What is a 3D secure PIN?

The idea for the world's first ATM machine has an unusual genesis.

Its inventor, John Shepherd-Baron, thought it up while in the bath in 1967:

"It struck me there must be a way I could get my own money, anywhere in the world or the UK. I hit upon the idea of a chocolate bar dispenser, but replacing chocolate with cash."

- 'The man who invented the cash machine' (BBC News, 2007)

The world's first personal identification number (PIN) was invented alongside it. It was used to identify codes written on cheques that were placed in the ATMs.

Payments have come a long way since then. But ultimately, they are still about helping people access and spend their money, anywhere in the world. And many of them still rely on PINs.

What is a 3D Secure PIN?

A 3D Secure PIN (3DS PIN) is a 6-digit numeric code used by a cardholder to authenticate an online card payment that uses 3D Secure protocol.

Its purpose is to help verify a cardholder's identity to their issuing bank when they make an online purchase.

Like regular PINs used at physical points of sale (POS) or ATMs, 3D Secure PINs make card payments safer, protect funds and give customers more confidence in the transaction they are initiating.

How does a 3D Secure PIN work?

Each time a cardholder wants to pay online, they must input or confirm their card details. This places an additional step into the transaction process. They are taken to a new screen and prompted to request a one-time password (OTP) or PIN.

An issuing bank might request any of the following confirmation methods:

• A one-time password. If the cardholder is requested to supply this, it will be simultaneously sent to the appropriate mobile phone number or email address
• A pre-set PIN/password. This is a predetermined password created when a card was registered for 3D Secure. It might have been chosen by the customer or provided by the issuing bank

In each case, the customer simply needs to enter the PIN to proceed with their payment to a merchant.

6 digit PIN codes vs 4 digit PIN codes

ATMs and in-store point-of-sale PIN codes usually require only four digits. These can produce 10,000 different potential combinations.

This low number of digits has the advantage of being easy to remember. However, this can also be a disadvantage as it means it's also easier for others to remember, too.

A six-digit PIN, on the other hand, has 1,000,000 potential combinations. However, some research suggests that this doesn't significantly improve the security of four-digit PINS over six-digit PINs.

The main reason for this is because users tend to use similar, easy-to-remember PINs. For example, the top 5 most common six-digit pins are:

1. 123456
2. 654321
3. 111111
4. 000000
5. 123123

Knowing this makes fraud attempts easier for criminals. They can simply enter the most common PINs. These days, setting PINs with repeated or sequential numbers is generally not permitted in most cases.

How does 3D Secure 2.0 verification work?

3D Secure 2.0 verification also uses one-time passwords. In addition, it provides biometric authentication (such as fingerprint authentication), which essentially verifies the identity of a cardholder just like a PIN.

What is a one-time PIN?

A One-time password (OTP) or PIN is a form of strong authentication useful for avoiding cardholders choosing common, easy-to-guess combinations. It also has the advantage of not being something that relies on the cardholder's memory.

Another form of OTP is the time-based one-time passwords (TOTP). This has a time-limit set to it, usually of 60 seconds. Once this time-limit is up, the PIN expires.

How secure is fingerprint authentication?

The fingerprint authentication process presents fraudsters with a new problem. They can no longer rely on guessing and repeatedly attempting commonly used PINs. And unlike PINs and passwords, biometric data is saved on your device, not on servers.

Since the iPhone 5S' was first released, some users have demonstrated their ability to be 'hacked', using various means (such as finger moulds).

However, this method still gives strong benefits and protection against fraud for many users, as the hacks require relatively sophisticated schemes.

結論

3DセキュアPINは、3Dセキュアプロトコルを使用するオンラインカード決済の認証に使用される6桁の数字コードです。

これは、顧客が加盟店で購入する際に、顧客の身元を確認し、オンライン取引をより安全にするのに役立つ。

しかし、1,000,000通りの組み合わせが可能であるにもかかわらず、ユーザーは似通った覚えやすい暗証番号を使う傾向がある。このため、暗証番号は詐欺師のターゲットになりやすく、詐欺師は、標的とするシステムが許容する試行回数に制限されるだけである。

3Dセキュア2.0認証は、ワンタイムパスワードとバイオメトリクス認証（指紋認証など）を使用し、全体的にセキュリティを高めている。

バイオメトリック・データはハッキングされる可能性があるが、それは比較的巧妙な手口によるものであるため、多くのユーザーにとって詐欺行為からの強力な保護となる。

全体として、3DセキュアPINやその他の強力な認証形式は、オンライン取引をより安全なものにし、顧客の信頼を高める。

あらゆる種類のテクノロジーと同様に、セキュリティも進化を続け、カード情報、顧客、発行者、加盟店のすべてを保護する新しい方法を今後も提供していくだろう。

Nuveiの詳細を見る 詐欺とリスク管理システム.