Guidelines for Ensuring the Security of the Verified by VISA Password
|
CONDITIONS OF USE
1. INTRODUCTION
a. These Conditions of Use govern use of the authentication process, and operate in conjunction with the VISA Card Conditions of Use. Together, these Conditions of Use and the VISA Card Conditions of Use govern the use of the VISA card to conduct transactions online. If there is any inconsistency between these Conditions of Use and the Conditions of Use of the VISA card, the Conditions of Use of the VISA card shall prevail.
b. These Conditions of Use take effect from the time you register for the authentication process and until participation in the authentication process is terminated in accordance with clause 11 of these Conditions of Use.
2. DEFINITIONS
a. In these Conditions of Use:
"account holder" means the person or persons in whose name the linked account is held.
"authentication process" means the "Verified by VISA" online transaction authentication process conducted by VISA International or your credit union’s nominated service provider as determined by Visa International and your credit union from time to time and advised to you.
"nominee" means any person to whom the credit union has issued an additional VISA card to access the account holder's linked account(s).
"password " means the personal password entered by you and used by the authentication process to authenticate online transactions using the VISA card.
"you" means an account holder or a nominee, as relevant, who registers for the authentication process.
"VISA card" means the VISA card issued to you by your credit union.
b. In these Conditions of Use, the terms "credit union", "day", "linked account" and "merchant" have the same meanings as they do in the VISA Card Conditions of Use.
3. CODES OF CONDUCT
a. The credit union warrants that it will comply with the requirements of the Electronic Funds Transfer Code of Conduct where that code applies to your dealings with it.
b. The relevant provisions of the Credit Union Code of Practice apply to these Conditions of Use.
4. REGISTRATION AND OPERATION
a. In order to use the authentication process, you must provide certain information to us that allows us to validate your identity and verify that you are the account holder, or authorised nominee by the account holder, of the specified credit or debit card. The information that you provide may be validated against information we hold about you and may be validated against information held by third parties with whom you have authorised us to disclose and exchange your personal information.
b. If you are unable to provide adequate information to validate your identity, we have the right to not allow you to register for the authentication process. You warrant that any personal information you provide us is correct and that you have the legal right to use that information.
c. In the event you have a question regarding the authentication process, its registration or a transaction using your credit or debit card, you should contact us.
d. When engaging in an online transaction or other transaction for which the authentication process applies, you may be asked for your password before a merchant accepts your purchase or payment. If you are unable to provide your password, or if the authentication process otherwise fails, the merchant may not accept your card or payment for that transaction.
e. By registering to the authentication process, you consent to the use of your password to evidence your identity.
f. In order to use the authentication process, you must have the ability to access the World Wide Web and must pay any service fees associated with such access. In addition, you must have the equipment necessary to make such a connection to the World Wide Web, including a computer and modem or other access device.
5. ACCEPTING THESE CONDITIONS OF USE
a. When you first register for the authentication process you will be prompted to read and accept these Conditions of Use. If you click “I agree” you will be deemed to have read, understood and accepted these Conditions of Use.
6. ADDITIONAL CARDHOLDERS
a. A nominee may use the authentication process. A nominee must register for the authentication process separately and will also be required to select a password.
b. Where a nominee can access the account holder's linked account, the authentication process can only be used when accessing that linked account when the account holder and or the nominee have registered for the authentication process. If the account holder or nominee fail to register then the non registered party will be denied access to the authentication process.
7. PROTECTING THE PASSWORD
a. When you register for the authentication process, you will be asked to select a password. The password is different to the PIN you are issued with the VISA card and serves as a distinct authentication code for every online transaction.
b. Having registered your password for the authentication process, you agree to protect this password as a means of preventing fraudulent or unauthorised use of the VISA card.
c. You must not tell or show the password to another person or allow it to be seen by another person, including your family and friends.
d. When you select or change the password, you must not select a password that represents your birth date or a recognisable part of your name. If you do use an obvious password such as a name or date, the account holder may be liable for any losses which occur as a result of unauthorised use of the password before notification to the credit union that the password has been misused or has become known to someone else.
e. Do not record
the password on the VISA card or keep a record of the password on
anything which is kept with or near the VISA card unless reasonable
steps have been taken to carefully disguise the password or to prevent
unauthorised access to that record.
8. HOW TO USE THE PASSWORD
a. When conducting an online transaction using the VISA card, you will be prompted by the authentication process to enter the password in order to complete the transaction. Once the password is entered into the system, the transaction will be authenticated and it is irreversible.
b. If you do not enter the password when requested by the system then:
(i) your transaction may not proceed and will be rejected by the authentication process; or
(ii) the merchant processing your online transaction may choose not to proceed with the transaction.
c. If you wish to change the password for whatever reason you should access the authentication process registration site (where you first completed your registration) and use the tools available.
d. If
you forget the password you should contact your credit union, who
will be able to assist you in activating a substitute password.
