Mastercard Securecode changes

londonman42

And I see I was bang on the money by raising this thread way back when. It is coming in thanks to the bloody interfering EU. What extra hoops you need to go through will depend on your bank. Typical barmy suggestions are ...SMS message (as per this thread)....just great for the 15-20% in the country who can't get a bloody mobile signal.
Or use a smartphone to take a selfie ! Or use the fingerprint....

And if you don't have a smartphone...well, you are stuffed. How about the aged? Many are not familiar with all this high-tech.

Sod the EU, I say.

londonman42

March 2019 is when it all kicks off. I've asked several finance companies about how they are going to cater for those without a mobile signal. They have all come up with very vague words but when pressed for details, it soon becomes obvious that they have no system in place. Nor anything proposed.

For example, M&S. They say that if the OTP (onetimepassword) can't be received due to a poor mobile signal that they will then send an email with the code. While you're waiting online, with your payment transaction pending? Which will time out probably before you get the email.

But even if you do get the email, they will only do this for five transactions. After that you have to ring them up. So there you are - mid-transaction and no OTP - the screen sitting waiting for your input. You trot downstairs to wherever the phone is and dial M&S. Eventually you get through. Now how exactly are they in customer service going to access the specific transaction you are currently working on given that the systems with all the details are at Mastercard ?

OK...you've managed to get through, they've got the systems, you've got the number, you rush upstairs..."Sorry your session has timed out"

londonman42

I'm amazed that this hasn't received more coverage in the press or does everyone now have a mobile phone ? Does everyone in the country get a good mobile signal? Get any mobile signal ?

Because those people without either a mobile and/or mobile signal are going to be effectively disenfranchised from buying anything online using a credit card.

The companies will NOT send the OTP to a landline either.

Both M&S and John Lewis Partnership Card, for example, say that they will email you the OTP, you then have to ring them up (as I mentioned above) and give them the code BUT after doing this for five purchases, that option will stop.

So no mobile ...you are stuffed.

So no mobile signal. ....you are stuffed.

bubieyehyeh

It is annoying, especially when their is a more secure open standard solution for the no coverage issue...


RFC628 (TOTP) which has several implementations, most well known probably being google authenticator.


HMRC use it.

londonman42

bubieyehyeh wrote: »

It is annoying, especially when their is a more secure open standard solution for the no coverage issue...


RFC628 (TOTP) which has several implementations, most well known probably being google authenticator.


HMRC use it.

But that only works if you have a smartphone, surely ?

A lot of people do not have either a mobile (dub) or smartphone.

bubieyehyeh

londonman42 wrote: »

But that only works if you have a smartphone, surely ?

A lot of people do not have either a mobile (dub) or smartphone.

I see no reason why the application to generate the codes couldn't run on a computer. The only minor issue is that the way to provide the "Secret" to the application is usually via a QRcode.


However the alternative solution is for the credit card companies to provide a otp generator device to customers without a mobile. Such as used by HSBC internet banking. However these cost money and need replacing when the battery expires. However they could allow customers without a mobile phone to purchase such a device, if they weren't willing to fund it.

londonman42

In theory there is nothing wrong with either of your ideas. Other than Visa and Mastercard won't do it !