31–40 of 45 posts
...well crap. Time to update my side projects to handle this new flow. I wasn't aware this was even coming. Looks like there are a lot of exemptions (my side project costs customers less than 30 euros), but it's ultimately up to the customer's bank. I guess I'll move to Stripe checkout instead of my custom form.
I'm wondering what this means for multi-factor authentication with regards to payments. Why bio-metrics instead of a physical security key and U2F? Convenience? Customer reach?
If the U.S. implements something like SCA in the future, would it be likely that biometrics will win out over PINs or security keys, given different legal protections for both (https://pilotonline.com/news/local/crime/article_25373eb2-d7...)? What might this mean for future legal precedents regarding biometrics?
It's quite exciting that stolen payment card details will lose most of their value for Internet purchases in the EEA soon. Long overdue I think, it's practically a backdoor to the whole Chip and PIN security system. (Though so are transactions with signature or magstripe, but those are also slowly being tackled…) My main bank account is with Nordea, a big Nordic bank, one of Sweden's big four. They are currently quit…
Why isn’t Verified by Visa mandatory everywhere? Isn’t that enough?
...well crap. Time to update my side projects to handle this new flow. I wasn't aware this was even coming. Looks like there are a lot of exemptions (my side project costs customers less than 30 euros), but it's ultimately up to the customer's bank. I guess I'll move to Stripe checkout instead of my custom form.
Earlier quoted context omitted.
Why isn’t Verified by Visa mandatory everywhere? Isn’t that enough?
Verified by Visa with an appropriate implementation is one way to fulfill the requirement for Strong Customer Authentication. All Visa cards in the EEA will have to either implement Verified by Visa in a compliant way, or use some other method such as a randomised CVC you can find out via a mobile app.
...well crap. Time to update my side projects to handle this new flow. I wasn't aware this was even coming. Looks like there are a lot of exemptions (my side project costs customers less than 30 euros), but it's ultimately up to the customer's bank. I guess I'll move to Stripe checkout instead of my custom form.
You might be eligible for https://stripe.com/en-US/guides/strong-customer-authenticati...
...well crap. Time to update my side projects to handle this new flow. I wasn't aware this was even coming. Looks like there are a lot of exemptions (my side project costs customers less than 30 euros), but it's ultimately up to the customer's bank. I guess I'll move to Stripe checkout instead of my custom form.
Sounds like you're in Europe, do you handle VATMOSS?
Earlier quoted context omitted.
There's more to that. Anti-fraud mechanisms that require additional action on user's side, lower the conversion rate. For example 3DSecure mechanism redirects customer to another site where user has to put a number received in a text message. My phone is in another room upstairs. I cancel the payment and tell myself I'll do it later. Of course I might do it, but I might forget about it or change my mind. Another exam…
The implementations of 3DSecure I've seen were so terrible that I'm not surprised there is a drop in conversion rates. I would consider the user interface and the massive breakage as actively user-hostile. The redirects, terrible UI with blurry crappy bank logos, ugly dialog, and then I have to copy the code from my phone. And incidentally, SMS is a particularly bad method of authentication.