'Verified' by Visa

By Ashok Argent-Katwala

While using my Halifax Visa card online recently, I bumped into the Verified by Visa programme.

It's a nice idea, in theory, but the implementation I saw was woeful. It was depressingly similar to a phishing attack, warmly assuring me about security by chatting about it in the Web page, while hiding the parts of my browser that can tell me that more sensibly.

Like most geeks, I try and educate my less geeky family and friends about how to behave safely with technology. Things like this make that job harder.

---

This is how it went:

1. I'm registering some domains with Joker.
2. After putting in my payment details, Joker gave me a pop-up window, with no address or status bars, but branded as 'Halifax Secure', and claiming to be terribly secure (in the text of the page), while hiding my browser's mechanisms for telling me that more assuredly. It's asking me to set up an account, or give them my existing credentials.
3. After some poking about (I'm well past the usual behaviour of a consumer by this point) I saw that the site serving the pop-up was www.securesuite.co.uk, over HTTPS, with a valid certificate from Verisign.
4. At this point, I really expect that something funny is going on. However, further poking about turned up this Halifax page (on their non-secure site) linking to a securesuite.co.uk page.
5. So I carry on, roughly believing that the Halifax page is genuine (although I've no maths to back that up) and by supplying no more secrets than I had already given to Joker, create a username and password on this new whacky site. I get my domains, but I don't feel like they've ever 'verified' me.

Things they ought to fix:

• make the subsidiary site one hosted by my bank, from the domain I normally use for my banking. Ideally my bank should have one domain and use it consistently, and not use halifax.co.uk for general information, hbosplc.com for corporate information and halifax-online.co.uk for online banking. I suspect getting that right is beyond them.
• don't hide the toolbars and address bar (i.e. don't use a damn pop-up).
• don't mix up the verification step with signing up for the programme.

It's good that I've got this VbV account now, and that ought to make it harder for a fraudster impersonating me in future. However, I'd rather they asked me for the details when I next logged in to my online banking, where I could know what the devil was going on.

Until you first bump into it, you're more at risk. If the first person to try and spend money through a merchant using VbV is the fraudster, then it's especially crap. Also, if I were evil I imagine it'd be pretty straightforward to phish someone's VbV details anyway, since the noddy consumer is expecting it to be verified by the graphics in the page, not using the mathematics their browser is doing for them.