freitasm: Moved to correct forum.

cws82us: Been ready 3new website and its says steam been hacked
http://www.3news.co.nz/Steam-hacked-credit-card-details-may-be-at-risk/tabid/418/articleID/232414/Default.aspx

dontpanic42: This makes me think.

You have the option of the likes of Gmail/Google Accounts having multi-factor authentication (hell, even Steam itself has a multi-factor system), why can't this be implemented for credit cards as well?

I would personally seriously consider this type of system.
I realise there are many factors that would be serious things to think about; such as losing the second multi-factor authentication system (most likely a cellphone/smartphone), and maybe emergency situations where you really need a credit card to get out of any critical situations overseas etc but you have lost your cellphone.

Now, of course, this type of system would need to be opt-in/optional only for a start, but I think it would be quite a good way to combat breaches like these. Could save banks a bit of money in the long run.

Essentially, the technology is already in place for such multi-factor authentication systems (i.e. Google Authenticator, Battle.net, ASB, RaboBank, OATH-OTP etc...) so it probably wouldn't be too much of an investment to make it happen.

I know there are many intricacies involved with credit cards, and I will be the first to admit that I have no idea what these intricacies might be, but just putting the idea out there.

codyc1515: To combat the real problem what we need is to have the CVC be dynamic rather than static, like, the CVC could be a screen on the card just like the bank tokens and the CVC would only be valid once.

dontpanic42:

codyc1515: To combat the real problem what we need is to have the CVC be dynamic rather than static, like, the CVC could be a screen on the card just like the bank tokens and the CVC would only be valid once.

That's actually not a bad idea, and in fact, what I was trying to get at really.
The truest form of multi-factor authentication is something that is always changing, so nearly impossible to guess without the proper device.

A pin can be guessed, a CVC can be guessed.
When credit card details get leaked in cases like these, it would be good to have a multi-factor authentication option which would force another factor to be used as authentication for ANY transaction.

Now that I think about it, the biggest challenge with implementing such a system probably wouldn't be with credit card companies, but with actual merchants.
But surely it can't be that difficult to add another field in online payment forms, and maybe the same code could be used in lieu of a static credit card PIN for bricks and mortar transactions. Actually, no. A static PIN is still probably the best form of security in bricks and mortar situations.

I have heard that the new paywave/paypass credit cards are using a technique of having a unique code dynamically loaded onto the card during each transaction, so that's a start at least.

I would imagine Hotels might have something to say about such a multi-factor system, as it might mean they couldn't do the usual fund allocation.

The reason I suggest using the likes of a smart phone is simply because it would hopefully cost a lot less than your suggestion of integrated screens on the card itself. Your suggestion is a good one though.

codyc1515:
Not everyone has a smartphone (not me at least, see the 4S thread....), "card present" fraud (I believe) is much smaller than "card not present" transactions (like online) and like I said earlier assigning a dynamically changing CVC to the card instead of a static CVC would make it drastically more secure and not require any new "fields". Could be a problem with recurring payments though, this would have to be factored in. From a quick glance I could probably patent this.

dontpanic42:

codyc1515:
Not everyone has a smartphone (not me at least, see the 4S thread....), "card present" fraud (I believe) is much smaller than "card not present" transactions (like online) and like I said earlier assigning a dynamically changing CVC to the card instead of a static CVC would make it drastically more secure and not require any new "fields". Could be a problem with recurring payments though, this would have to be factored in. From a quick glance I could probably patent this.

You do make a valid point about not everyone having a smartphone. I suppose I was just heading in that direction because the technology already exists, so would be fairly easy to implement.

Re: CVC. That is also a very good point. The field is already there, and you wouldn't have to change much in order for it to work. That being said, it would require banks to develop a whole new card technology.

I would assume the card would have to have some sort of power source as well for the number to be generated. I'm also pretty sure the card would have to have access to a highly accurate time source. This is already being done with the likes of ASB and Rabobank, so the tech already exists there, but to put that into a credit card might be different story.

The smartphone just seems like the easier option at this point, with the possibility of it being integrated into the card itself in the future when the feasibility of such a system proves itself to be worthy.

codyc1515: I think I have seen cards which do have the ability to function as a credit card and a two-factor device but they used separate codes, though I may be wrong. Can't find links just now. Also, adoption could be slow but I imagine that the banks would really be pushed to have it on offer.

Not everyone has a smartphone (not me at least, see the 4S thread....), "card present" fraud (I believe) is much smaller than "card not present" transactions (like online) and like I said earlier assigning a dynamically changing CVC to the card instead of a static CVC would make it drastically more secure and not require any new "fields". Could be a problem with recurring payments though, this would have to be factored in. From a quick glance I could probably patent this.

KennyM:

Why couldnt there be something similar for each time the credit card is used, mastercard (in my case) picks up and active withdrawl, send me a txt with a unique code, I enter it. Job done.