The 'Wait, wait, don't tell me' quiz

Try this quiz. The answers at least have a humorous slant...

http://www.nytimes.com/2011/07/03/opinion/sunday/03wait.html?nl=todaysheadlines&emc=tha212

I was curious about two words I came across today:

"Bespoke" -- custom-made/tailored-made to one's specifications. Hence, a bespoke tailor (the chap you go to for a tailor-made suit, as for example, when buying a men's suit off the rack is not an option) or a bespoke test paper, say, a test paper that can be varied to adjust for difficulty levels.

"One-trick pony" -- someone good at or skilled at only one thing. I know I have been making reference to equine analogies in recent postings but I don't suppose this phrase applies to any of them. But my attempts to find the etymology of the phrase was unsatisfying, save this one which I guess should be taken with a pinch of salt (or maybe a lump of sugar)...

Apparently, there was this circus whose only animal act was a pony (abuthen). And the animal's only trick was to play dead, which it wasn't very good at doing. The circus, I was led to believe, folded (I don't suppose it happened in a dramatic way, as in the Big Top crashing down).

-------------------------------------

Ok, serious stuff now. I posted earlier the concerns of two ST readers who discovered that unauthorised online transactions had been made using their credit cards. This was despite the implementation these days of the much touted in-built safety feature of the one-time password (OTP) system. The key point the two readers made was that there must have had been a lapse or a breach in the system, since no one else should have access to the personal-to-cardholder OTPs.

I thought ST should have run a news story so that the public would be better aware. But because there wasn't, the two banks involved needed only to reply that they had contacted their respective customers and that they had identified/fixed the problem (although OCBC did elaborate a little more). The replies were essentially an exercise in PR.

DBS' reply (excerpted)
We have been in touch with Ms Gan and are helping to resolve the unauthorised transactions on her card. We would like to assure our customers that we have several measures in place to protect transactions. This includes the one-time password for secured e-commerce transactions, which applies to e-commerce websites that support 3-D secure authentication protocols such as Verified By Visa and MasterCard’s SecureCode (MasterCard).

DBS has also introduced the SMS Alerts service notifying customers of first-usage for new or replacement cards, as well as transaction alerts for amounts above the pre-specified threshold limit. These alerts are sent via SMS to cardholders’ mobile numbers in the bank's records. Hence, customers are encouraged to update their contact details if there are any changes.

OCBC's reply (excerpted)
We have contacted Madam Khong and the matter has been resolved. Visa and MasterCard have had “3-D Secure” authenticaton protocols in place worldwide sinc 2005 to protect both merchants and consumers against online credit-card fraud. Last July, credit-card issuers here implemented a one-time password (OTP) system – made possible by the “3-D Secure” protocols – as part of the industry’s efforts to enhance security for online credit-card transactions.

The system involves what is known as 2-Factor authentication (2FA): After the cardholder keys in his own user ID and password when making an online payment with his card, "3-D Secure" websites will still require the keying in of the OTP to validate the authenticity of the transaction. The OTP is sent to the cardholder’s chosen 2FA token – for instance, via SMS to his mobile phone.

He will, therefore, be alerted to a potential security breach if he is sent OTPs for online transactions that he did not initiate. He should then notify the bank immediately.
In Madam Khong’s case, the OTPs that she received were from transactions done via "3-D Secure” websites, and this prevented the transactions from going through.

Some merchants, however, do not yet secure their websites using the “3-D Secure” authentication protocols. Online transactions involving such merchants will not generate OTPs and may, therefore, result in unauthorised transactions being approved. However, consumers are still protected. If verified that transactions involving such merchants were unauthorised, the conditions set by Visa and MasterCard allow the value of the transactions to be refunded to consumers.

This was the case with Madam Khong, where other card transactions were done on non-“3-D Secure " websites. We refunded the value of the unauthorised online transactions to her on Monday.