Verified by Visa
Tuesday, 10th February 2009 at 3:09 am
I make a lot of purchases online and of late am having to deal with Verified by Visa (VbV) more often than I’d like. Aside from whether or not I think such a process improves security or aids phishers, I have some serious issues with the way it’s conducted.
I have yet to complete the process, end-to-end, without having to detour through the “Forgot Password?” section, followed immediately after by a call to my bank, who then walk me through the reset and/or re-registration process. The things that (often repeatedly) trip me up are:
- Password restricted to no more than 10 characters I find it difficult enough to remember passwords without a false limit being imposed on their length – especially as I’ve been trying the increase the length of my passphrases because I’m under the (maybe false?) impression that the longer the passphrase the harder it’ll be to crack.
- Name on Card I have learnt now that what this field is really after is my forename and surname. Not my name as it’s actually written on the card.
Also, during my most recent re-registration experience, it occurred to me to wonder if, as I was required to enter my name in lowercase during the registration process, should I be doing so during the actual verification process? If so, there’s nothing to say I should.
- Inconsistent date patterns For my date of birth, I am required to follow the pattern ddmmyy but for my card’s expiry date I am required to follow the pattern mmyyyy. This is especially disconcerting because the pattern used ON my card is mmyy.
- Obscuring non-password fields The values I enter in the “Card expiry date” and “Postcode” fields are obscured as they would be when entering a password, making it trickier for me to spot mistakes. These are not fields that are typically obscured and it puzzles me why these are considered to be more sensitive than either my 3-digit security number or my date of birth.
- Card expiry date This is not specific to the verification or “Forgot Password?” processes but a general database issue. During my most recent re-registration process it was revealed to me by the person walking me through it that a mistake had been made the previous time and my card expiry date erroneously recorded as “2100″. Given that Visa set the maximum lifetime period for their cards, it should be possible to use today’s date to calculate the upper limit for a valid expiry date and use that to identify and flag up such mistakes to prevent them getting as far as the database.
I find it difficult to believe that Visa would consider this good customer experience so and as, so far, they’ve not had to take the brunt of my annoyance each time the process has broken down (I love you First Direct, really I do) , this evening I’ve written to them so that I can be sure that they’ve at least been alerted to these issues.
Although I’m sure there are many people who remember their password each time and sail through effortlessly, my experiences have been so consistently bad that I find it hard to believe I’m alone in this. If you’ve had the same/simliar/completely different issues with Verified by Visa, I’d love to hear about them.
