Definitely. I thought I was acknowledging that by saying there’s no security on SMS in transit at all. The difference is in the US it’s easier to steal a phone number through the official porting process (thus easier for unskilled criminals).
As an investor it’s extremely annoying to use monzo on any crypto currency exchange/site. I now use monzo as my primary banking account but lo and behold it falls short on sites like coinbase because it does not support 3D scan confirmations. I see no mention of the process being supported on the road map short or long term. Can anyone confirm for me that monzo are working on this at some point. For now I’m going to have to open another bank account that supports the process which is not only a waste of time but just a hindrance.
1 Like
Hey Harry, I’ve moved your post here as there’s been some discussion about Monzo supporting 3D Secure here for you to check out. We know that Monzo are planning on supporting it but not yet when I’m afraid. As you say, it’s not yet on the roadmap, here’s the latest update from the team -
Click the 
to view the full post.
Hi Harry!
3DSecure (also known as SecureCode) support is very much in the pipeline. It is difficult to provide an ETA since there is a large amount of testing and certification needed from Mastercard but it’s something we’re hoping to complete as soon as possible.
4 Likes
It is a real pain not having 3d secure. I tried to buy something online today and couldn’t, please sort this out asap.
I am not angry, just dissapointed
2 Likes
They have just changed their targets about 3D Secure to near term… so expect it to launch in a few weeks 
6 Likes
Could be that MasterCard actually threw the switch too soon and it’s now trying to use Monzo’s still in development 3D-Secure system.
Is there any official update on when 3D Secure will be ready?
If the forum rumours that MasterCard performs changes on their systems only on a Tuesdays, probably not this week
If you’re talking about my post, I was only talking about MasterCard activating issuer’s payment solutions e.g. Fitbit Pay or Google Pay. I don’t know if that applies here 
Hope you support MasterCard Secure soon @Monzo! Just tried to make a purchase for flights at Gate1.co.uk which is a site Skyscanner picked up. I can’t make the purchase without my card supporting MasterCard Secure which is a real kick in the teeth having recently gone full Monzo.
1 Like
With 3D Secure mentioned on https://monzo.com/blog/2018/05/22/making-monzo-better/ I’m looking forward to seeing how Monzo implement it. I’d like it if a notification came up which I can then say yay/nay with. It could even show up on smartwatches (like how transactions show up with a “flag as expenses” button on my Apple Watch). Depends how flexible 3D Secure is I guess…
They said they were waiting for 3D Secure 2.0 which will allow them a lot more control than the current implementation allows. They also said they’ll be their own “provider” instead of relying on a third-party like Arcot Systems (whose UX is absolute garbage, and part of the reason I hate 3DS so much).
2 Likes
The way that two factor authentication works with, say, a Google app, where I can approve straight from the notification would be great.
But I hope also they will be doing stuff behind the scenes like Natwest so we are rarely prompted.
3 Likes
To set some expectations, we won’t have in-app authorisation to begin with.
When coming up with the list of things we needed to improve on for what turned into the blog post below, we decided to build 3D Secure 1.0, get it out there, and then iterate on it over time. We’ll be adding 3D Secure 2.0 support with in-app authorisation at a later date but to support 3D Secure 2.0, we also have to support 3D Secure 1.0 and fallback methods. 
The thinking behind this is that 3D Secure support is a big blocker for some people making all of their transactions with Monzo and was blocking a few major merchant acceptance issues. By building the minimum viable implementation, we unblock these issues and build a solid foundation for future work. We can build the minimal version on our backend with zero app work and get it out in a matter of weeks, rather than months. 
There’s also some exciting things that we want to do in the app that require seeding with merchant matching data from existing transactions. 
Rest assured that the user experience of even our initial minimal 3D Secure implementation won’t be super terrible, I’m making sure of that. 
22 Likes
Could you give a bit of technical detail as to why the in-app notification isn’t possible with 3DS 1.0?
As far as I could tell from observing current implementations, the merchant either redirects wholesale to (or embeds in an iframe) the issuer’s 3DS site, the user interacts with that page in some way, then on submission of the form, the issuer redirects back to the merchant with a success or failure.
Is it a technical or regulatory problem that prevents you in this scenario (unless I’ve misunderstood the setup?) from sending a push notification at the same time as serving the page - presumably at that point you’ve been passed the card number so know the account to push to? And then the page itself opens a websocket or does some awful meta refresh as a non-javascript fallback until the user grants or denies the popup?
Is the 3DS page required to also work in environments which might not be as browsery as I’m expecting? Or do they have ridiculous rules for getting 3DS accreditation that you must have some inscrutable text entry fields as part of your implementation?
Edit: unless I’ve misunderstood and 3DS 1.0 as 2.0 are your monikers for “quick” and then “complex” implementations, rather than two very long and tedious banking spec documents
1 Like
I’ve never understood 3D secure. I mean - I get that it’s a n extra layer of security. But the process was never really communicated well when I used it with my old bank. Most of the time the very 90’s looking Verified by Visa thing would just flash up then disappear. I don’t think I ever actually had to use it now that I think of it. I may have been asked to set it up when buying something once but it looked so dodgy I think I just closed the browser.
2 Likes
Sure, while it is technically possible, 3D Secure 1.0 (in our case, Mastercard SecureCode) offers the following standard acceptable authentication methods.
- Static password
- “Random” static password (e.g. “please enter the 3rd, 4th and 7th character of your password”)
- One-time password (OTP) via SMS
- One-time password (OTP) via Mobile Application
- One-time password (OTP) via Chip & PIN device
We can also build entirely custom authentication methods on top of that (including in-app approvals) but we need to support a fallback method. As you’ve mentioned, building our own flow, we have complete control over what happens within that frame or page as long as it conforms to the specification and follows requirements such as not requiring JavaScript. In this case, we’re choosing to start small for speed to fix the acceptance issues and work our way up from there.
3D Secure 1.0 and 2.0 are two different specifications, 3D Secure 2.0 is often called EMV 3DS and contains a number of nice extensions to the spec including completely out of band authentication, the ability to complete a 3DS challenge within a merchant’s mobile app, and the ability for a merchant to use 3D Secure as an identity verification method without a payment. Eventually, 3DS 2.0 will entirely replace 3DS 1.0 but I’m not sure that’ll be happening fast enough to continue waiting. 
5 Likes
Ah great, thanks for clarifying! Always interesting to find out how much of the Legacy Banking Nonsense we’re all used to is mandated by spec/regulation and how much is just poor/unimaginative implementation!
Thanks for going in for the “quick fix” first though, I have a couple of sites (train tickets, video game store) that require MCSC (or MSC? Isn’t that something to do with fish?) and then I think that’s all that’s left before I can potentially sever my ties with Barclays…
3 Likes
The Amex implementation of 3DS is bafflingly non-interactive. No password, no challenge, just straight on through. Almost pointless (but I’m assuming there is some magic going on). I guess they are very much in control of their implementation though. Obviously not bound by VISA or MasterCard.
1 Like