As I’ve said before, there are many things that could be used as a factor for authentication, and I think this may be the first commercial use on a large scale.  This is potentially a great use of a hidden 2FA (at least normally, the user wouldn’t actually do anything, it would be verified behind the scenes), though I don’t know if it really solves the problem.

The idea is really cool.  I want to travel and use my Visa card, but don’t want fraud, which is generally higher in those cases.  So I register my phone with a special app, and the app tracks my location.  What this does then, is when I use my Visa card to make a purchase, Visa will contact the app and check the location of the phone.  If there is a match, the purchase is authorized, and if not, then it wouldn’t be.

The cool thing here is that it is attempting to pair your purchases with your location at the time of purchase, using your smartphone, which is generally always with you.  The location becomes a second factor, and one that doesn’t even need user interaction.  Just carry your phone with you!  Silent, simple, and you don’t need to do anything to “authenticate”.

But while this is cool, and I really like having things like location being used as a second (or third) factor, there are still some questions about this.  For example, my phone is on the Verizon Wireless network and doesn’t work well overseas where GSM is the standard instead of CDMA.  Hopefully, this will be solved with LTE.  For right now, if my phone can’t get online while I travel, how will the location verification work?  Of course, a related issue is that even if I have a phone that works, it tends to be expensive (calling is already expensive, data even more so), so maybe I don’t want to pay the charge.

I also wonder how well the registration process will be monitored.  Could someone create a fake card and then register with the app and use it when “traveling”?  This has been a problem with Apple Pay, where the registration process has actually led to fraud that wasn’t possible before.  Could this be similar?

Always keep an eye on your risk when implementing new factors, but this is great news from Visa.  We should watch closely.