9. Your Conduct
a. Whilst using the authentication process and your credit union’s Internet banking services, you agree not to:
(i) impersonate any person or entity using the authentication process;
(ii) upload, post, email or otherwise transmit any material that contains software viruses or any other computer code, files or programs designed to interrupt, destroy or limit the functionality of any computer software or hardware or telecommunications equipment used by the authentication process and your credit union;
(iii) spam or flood your credit union Internet banking service and the authentication process;
(iv) modify, adapt, sub-license, translate, sell, reverse engineer, decompile or disassemble any portion of the authentication process;
(v) remove any copyright, trademark, or other proprietary rights notices contained in the authentication process;
(vi) "frame" or "mirror" any part of the authentication process without the prior written authorisation of your credit union;
(vii) use any robot, spider, site search/retrieval application, or other manual or automatic device or process to retrieve, index, "data mine," or in any way reproduce or circumvent the navigational structure or presentation of the authentication process;
(viii) otherwise interfere with, or disrupt the authentication process or your credit union’s Internet banking services or servers or networks connected to the authentication process or violate these Conditions of Use or any requirements, procedures, policies or regulations in relation to the authentication process; or
ix) intentionally or unintentionally violate any applicable local, state, national or international laws, regulation, regulatory guideline or judicial or administrative interpretation relevant or applicable to the authentication process.
10. ACCOUNT STATEMENTS
a. Your
credit union will send the account holder an account statement for
the linked account at least every 6 months. Account holders
may request more frequent account statements or a copy of an account
statement at any time.
11. CHANGES TO CONDITIONS OF USE
a. Your credit union reserves the right to change these Conditions of Use from time to time. For instance, this may occur should VISA International or the nominated service provider change any aspect of the authentication process.
b. Your credit union will notify the account holder in writing at least 30 days before the effective date of change if it will:
(1) impose or increase charges for the use of the VISA card and/or password or for issuing additional or replacement VISA cards or passwords; or
(2) increase the account holder's liability for losses relating to use of the authentication process.
c. Your credit union will notify the account holder of other changes no later than the day the change takes effect by advertisement in the online authentication message service or in the national or local media, or by statement message.
d. If it becomes necessary to change these Conditions of Use for security purposes then these changes may take effect immediately and the account holder will be provided notice as soon as practicable thereafter.
e. Your credit union
reserve the right at any time and from time to time to either suspend
temporarily or discontinue this authentication process by providing
you with notice as set out in clause 11c.
12. PRIVACY AND CONFIDENTIALITY
a. Your credit union and VISA International or the nominated service provider collect personal information about you for the purposes of providing services to you. When you verify an online transaction using the authentication process, the credit union and VISA International or the nominated service provider will collect certain personal information.
b. You authorise your credit union to disclose that personal information to others in order to execute your instructions including, but not limited to, conducting the authentication process and investigating disputes or allegations of unauthorised transactions, or if it is required by law.
c. You further authorise VISA International or the nominated service provider to use personal information it has collected throughout the authentication process for the purpose of conducting market and statistical research and/or surveys, subject to such research and or surveys being conducted solely for the purpose of improving the authentication process.
d. You may have access to the personal information your credit union, or its nominated service provider hold about you at any time by asking your credit union.
e. For
more details of how your credit union handles personal information,
refer to the credit union's privacy policy which can be viewed by
accessing its Internet home site or by calling the credit union.
13. TERMINATION OF THE AUTHENTICATION PROCESS
a. The account holder, the credit union, VISA International or the nominated service provider may terminate the services offered pursuant to the authentication process by notice to the appropriate parties.
b. The account holder or nominee can terminate their individual access to the authentication process in respect of the VISA card by notice to the credit union.
c. If participation in the authentication process in respect of the VISA card is terminated, your ability to transact online with the VISA card may be adversely affected. This is because the credit union may require that the authentication process be used when you transact online with the VISA card. Alternatively, merchants may refuse to complete an online transaction if it is not authenticated.
d. Your credit union
will inform you if there are any restrictions on the use of the VISA
card and the merchant will advise you if they are willing to complete
a transaction that has not been authenticated.
14. MERCHANT DEALINGS
a. Your correspondence
or business dealings with, or participation in promotions of, online
retail merchants on or through the authentication process, including
payment for and delivery of related goods or services not purchased
via the authentication process, and any other terms, conditions,
warranties or representations associated with such dealings, are
solely between you and the merchant. Except as otherwise required
by law, the credit union, VISA International and the nominated service
provider have no responsibility or liability whatsoever arising out
of or related to those dealings or the merchant's goods, services,
acts or omissions.
