12

I've wanted to pay a merchant in the European Union.
We've done business with that merchant for over 10 years and they are absolutely trustworthy. They handle their online credit card payment service via the payment provider Wirecard, also a big and trustworthy player.

However, on my recent order when I proceeded to the checkout page the following screen was presented:

enter image description here

They wanted me to enter the last 6 digits of my social security number.

I've never seen anything like this and aborted the payment.

I've contacted the merchant who in turn told me that they have no control over the payment process since it is handled by Wirecard. Nevertheless they have forwarded my query to Wirecard and received the following answer:

This is a 3D-secure / Verified by Visa query from the customer's card issuing bank. The procedure of this query differs between banks. For most European banks, a TAN code is sent to the customer's mobile phone, which must then be entered. This US bank appears to require the Social Security Number for this procedure. We have no influence on the type of the 3-D Secure query. This is handled by the customer's bank.

I've directly contacted my bank and also Visa. Both denied being responsible for asking social security numbers.

So what is going on here?

Is asking for 6 digits (out of 9!) of a card holder's social security number a common way for banks to implement the 3D-secure verification?

Or is this some kind of fraud?

Improve this question
6
  • 2
    I can't answer your question but I'd like to add that there is current EU legislation which will enforce merchants to use 3D-secure transactions in a few days. In Italy it starts from the 14th but I'm not sure that the date will be the same for all EU countries. Merchants can request to opt out but they have to adapt the requests made to the bank and in the bank can force the use of 3D-S anyway. So I'd expect some change in the payment process around this time, I have no idea how this works with US-EU transactions though so I can't help you specifically regarding the request of your SSN.
    – Giacomo Alzetta
    Sep 11, 2019 at 12:11
  • 1
    Are you in the US? (You say you want to pay a merchant in the EU, but not where you are or where your payment card is based in.) Is your card issued by "US Bank"? Do you have any other payment cards to try which might prompt you for different information?
    – user42405
    Sep 11, 2019 at 12:31
  • Asking your bank is only valid if your bank is USBank. Is USBank the one that issued your card, and the one that you contacted?
    – RonJohn
    Sep 11, 2019 at 12:41
  • PeterCooperJr. and RonJohn yes, I'm in the US and my Visa was issued by my bank which is U.S. Bank indeed. I've payed via PayPal now in order to be on the safe side. I'm not interested in trying additional cards while things smell fishy ;) I'd simply like to know if I'm the only one in the US who is being asked for SSN digits when making a credit card payment with a 3d-secure enforced payment site.
    – gollum
    Sep 11, 2019 at 12:48
  • 4
    I would think that if it was fraud (website got hacked, your information going somewhere else) that they would ask for the whole SSN, because most people wouldn't question it.
    – xyious
    Sep 11, 2019 at 15:22

1 Answer 1

Reset to default
2

That looks like a phishing popup to me but it is possibly legitimate.

While I do not care for VISA's "Verified by Visa" implementation, the individual bank does have the ability to request the information.

As there is no information on the particular merchant in your question, I have no way of tracing network requests for the site you are at but I would recommend following the guidelines from VISA posted below and not entering that information. Use a different payment method such as Paypal (as long as you know you are at the correct site) if you can.

Depending on the browser you are using, you can additionally check the certificate on the site you are at. To do so, click the lock to the left of the address bar, then click certificates to make sure the Common Name(CN) matches the merchant's site.

Verified by Visa information

To protect yourself online, visit only trusted merchants and avoid sites that ask you to provide unnecessary information, such as your Social Security number. Never send payment information by email.

Check to make sure that transactions occur in a secure environment by looking for the padlock icon at the bottom of your browser. Any website URL where you enter sensitive information should begin with https://.

Visa Checkout also provides added security by offering advanced authentication tools when you use Visa Checkout to shop online.

Improve this answer
3
  • Does it really look like a phishing popup to you? It looks pretty legit to me.
    – user541686
    Oct 5, 2019 at 0:35
  • From what I understand, banks only need the last 4 to verify and usually the Verify by Visa popup asks for a password or has you create one the first time. It is just hard to say without seeing the site network requests. It is very easy to duplicate the appearance of a page but have subtle differences.
    – user90110
    Oct 5, 2019 at 4:36
  • For a cert issued by a public CA since about 2010, check Subject Alternative Name (SAN, also called UCC by Microsoft) not CommonName. (And any Internet business not using such a cert probably shouldn't be trusted at all.) But that only checks the merchant cert, not the bank that supposedly provides the popup.
    – dave_thompson_085
    Oct 6, 2019 at 7:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .