In face-to-face transactions (contactless transactions excepted), entering a PIN is mandatory. The equivalent of this for online transactions is processing the transaction through 3D Secure.
In 3D Secure transactions, a one-time password specific to the transaction is sent to the customer's mobile phone, and the transaction proceeds once the customer enters this password correctly.
So, if I share the password sent to my phone for a transaction initiated as 3D Secure with someone else, am I liable for that transaction?
The cardholder is liable for every purchase made using the 3D password sent to the mobile phone registered in the bank's system. Therefore, the one-time 3D password should never be shared with anyone.
So what information does the 3D Secure message contain?
The message containing the 3D password includes information about the merchant where the purchase is being made, the date and time of the transaction, and the amount being charged. Before entering the password that arrives in the 3D Secure message, this information must be checked, and if there is any discrepancy, the 3D Secure password must not be used, the purchase should be terminated without completing it, and the bank should be notified.
So if a card transaction is carried out online without 3D Secure, is the cardholder still liable in that case?
If the transaction is not 3D Secure, liability passes to the merchant. If this transaction is disputed, the corresponding refund is made to the card.
