Verified by Visa and Mastercard SecureCode are broken and need to be fixed

Even though there's no choice (here at least, when you want to use your Visa over the internet) I HATE, HATE, HATE the concept and here's why:

For starters I thought it's a phishing attack, when the frame popped up for the first time.

But the worst is that I don't feel it protects me, despite the marketing crap dished out by CC companies. The only reason is to protect Visa.

What happens if I book a flight at a badly infected internet cafe computer in Chiang Mai and a key logger reads my password?

"No, Mr. Zapp, our logs show irrefutable proof that your password was typed with suchandsuch transaction. Sorry, you're liable, you obviously didn't protect the password."

Scary stuff.

Verified by Visa is a horrible horrible implementation, I spent an hour in the bank last month trying to sort out why my company card wouldn't let us buy train tickets ) VbV had my date of birth wrong for some reason) oh yeah if yuo have any problems with VbV you have to call an 0845 number, which although only 5p a minute on my plan... it soon adds up

He's only complaining about UX, but the bigger problem is that this doesn't actually make things much more secure.

It is already really hard to teach casual computer users about security online. The one thing that used to work so far was "never enter your password on a website you've been redirected to" and "always check the site's identity in the address bar". Verified by Visa redirects you to some website on some random server and asks you to enter your password. There is no way for the user to check it's authenticity.

A much more reasonable design would be to control all sales via your bank's website, i.e. having an inbox with "purchase requests" and approving them through your bank's interface. That would be both secure and very transparent to the user, and the bank could easily control the level of security required (passwords, TANs, ...).

The first time I saw VbV I checked the frame URI. When it came up as securesite.net I phoned up the merchant to tell them their site had been hacked. It’s unbelievable that they thought that was a good idea.

I've always managed to not enable Verified by Visa on any of my credit cards, but another huge problem with it is that doing so is nearly impossible. Once you get redirected to that popup, it's very hard to not signup without canceling your transaction with the original merchant. Or getting dumped back to your shopping cart, trying to check out again only to get dumped straight back into Verified by Visa's signup process.

There doesn't ever seem to be a permanent opt-out, so anytime I want to buy something from a merchant that uses it, I have to hunt for the magic button to get around it again.