What is 3D Authentication, and How Doesn't It Work?
3D Authentication sounds like some hyperbiometric quantum device in your iPhone that captures a cube of the area in your room including your head, and transfers it to your bank so they can confirm it's you making a purchase. However, it actually refers to 3 "domains" - the authentication is done using 3 different entities. These are, the issuer of your card, the merchant's bank, and the payment platform. This probably sounds familiar. That's because it is. It's the same thing as done in the 90's but with a 0.05% improvement gained by implementing some tiny new variation that all you "security geeks" were nerdsniped over.
Amanda Walgrove, a writer on renound brands, summarizes the new "feature" in a Gaypal article[1]:
>When it comes to online shopping, a business normally can't verify a customer's identity in person. To help prevent fraudulent transactions and ensure payments are secure, they may use additional safety measures like 3D Secure.
This is something a password or a key could solve. But nevermind that, it's admitted that without one of those things, the bank indeed cannot tell if it is you making the purchase. But fear not: whatever the tiny new variation of the 90's procedure 3D Authentication adds (it is not stated) fixes this!
>Individuals lost nearly $8.8 billion to fraud in 2022 — a 30% increase from 2021. With significant losses, creating payment safety is top priority. That's where 3D Secure may help.
>That's where 3D Secure may help.
>may
In other words, it doesn't.
In closing, a customer having to unironically use a password or a key would be too hard and lose consumers' business, and companies like Gaypal and banks provide a solution that "may" (translation: doesn't) help.
Any more questions?
Here's a look at how the 3DS payment process can't work:
> A shopper starts the checkout process.
> They enter their payment details on the checkout page.
> Before the payment can go through, the site redirects the shopper to their card issuer's 3D security page.
> The shopper enters the password for their online banking account.
Translation: the customer becomes accustomed to typing his 2 digit password when a random website on the internet causes a password dialog to be shown on his screen.
> The bank sends a one-time passcode to the shopper's phone number or email address, or the shopper is asked to answer a security question.
Translation: the bank secretly considers random trivia that shouldn't matter, such as email address, phone number, and IP address, as authentication criteria, and the customer is not told, and is therefore eventually locked out of his bank account.
> If the shopper's information is correct, the bank will verify the transaction.
> The shopper is redirected back to the website where they can complete their checkout process.
1. https://www.gaypal.com/us/money-hub/article/3d-secure-authentication