Warning: This is a rant.

Mastercard and Visa drive me crazy. For many, many years, phone and internet-based merchants have been asking, loudly, for Visa/Mastercard (which, for all practical purposes, represent a duopoly in the US) to accelerate the pace at which they roll out customer security features. It is in the consumer’s interest and in the merchant’s interest to reduce fraud, but what is in Visa/Mastercard’s interest is maximizing the number of transactions, since they take a percentage of each transaction. The more transactions, the bigger the profit Visa/Mastercard make (they are not the same company, and their regulations differ, but only in detail, never in substance).

A few years ago, they introduced those security numbers on the back of your credit cards called the CVV2 number. That’s great. The idea was that CVV2 numbers would ensure that at the very least the person using the card has the credit card physically present, since merchants weren’t supposed to be permitted to store CVV2 numbers. The logic is good: If they’re not stored anywhere but the card itself, then you either have to get the cardholder to tell you what the CVV2 number is (phishing schemes, for instance) or have the card physically. Unfortunately, the rules that ended up being set in place do not actually guarantee that, and while they did end up reducing fraud overall, the impact was limited compared to what it might have been had Visa/Mastercard worried more about their customers (both the consumer AND the merchant) . Now, you’re allowed to store the CVV2 number, meaning that data theft leads to fraud that wouldn’t happen otherwise.

So, the next obvious “innovations” (if such a thing can EVER be said about the molasses-in-winter-speed dinosaurs that are Visa/Mastercard) are the “Verified by Visa” and “Mastercard SecureCode” programs that have been around for a bit now. Both of them are essentially the same thing: Pin numbers for your credit card. I know…believe me…I’m as blown away as you are. Imagine: A portable card representing access to money that is protected by a pin number. It’s like something in a sci-fi movie, isn’t it? It’s like they got a time machine and went to 1986 to find the latest and greatest innovations, and then cleverly exported them…to the future, where they were already commonplace.

On paper, it sounds great. If a merchant is enrolled in Verified by Visa (or Mastercard’s program) and a customer is enrolled in Verified by Visa (both the merchant and consumer have to independently sign up initially), then any transaction from that customer to that merchant is guaranteed by Visa, completely protecting the merchant against fraud. That sounds fantastic until you realize how unbelievably stupid it is to sign up for this kind of service as a customer. Then it just makes me angry when I think that they’re basically kow-towing to merchants like me by trying to stick a red hot poker up the ass of the people who trust us.

See, here’s the thing: The only way that Visa/Mastercard are willing to guarantee the merchant that a transaction isn’t fraudulent is to stick it to the consumer. The rules a consumer has to agree to when he/she signs up for Verified by Visa/SecureCode say that the consumer is not allowed to ever write down or communicate the pin code to anyone else. Great. Very logical. If someone does write it down or tell someone else, and he gets ripped off, my sympathy level is low. But what happens when the customer’s data is stolen?

Visa and Mastercard’s answers are that there are strict data protection rules in place, with hefty fines that prevent merchants from storing the pin number, and thus being subject to having that data stolen (violating Visa/Mastercard’s data protection rules is suicidal for a merchant, especially a small one. Each violation can literally run up to half a million dollars in fines.) Of course, that’s just nonsense. That means that they are intentionally luring customers into an agreement where the customer bears responsibility for a third party merchant getting hacked, and takes a financial hit as a result.

Imagine being that customer, enrolled in Verified by Visa. Visa calls you one day to ask about suspicious transactions with Iron Realms on your account, and you, being a truly unhip individual, inquire, “Who the hell is Iron Realms?” Visa simply tells you that you’re lying, since the only way that someone could possibly have gotten your pin number is if you gave it to other people. It’s simply inconceivable that technology is fallible, and that someone obtained your pin number illicitly.

I mean, this just drives me a little crazy. I hate dealing with Visa and Mastercard. They are almost universally hostile to the merchant, and when they’re not making new rules and imposing new costs on us, they’re turning around and trying to placate us by screwing the consumer. I totally understand that the value proposition of Visa/Mastercard relies on the perception that transactions are very (if not totally) safe, but their strident unwillingness to assume any responsibility for the trustworthiness of the payment network that they created really gets under my skin.

Disclaimer: Some of this info came out of a conversation with the head of the risk department at a merchant bank. I am just assuming what she told me is true and haven’t actually double-checked anything. I’ll add that when I asked whether Verified by Visa actually made any sense at all for a consumer, she said that while she recommends it to her merchants, she’d never recommend it to a consumer, as it makes zero sense from the consumer’s perspective. Probably why Visa is spending so much money trying to push it onto consumers.