[PR] 3D Secure for Credit Card Payments

[Colm Moore]

http://www.irishrail.ie/cat_news.jsp?i=4470&p=116&n=237

We're going 3D Secure for Credit Card Payments Shortly!
02 February 2012

Iarnród Éireann will be shortly introducing 3D Secure to the online ticket purchasing system. 3D Secure will provide an extra layer of security and peace of mind to our customers during the purchasing process. We have compiled the following Frequently Asked Questions (FAQs) to make it easy for you to understand what to expect when we go live with 3-D Secure!

•What is 3D Secure?
•How it Works?
•Who developed 3D Secure?
•Why was 3D Secure developed?
•Why is it called ‘3D Secure’?
•Why is Iarnród Éireann adopting 3D Secure now?
•Were my ticket purchases secure before 3D Secure?
•I haven’t used 3D Secure before, what do I need to do?
•Do I need to update my credit card or get a new one before using 3D Secure?
•I have a Laser debit card, how does 3D Secure affect me?
•Is 3D Secure free?
•Do I need special software for 3D Secure?
•Will 3D Secure add extra time to my purchasing experience?
•I have used 3D Secure before, what do I need to do?
•What password should I select?
•I can’t remember my 3D Secure Password, who do I contact?
•Are there any alternatives to payment with 3D Secure?
•I don't wish to register with 3D Secure - can I still pay online?
•How can I find out more details about 3D Secure?
•What does my bank or card provider say about 3D Secure?

Q. What is 3D Secure?
A. 3-D Secure is a protocol used as an added layer of security for online credit and debit card transactions. This is achieved by adding another authentication step for online payments; a password.


Q. How it Works?
A. If you haven’t purchased an item online using 3D Secure before on any website, you will be redirected to your issuing credit card’s secure website where you must verify some personal details and select a password. You must never disclose this password to anyone – this is how you guarantee your card is secure. Do not write your password down anywhere.


Q. Who developed 3D Secure?
A. It was developed by Visa and named “Verified by Visa”. MasterCard then developed a service based on the same protocol called “MasterCard SecureCode”.


Q. Why was 3D Secure developed?
A. It was developed to improve the security of Internet payments by offering an extra layer of security to customers before making a purchase online. This involves selecting a password. This ensures your credit card cannot be used fraudulently as only the customer will know the associated password.


Q. Why is it called ‘3D Secure’?
A. '3D Secure' stands for "3 Domain Secure" as there are 3 parties involved in the online payment process: irishrail.ie, our Bank, and Visa or MasterCard.


Q. Why is Iarnród Éireann adopting 3D Secure now?
A. 3D Secure is compulsory, every bank will be required to implement this technology if they are to remain offering card services. All major banks around the world are either supporting 3D Secure or at advanced stage of offering it. What's more, if the merchant accepts 3D Secure, then the merchant is protected irrespective if the client's bank supports it or not.


Q. Were my ticket purchases secure before 3D Secure?
A. Yes, there is nothing to worry about. This additional step simply removes the possibility of someone else using your card fraudulently. Irishrail.ie has always used the strongest security standards and will continue to do so.


Q. I haven’t used 3D Secure before, what do I need to do?
A. If you haven’t purchased an item online using 3D Secure before on any website, you will be redirected to your issuing credit card’s secure website where you must verify some personal details and select a password. You must never disclose this password to anyone – this is how you guarantee your card is secure. Do not write your password down anywhere.


Q. Do I need to update my credit card or get a new one before using 3D Secure?
A. No, your existing credit card can be used.


Q. I have a Laser debit card, how does 3D Secure affect me?
A. Laser cards are processed through the MasterCard SecureCode element of 3D Secure.


Q. Is 3D Secure free?
A. Yes, 3D Secure is a free service provided by Visa and MasterCard.


Q. Do I need special software for 3D Secure?
A. No, 3D Secure will operate in your web browser as a webpage – you will not need to download any additional software or plugins.


Q. Will 3D Secure add extra time to my purchasing experience?
A. The 3D Secure authentication process is smoothly integrated into our online checkout process and will usually only add a few seconds to the normal transaction time. We believe this is a small price to pay for increased protection for our customers.


Q. I have used 3D Secure before, what do I need to do?
A. If you have purchased an item online using 3D Secure before, you will be asked to submit your chosen password during the purchasing process.


Q. What password should I select?
A. The password you decide to use should be chosen in such a way that nobody else can guess it. A secure password is ideally
•a minimum of 8 characters in length and
•a mixture of letters, numbers and characters.
•You should select a password that only you can memorise – do not write it down anywhere.
•Do not select a password that is the same as your irishrail.ie account.


Q. I can’t remember my 3D Secure Password, who do I contact?
A. If you can’t remember your 3D Secure password you need to contact your card issuer. Iarnród Éireann will never contact a customer to ask for 3D Secure password and we cannot help you retrieve forgotten 3D Secure passwords. We don’t save your 3D Secure password on any Iarnród Éireann computer system; when you selected your password this was saved only on the issuer’s computer system.


Q. Are there any alternatives to payment with 3D Secure?
A. If you have been unsuccessful in making a payment through 3D Secure please contact our customer information line hotline on 1850 366 222 (between 08:30hrs-18.00hrs, Monday to Friday) to make your payment over the phone.


Q. I don't wish to register with 3D Secure - can I still pay online?
A. Unfortunately not. Instead you will need to contact our sales hotline on 1850 366 222 (between 08.30-18.00, Monday to Friday) to make your payment over the phone.