15. EXCLUSION OF LIABILITIES
a. Subject to any warranty which is imported into these Conditions of Use by law and which cannot be excluded, the authentication process is provided by VISA International or the nominated service provider and your credit union "as is" without warranty of any kind, either express or implied, including, but not limited to, any implied warranties of merchantability, fitness for a particular purpose, title or non-infringement.
b. Your credit union, VISA International and the nominated service provider shall not be liable for any damages whatsoever arising out of or in relation to:
(i) your use of or access to (or inability to use or access) the services; or
(ii) any other failure of performance, error, omission, interruption or defect, or any loss or delay in transmission.
c. In no event shall the credit union, VISA International or the nominated service provider have any liability for direct, special, incidental, indirect, consequential or exemplary damages, regardless of whether such damages arise in contract, tort (including negligence) or otherwise, or for lost profits, business interruption, or loss of programs or data on your computer system, regardless of whether we were advised of the possibility thereof.
d. If you are dissatisfied
with any aspect of the authentication process, account holders' sole
and exclusive remedy is to terminate participation in the authentication
process, as provided in these Conditions of Use.
16. ACCOUNT HOLDERS' LIABILITY
a. The account holder's liability for unauthorised transactions using the password is governed by the Electronic Funds Transfer Code of Conduct and by clause 16 of the VISA Card Conditions of Use and for that purpose, a reference in clause 16 to the term "PIN" includes a reference to your password.
b. If you breach these Conditions of Use, this may affect the account holder's liability for unauthorised transactions. For example, if you breach the password security measures in clause 7 of these Conditions of Use then you may be regarded as having contributed to any losses incurred through unauthorised use of the VISA card for the purposes of clause 16 of the VISA Card Conditions of Use. If it is determined that you have contributed to the loss, the account holder may be held liable for the transactions notwithstanding that they are unauthorised.
c. If
you suspect that the password has become known to someone else or
there is a security concern, you must change the password or notify
your credit union of such security concern as soon as possible. If
you delay in notifying the credit union of the security concern or
delay changing the password after you knew or ought to have known
of the security concern, you may be in breach of these Conditions
of Use and the Conditions of Use of the VISA card and the account
holder may be liable for all transactions on the VISA card until
notification occurs.
17. REPORTING A BREACH OF PASSWORD SECURITY
a. If you believe the password has become known to someone else, you must immediately report the breach of security to your credit union in accordance with the procedures set out in clause 17 of the VISA Card Conditions of Use.
If you contact the credit union after business hours or an automated response service answers your call, leave your details and the Visa card particulars on the automated response service and the reason for the call (i.e. cancel card number etc.) and it will be attended to as soon as the credit union receives your message. You will be deemed, for the purpose of ascertaining liabilities, to have notified the credit union from the date and time of your message.
b. For further details as to reporting a breach of password security, refer to clause 17 of the VISA Card Conditions of Use.
18. DISPUTES
a. If you believe a transaction using the authentication process is wrong or unauthorised or a periodical statement contains any instances of unauthorised use or errors, you should contact your credit union immediately.
b. Any dispute concerning the operation of the authentication process or unauthorised transactions will be resolved in accordance with clause 18 of the VISA Card Conditions of Use and for that purpose, a reference in clause 18 to the term "PIN" includes a reference to your password. If you are dissatisfied with the resolution of the dispute, you may wish to take the matter further. You may, for example, contact the Credit Union Dispute Resolution Centre at the address or on the telephone numbers set out in clause 18 of the VISA Card Conditions of Use.
19. GENERAL
a. These Conditions of Use and the VISA Card Conditions of Use constitute the entire agreement between you and us regarding your use of the authentication process and supersede any prior agreements between you and us regarding the same subject matter.
b. No waiver of these Conditions of Use will be effective unless in writing signed by an authorised officer of the credit union, VISA International and or the nominated service provider.
c. Any part of these Conditions of Use which is invalid or unenforceable is, where possible, severed to the extent necessary to make these Conditions of Use enforceable.
d. These Conditions of Use shall be governed by the laws of the state in which the head office of the credit union is located and any matter arising pursuant to these Conditions of Use shall be dealt with by the non exclusive jurisdiction of the court of that state.
e. You agree to indemnify and hold your credit union, VISA International and the nominated service provider harmless from and against any and all losses, claims, damages, judgments, liabilities, costs and expenses (including reasonable attorneys' fees) arising from or relating to your use of the authentication process.
