SagePay - 3D Secure

[party_pete]

We've held off adding 3D Secure to our SagePay account but now we're getting a few issues with customers trying to make payment via Maestro.

Has anyone any experiences of this good or bad?

[TraceyHand]

well, tbh, however much you hold off, you can't escape it forever.
I've no doubt that we experience abandoned orders due to customers getting as far as 3d secure and then bailing but, of course, the reverse is true for cards where 3d secure is mandatory.
Eventually, it'll be compulsory across the board, regardless of experiences so I'd just bite the bullet and do it, IMO.

[party_pete]

SagePay have said they have extended my exemption date to 31.12.09.

At least we'll get through the busy December, then implement it then.

[Sean Williams]

We're going to have to bite the bullet soon too - Tracey's right (crikey, did I say that )
I think the important thing is to have a decent (short) explanatory note to warn customers what is about to happen and not to get scared

[party_pete]

I think the main worry for consumers is that they appear to have to transfer to another site to set-up their card security details and you can understand them being concerned.

[cbarling]

I'm not sure how SagePay works, but in Actinic Payments 3D Secure is on by default for Maestro, but you can also choose when to switch it on for Visa and Mastercard. So you can have Maestro on but Visa and Mastercard 3D Secure off.

Chris

[Mark H]

Any news on whether 3D will be mandatory for Visa/MC? I wonder if it will just quietly die in a corner when Maestro cards become rare?

[cbarling]

I'm not aware of any date when 3D Secure will be compulsory for Visa and Mastercard.

I don't think it will die. My impression is that 3D Secure use is gradually growing across the board. It may be part of the reason why online fraud has just taken a turn downwards. If I'm right about this growth, I imagine there will be a point where it becomes mandatory.

My own opinion is that it is in principle a very good thing. It's just that the implementation and rollout has been appalling. Implementation by the issuers seem to have been inconconsistent and late, and definitely missed some tricks in terms of making it secure. Education to consumers has been almost non-existent.

Chris

[Darren B]

i have been using it for at least a year now and dont have any issues, i have had the odd customer question me but no more failed payments than usual.

IMHO you should have turned it on ages ago, when things were quieter and then you could have seen for yourself

[Duncan Rounding]

I'm really surprised how it can cut fraud when all that is required to bypass it is the cardholder's date of birth. There are other ways of second level security such GridSure that are better IMO.

[Rich Brady]

I'm really surprised how it can cut fraud when all that is required to bypass it is the cardholder's date of birth.

Exactly, it's a bloody joke. Even the dude from Creditcall at the Actinic conference said things along the same line.

At the moment all it does it put an extra step at the checkout process IMO

[saucysal]

Varies with Bank

Each bank/card issuer has different requirements on 3D-Secure. One might ask for, say, the first, third and sixth characters of a password, another might ask a couple of things, such as date of birth and a password, or mother's maiden name, etc. I am pretty sure that it is never just a date of birth.

Each bank/card issuer supplies a link should somebody forget their password, etc. If necessary they can contact their bank/card issuer. No genuine cardholder should have a problem with this, especially as it is for their benefit.

Sarah

[Darren B]

my card always asks for certain digits from my password and dob this password is set on my bank account along with my password, i have to log into my bank account to change these i cant do it from the 3d bit

[Duncan Rounding]

I don't think anyone has a problem with this in principle.

The issue comes in that if you forget your password, which so many people do, then when clicking on the link to change the password to set another one the only additional information you are asked for is your date of birth, which is pretty common knowledge.

The issuing bank cannot reset the password that can only be done online.

[Duncan Rounding]

my card always asks for certain digits from my password and dob this password is set on my bank account along with my password, i have to log into my bank account to change these i cant do it from the 3d bit

I hadn't heard of this. It certainly isn't the case with my Barclaycard Visa.