudulent ride is very small, so they might not want the delay of asking for a PIN on a ticket machine. Similarly for McDonalds. But if you're buying a TV, you will need to use a PIN.
That's very interesting, thank you. I've always wondered what the process is for deciding whether to ask for a pin. It's strange to me because I think of someone being there with the card as being more secure than accepting a payment online?
There's a (relatively low) transaction limit for contactless payments without additional verification. So, to buy a TV, you still need to enter a PIN.
Newer payment terminals can support device-based customer verification for contactless transactions, called CDCVM. The transaction limit doesn't apply if CDCVM is used. This is the mechanism used by Apple Pay, where you verify your identity using your fingerprint via Touch ID.
The actual authentication mechanism is left up to the card issuer. But using the card's PIN would be considered insecure due to the risk of malware/key-loggers intercepting it.
My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers.
Well, it's a bank. If a hacker can penetrate to the point that they can read passwords directly out of the bank's account database, then you have far greater things to worry about than just a compromised password.
Unhashed passwords means a SQL injection hole goes from "I can read some interesting transaction histories and balances" to "I can log in and make bank transfers in everyone's account". There's a reason bcrypt one-way hashing is the recommended standard for any web app.
Which may mean that either the bank is storing your password as plaintext (or is hashing every three character combination possible, which would also help a hacker figure out the plaintext).
3D Secure can use 2 factor authentication, using a dongle supplied by your bank. Unfortunately there are so many other problems with 3D Secure that I wouldn't trust it except on high profile websites or for very technically competent users who are able to check the originating site and certificate of the iFrame used (ie. very few people indeed).
