How does credit card's online authentication work?

Question

I am not sure if this question is valid here but this seems to be the most appropriate place.

I have a credit card which I use to shop online. When I checkout a product on say, Flipkart, it asks me my credit card details. After entering my card details it takes me to the merchant's website where I have to authenticate the transaction either by entering the password or by entering OTP sent to my mobile.

But in some other cases like Apple App Store or Google Play I only save my card details and nothing else. After then my card is charged with amount depending on the app bought via respective app stores. There is no authentication involved.

1. How does credit card's online authentication work?
2. When exactly is authentication required for purchase via credit card?
3. Is there a way where I can a say that my credit card will not be able to be charged without authentication (password/OTP)?

Answer 1

As per RBI regulations, all transaction originated in India [i.e. Merchants in India] and cards issued in India. As of now if a merchant is not in India, then OTP or additional password is not required.

The Financial Institutions had contended that making changes for Gateways outside of India would be a technical challenge. This was accepted by RBI as it was deemed that number of user's doing international transaction is small and hence the chances of fraud are less.

Quite a few companies, UberCabs for example switched the gateway to US so that they could bill customers without OTP.

Answer 2

The additional procedure that you describe is perhaps 3D-secure. It's an additional authentication procedure that in some online payment transaction are restricted. It didn't happened to you in Paypapl transaction or other payment methods because it is not mandatory in all cases. only the validation of the card number itself is done in all cases in order to get authorization for tranactions.