I have to chuckle. This concept came out of the idea that one would need to verify who the user was that was using the Visa number when doing online purchases. The TV Ad that Visa ran was rather humourous in that a person would attempt to buy something and then stick their head into the monitor. The customer service rep would then yank his head out on the other end and yell to her colleagues "Does anyone know this guy!?!?" to which someone would reply "Yea, he's a friend of my sister's boyfriend's friend".

So Visa introduced Verified by Visa as a method of securing transactions. I have to laugh however at a recent transaction I did. I purchased a train ticket with my Visa card and it asked me for my "Verified by Visa" password. I panicked. I don't remember getting or setting one. Oh look. A "Forgot your Password?" option. I click on it. It asks me for the 3 extra digits, my birthday (month/year), how my name is spelled on the card and it's expiry date -- all information that actually can be easily tracked down. When Visa came and did a lecture at my college earlier this year, they were quite hyped up about the whole VbV process. (They also seemed hyped up about creating a card that would hold EVERYTHING -- driver's license, passport, credit card info, etc. -- using smart card technology).

Anyways, I ended up creating my password after putting that simple information in. It strikes me that the verification isn't that... well... verifiable. I remember asking Visa as to what information was necessary for it and they said it was birth month/year. They didn't use things like Mother's maiden name, etc since it was commonly found (like this isn't?!)

Sigh.

I do wish they would look into how user's operate and generate security around that. The idea that the user should know better isn't working any more. The user doesn't know better. The user is clueless.

Security should be built around that.