It has to do with “3d secure” also known as “verified by visa” or “visa secure” for cards that operate through the visa network.
3d secure is a voluntary security measure that merchants can decide to require prior to completing an online purchase. Kind of like a CAPTCHA, 3d secure is intended to ensure a transaction made online is being made by the actual card owner through an authentication process.
Pasmo and Suica implemented 3d secure requirements a while back. Part of this is a general trend in Japan to require 3d secure for non-Japanese online transactions. If you have ever tried to book disneyland tickets and failed due to the disneyland online registration system not allowing the use of your card, this is likely the same reason why.
For Pasmo and Suica, Apple Pay was one of the few exceptions that previously did not require validation via the credit card issuer’s 3d secure authentication process. This is likely because Apple had their own measures which were equivalent. Since last month, it seems both Pasmo and Suica started enforcing 3d secure authentication requirements if you used a non-Japanese credit card on Apple Pay.
The authentication process is different for each card network. As I mentioned before, Visa has what is called “verified by visa” or “visa secure”. Mastercard has SecureCode and Amex has Safekey. Each are different authentication protocols. It seems Mastercard and Amex implement automated systems that do not require manual authentication. I am guessing whatever glitch they had with mastercard, they troubleshooted away in a couple weeks.
Unfortunately, Chase and several other credit card issuers (banks) that partnered with Visa agreed to an onerous authentication process if the vendor requires 3d secure authentication to make a purchase. Not sure why, but reading how this has prevented many other people from making purchases all over the world, not just in Japan, it could be something to do with the agreement between the banks and Visa.
For those that use a Chase card or some other bank with similar restrictions, the customer needs to manually call the credit card company to authenticate the vendor prior to purchase.
The banks have no way for you to nullify 3d secure requirements as it is a voluntary requirement of the merchant, not the banks.
The visa card issuers could make the process easier like those partnered with amex or mastercard. But this issue predates the current snafu with pasmo/suica and they dont care enough to negotiate with visa to develop a simpler process.
This, of course, makes the whole point of using apple pay to charge a transit card too onerous for daily use.
You can try to call customer service but they won’t see the transactions at all and most of the regular customer service reps won’t be familiar with this issue since most of their clients do not face this problem.
You can only find this stuff out talking with the “3d secure”/“verified by visa” security team/reps who have like one person on staff at any given day. So good luck with that. They also won’t allow you to blanket authorize Pasmo or Suica for 3d secure authentication and it seems they require a verification per purchase.
If anyone else is more familiar with the 3d secure authentication process and/or have been successful in convincing the bank security team to blanket authorize, please let me know.
7 comments
Wow thanks for the research and write up. So as of now, there’s still no straightforward fix?
I’m still trying to figure out if the zillion little roadblocks you come across in Japan dealing with foreign payment systems are incompetence or malicious in nature.
Nice write up!
>If anyone else is more familiar with the 3d secure authentication
process and/or have been successful in convincing the bank security team
to blanket authorize, please let me know.
The only one here that would be familiar with such stuff is u/jbankers.
I’ve had some experience with the 3D secure stuff, and yeah, it’s a mess. Like I had no problem buying Disneyland tickets with my us Visa card that had 3D secure setup, but the system that the Shinkansen uses for buying tickets online wouldn’t take that card, as it failed their 3D secure check. Ultimately, I had to use my Japanese Visa card, which wouldn’t normally be an issue except for it’s low limit and the price of shinkansen tickets for the whole family round trip.
I’m guessing there are multiple intermediaries that provide services for confirming 3D secure status and some of them are good and some of them are not. Given the general propensity for Japan to not be good at testing systems for foreigners, not to mention edge case testing in general, it’s no surprise there is hit or miss performance, and no fall back system to deal with the inevitable breakdowns.
I’d guess that blanket authorizations violates the spirit of 3d Secure, which is to make sure that you are really the person authorizing the transaction by requiring a secondary authorized channel to prove that you are the authorized user. In the same fashion, this is a protection for the merchants, so that they can be assured that the transaction is really from the authorized user and don’t have to worry as much about charge backs for ‘fraud’. Opening up a blanket authorization would leave a hole in that protection for a nefarious actor to exploit, hence the need to force an authorization interaction every time.
I do kind of like the intent of the system, but they’ve got a ways to go before it is really ready to be used, hence the issues we’ve both had over it. It falls back to my general approach to credit cards in Japan, I enjoy them when they work, but always plan for them to fail, because sooner or later, Japan always figures out a way to randomly block them.
Great finding!! I wish Suica, Passmo and Visa could swiftly resolve this problem soon.
In other (probably related) news, charging vpass-style cards from SMBC with debit cards (in this case, wise debit/prepaid card) has gone from “working” to “vpass website throws an error after 3d secure/idcheck”.
Called them up and while there was a maintenance yesterday that *could* have potentially broken something, it’s probably for real this time.
お前は…何者だ…