Q. How can I find out more details about 3D Secure?
A. For further details on 3D Secure you need to contact your issuing bank. Alternatively, you can view demonstrations and FAQs on the following websites:
• Verified by Visa - Information and Activation
• Verified by Visa - Demonstration of using Verified by Visa (Flash plugin Required)
• MasterCard SecureCode – Explanation, Sign up & Demonstration


Q. What does my bank or card provider say about 3D Secure?
•Bank of Ireland
•AIB
•Ulster Bank
•Permanent TSB
•National Irish Bank (NIB)

[dowlingm]

I've used the Mastercard one on VIA Rail, not too bothersome.

[plant43]

Worth reading

http://www.cl.cam.ac.uk/~rja14/Paper...securecode.pdf

[James Howard]

That paper is interesting reading and it good to confirm that I am not paranoid. I came across 3D secure a couple of months ago while buying something on the web and it set all kinds of alarm bells ringing as it looked very much like a phishing site.

There was no way I was giving it any personal details as the whole thing directly contradicted normal security procedures. Banks seem to be particularly prone to confusing their customers with random online identities. For example, BOI's online banking has been 365online.com for years.

This is just another way of shifting the liability for online fraud away from the bank/merchant and onto the customer.

[Colm Moore]

http://www.irishrail.ie/cat_news.jsp?i=4561&p=116&n=237

Website Maintenance
02 April 2012

On Tuesday 3rd April 2012 between 11:00 - 11:45, we will be carrying out some necessary maintenance work in order to implement 3D Secure on this site. Customers will be unable to book tickets during this time. Anyone wishing to book a ticket during this time can call 1850 366 222. Sorry for any inconvenience caused.

[dowlingm]

Booking engine down during a weekday business hour. Who cares about revenue when the taxpayer covers the losses

[Thomas Ralph]

I doubt it's a big business time; they probably have done at least some analysis.

3D Secure is a pain for customers IMO, although it saves merchants loads.

[Mark Gleeson]

Monday morning is the least busy for bookings

Call centre is available to handle bookings if the site is not available

3D secure is far from perfect but it does provide an extra level of security though weak which will reduce the cost

Booking fees will be gone soon

[Colm Moore]

Full details at link.

http://www.irishrail.ie/cat_news.jsp?i=4470&p=116&n=237

We have now implemented 3D Secure!
03 April 2012

Iarnród Éireann has introduced 3D Secure to the online ticket purchasing system. 3D Secure will provide an extra layer of security and peace of mind to our customers during the purchasing process.

We have compiled the following Frequently Asked Questions (FAQ) to make it easy for you to understand what to expect with 3-D Secure.

...

[markpb]

Originally Posted by Colm Moore

Iarnród Éireann has introduced 3D Secure to the online ticket purchasing system. 3D Secure will provide an extra layer of security and peace of mind to our customers during the purchasing process.

I wish Irish Rail would drop this drivel, it's totally untrue. It provides extra security and peace of mind to Irish Rail while removing any deniability to the customer. It gives the customer absolutely nothing.

[dowlingm]

Originally Posted by Mark Gleeson

Monday morning is the least busy for bookings

Call centre is available to handle bookings if the site is not available

All due respect Mark it's not good enough. What if the upgrade had gone badly and the site had stayed down? What if the engine upgrade had impacted the systems the call centre had access to? If my firm's website - which has no ecommerce component and probably has a budget one thousandth of IE's - was down during business hours avoidably there would be questions why. IE just skates by because it's a semi state and thus expectations are minimal.

[ACustomer]

What if...what if? Never mind that. People should read the article in the link provided by plant 43 (post #3). It's by two Cambridge computer scientists and it really puts the boot into a thoroughly badly-designed system.

[Mark Gleeson]

So do it at 3am when there is no staffed call centre...?

Try buying something from Apple day of a product launch you can't even browse their online store for several hours.

Irish Rail do have a complete test duplicate system, any booking in the process has to be allowed complete before the switch is made, actual time to do the change is seconds.

[dowlingm]

Mark

after 9pm would be reasonable given that few trains would be left to book that day - you'd have to pay a premium for the vendor to have someone available but that's what you do when you don't want to look sloppy. I've had a vendor on my site at 0700 on a Saturday because that's what our business need required to do a cutover balancing the business need with reasonable expectation of staff and vendor.

RUI seems to have a decent relationship with the techy side of IE but that's not a reason to let them slide when something that ropey on the ops side or the PR side and the cudgels would have been taken up. You see this differently from me so let's agree to disagree eh?

[markpb]

Originally Posted by dowlingm

I've had a vendor on my site at 0700 on a Saturday because that's what our business need required to do a cutover balancing the business need with reasonable expectation of staff and vendor.

We're exactly the same. Software upgrades are done overnight, generally at midnight. Hardware upgrades are done between 4am and 6am and vendors are required to be there.

When we're doing website/web-service upgrades, we upgrade each production instance one at a time and put it live when the upgrade is complete. There are very few upgrades which put our production system out of use, the business absolutely would not agree to it.

You absolutely cannot compare this to high levels of demand putting the Apple website out of order.

[Mark Gleeson]

Irish Rails website is vastly more reliable than both Dublin Bus and Luas both of which have fallen over badly in the past at the worst time

There was a very brief advertised outage to bookings on a date and time with very low bookings plus a call centre was staffed at the time to cover for any critical bookings. Doing it at 2am there would be no call centre. All other website services where available

We received no complaints and are happy that Irish Rail have appropriate provision for testing and fallback. A new booking system at design stage should be able to cope better with changes in real time

Apple deliberately kill their store which is madness its not a load issue

No company can deliver 100% there is always downtime it's all about how quickly the problem is fixed, milliseconds if you have the resources