The Old Verify By VISA

Fingerbobs

I was prompted for some characters from my VbV password last month, for the first time in (probably) years, so it does still happen occasionally. Needless to say, I had no idea what my password was, so I just aborted the transaction, rather than going through the "forgotten password" rigmarole.

CKhalvashi

My card issuer seems to simply reject any transaction it doesn't like the look of, instead of using VbV (a prime example was when stranded abroad in March and trying to book flights back, luckily a relative was able to book on her card from the UK over Whatsapp and I was able to transfer money to her), and won't unlock the card until they've spoken to me. This has happened on a number of transactions over a number of years, many providers I've used multiple times previously (Belavia and Belarusian Railways are the main ones, so I assume that they just don't like Belarus, however these are major companies, not small businesses)

When using my debit card online, I have occasionally been asked for a password, which when entered leaves the payment to go through. A password hasn't been asked for in a few years though IIRC.

I have no idea why there is such a huge difference in process, especially as both cards are issued by the same bank......

Migster

New "Strong Customer Authentication" regulations came in as part of PSD2 (2nd Payment Services Directive). These new regs mean banks have had to move away from static passwords for 3D Secure, as these were deemed to be not secure enough. As a result of this, the banks typically moved to SMS OTP (one-time passcode), but as with the old password-based solutions, they operate this in conjunction with a set of risk-based rules, so you won't be required to authenticate yourself for every transaction.

Further guidance has since been issued by the regulators that SMS OTP is also not sufficiently secure, so banks are implementing alternative solutions such as biometrics (e.g. approving a transaction using your banking app and your phone’s fingerprint or face recognition capabilities) or behavioural analytics to enhance SMS OTP (essentially, analysing how the OTP is entered to assess if it was entered by a human or a bot, and over time, learning to recognise how you specifically enter it vs someone else).

born_again

CKhalvashi said:

My card issuer seems to simply reject any transaction it doesn't like the look of, instead of using VbV (a prime example was when stranded abroad in March and trying to book flights back, 
I have no idea why there is such a huge difference in process, especially as both cards are issued by the same bank......

VbV is a retailer based system. Despite it saying it is run by your bank on the screen.
If the banks security system does not like the look of the transaction then it will not go through till you have cleared it with them. Never even gets to VbV stage.
Fraud on Credit & Debit cards are totally different, hence why a debit card will go through & a Credit won't or the reverse.

Purchase process is, rough guide.
Retailer > Bank to approve > retailer > VbV > Approval = Retailer OK > to bank.
With a side issue that if VbV is declined, retailer can override and self approve transaction... Despite customer getting a decline message.