I've wanted to pay a merchant in the European Union.
We've done business with that merchant for over 10 years and they are absolutely trustworthy. They handle their online credit card payment service via the payment provider Wirecard, also a big and trustworthy player.
However, on my recent order when I proceeded to the checkout page the following screen was presented:
They wanted me to enter the last 6 digits of my social security number.
I've never seen anything like this and aborted the payment.
I've contacted the merchant who in turn told me that they have no control over the payment process since it is handled by Wirecard. Nevertheless they have forwarded my query to Wirecard and received the following answer:
This is a 3D-secure / Verified by Visa query from the customer's card issuing bank. The procedure of this query differs between banks. For most European banks, a TAN code is sent to the customer's mobile phone, which must then be entered. This US bank appears to require the Social Security Number for this procedure. We have no influence on the type of the 3-D Secure query. This is handled by the customer's bank.
I've directly contacted my bank and also Visa. Both denied being responsible for asking social security numbers.
So what is going on here?
Is asking for 6 digits (out of 9!) of a card holder's social security number a common way for banks to implement the 3D-secure verification?
Or is this some kind of fraud?