Visa Secure Authentication Hacked?

[Hymie]

Last night I attempted to make an on-line purchase from a high street retailer using my Barclay credit card; having entered the 6 digit one-time pass code, the transaction was denied, I tried again with a second one-time pass code, but this too was denied.

This morning I telephoned Barclays, who advised me that the transaction had been flagged as potentially fraudulent, being the reason for denial. I pointed out that the purchased was from a well known high street retailer and was to be delivered to my address registered with the bank, and I had entered a 6 digit one-time pass code sent to my mobile phone.

Given the above, the Barclay’s representative did not have sensible answer as to why the transaction had been flagged as potentially fraudulent. However he said that since this transaction had been flagged as potentially fraudulent, if I went ahead with the transaction, I would not be protected by the banks fraud protection – this despite the fact that I would have to obtain a one-time pass code from visa to complete the transaction.

Clearly Visa/Barclays don’t have much faith in their multi-authentication process to prevent fraud.

[ToraToraTora]

That damn brexit!

[barry1010]

Whenever my credit card company suspects a fraudulent transaction they won't let it go through, call me within minutes and tell me to phone the number on the back of my card. Every time it has been with established companies but is large (for me) transaction.
I'm surprised they didn't call you.

[Maydup]

Is there any possibility you were on a fake website impersonating the well known retailer.

If not try another card if you have one or contact the retailer on a number from their genuine website and pay over the phone.

[douglas9401]

Banks eh? Working 'really hard' to deny any fault, ever.

[Peter Pedant]

oh were you trying to buy something from Nigel Farage?
haw haw haw

I think the double thingey works well, and if a bank warns me that a transaction is 'iffy' , I er dont get sniffy
I take notice ( sozza, it rrhymed, no offence intended)

[237SJ]

I paid for a hotel via an interline travel agent that I had used many times. The booking went through but the payment was declined. When I spoke to my bank they had no explanation as to why it happened. I told them that if anyone had looked at my past history I always spent roughly the same amount of money at the same time of year with the same agent. I spoke to the fraud department at the bank and they had no reasonable explanation either. They just said "It's the computer"

[bobbinwales]

Maybe switch your bank account to Nat West/Coutts (if you meet the criteria)
I'm not sure hacking as per your title comes into this.
It maybe that the retailer you used as had a data breach, but putting in your one time passcode should be sufficient.

I once tried to pay a deposit on a new car at a main BMW dealer and my bank twice refused to pay it even tho it was within the daily limit and I authorised it like what you did by pass code's. Turned out for some reason they wanted evidence that the car was genuine and that I had tested it .... they said it was to save me in case it was a fraudulent sale

[Hymie]

If fraudulent websites are able to get Visa to send customers they plan to scam a one-time pass code, then the system has indeed been hacked, and the banks need to rethink their fraud prevention strategy.

[Peter Pedant]

high - me
yeah but - you havent shown that have you?
.
There are excellent reasons why the coding system they use for card transfers is er hard to hack - involves factoring a long long number into two 100 digit numbers ( or something v diff)

this obviously doesnt mean looking over someone's shoulder and seeing the PIN

[Togo]

The website didn't get Visa to send a passcode ... you did. The website got you to ask for one.

[Hymie]

No, it’s Visa who control that part of the process – the merchant does not know my mobile number to sent the one-time pass code to, only Visa does.

[Hymie]

If Visa is allowing fraudulent websites to request a one-time pass code to authenticate payment, then the system supposedly in place to stop fraud, is pointless.

[bobbinwales]

You lost me... canyon go back a step and ask why your referring to a fraudulent website now

[Togo]

As ever Hymie, I get the feeling that you are not understanding the process. Visa, your bank, has been asked by the retailer to send funds from your account. The retailer knows your bank details, at least enough of them to instigate the payment process anyway, because you have given them the basic card details required. Your bank/visa detects a reason for concern, the amount or the retailer's location, or retailers past history with them. It sends you the automatic verification code anyway but declines to proceed for any or all of the reasons that it blinked in the first place. The retailer has not been in any contact with your visa/ bank supplier, only you. Your visa/ bank has not been in contact with the retailer ... only you.

[Togo]

Once you have put your card details into the retailer payment form it triggers an automatic application. This is a protocol that is in use World wide. The satellite coms that handle this are beyond military grade encryption, and are capable of being received anywhere on Earth. You try finding out what the system is and you will find that you hit a wall. TTT knows.

[Togo]

Not only that ... you are calling Visa, a pretty powerful organisation, a fraudulent organisation or one that has had it's system hacked on a public online site. Hymie you are the fraud, masquerading as informed and well opinioned day in day out.

[Hopkirk]