Using 2FA to verify a Visa online transaction cuts off the Internet

I have had this problem for months. In my country and with my bank, many online transactions made with a Visa credit card must comply with the Verified by Visa system, which adds a 2FA step on top of the card number and CVV number.

A one-time code is transmitted by vocal message through a designated phone number (landline, in my case), and typing it in the Verified by Visa window is the last required authorisation step.

This has worked for me flawlessly for months, until at some point, my Internet connection began to cut off when I clicked OK in the Verified by Visa window, after typing the 2FA code.

Attempted workarounds which failed :

• Using a different browser (Firefox, Opera, Vivaldi, Chrome, Internet Explorer 11).
• Changing antivirus. Formerly : Avast Free, now Microsoft Security Essentials. Also installed : IBM Trusteer Rapport (specific to banking, recommended by my bank), Microsoft EMET.
• Reducing security level in the browser. Such as : deactivating uMatrix, selecting less secure options in Settings. At one point, I thought I found the culprit : in Firefox, changing Options / Privacy & Security / Block Dangerous & Deceptive Content from Yes to No allowed the transaction to go through. Ditto in Opera, with Protect me from Malicious Sites set to No. However, after a brief period, the connection started cutting off again.
• Deactivating Microsoft Firewall.
• Asking my bank technical hotline (they can't figure it out).

Disconnection also happens when I attempt to use the one-time credit card numbers application provided by Visa and my bank. In this case, the Verified by Visa system kicks in just after login (username + password), so I can't even launch the program.

Most of the time, the disconnection, after OK'ing Verified by Visa, would happen across the board. No other site could be reached. However, in some rare cases, only the connection between the specific banking site used at the time by the application was broken, and other sites could be browsed normally.

Possibly related trouble :

My Internet connection periodically cuts off without any obvious cause. This might happen once a day, or every other day. The Windows icon monitoring the connection, in the System Tray (see attachment), switches from the "on" state to the "problem" state (warning black and yellow sign, with exclamation mark).

At that point, the connection is reset successfully by one of the following means :

Running Windows Network Diagnostics (run as admin). Either it finds a DNS issue, or it does not find anything. In both cases, despite no repairs being applied, just closing the Diagnostics box reopens the connection.

Sometimes, this would not work, and I would need to switch the router off, and on again. I some cases, Windows Network Diagnostics would still need to be run after this, and then the connection would be back again.

I'm using my own router, TP-Link TD-W 8960 N, through Ethernet. I'm supposed to use my ISP specific "box" instead, but I replaced it after many years when my connection failed, and I was told I would have to rent an expensive new box. I prefer the (unsupported by my ISP) TP-Link, because it's a one-time expenditure, and it gives me much greater control.

I'm at the end of my wits, and any help would be greatly appreciated.

Clairvaux said:

I prefer the (unsupported by my ISP) TP-Link, because it's a one-time expenditure, and it gives me much greater control.

This may in fact be your issue.

Is this a DSL or cable connection? You just have a router or a router and modem?

It is a DSL connection, and the only device that stands between my computer and my phone line is that TP-Link TD-W 8960 N, which is a modem-router.

What I would do is check your ISP's website for compatible third-party routers and buy one of those based on good reviews. Or you'll just have to buy or lease a router from your ISP.

There is no such thing as approved third-party routers where I live ! All the ISP's marketing is based on their own routers, so they won't tell you anything about other companies' equipment. However, the software on my TP-Link router does have pre-set settings for my ISP, so I believe they must have tested it.

What makes you think the router is the culprit ? I was able to use Verified by Visa for a very long time, with no problem at all, with that router. And that specific application is the only one which cuts off the connection. Has anyone ever seen anything like that ? How is it even possible that clicking on an OK button would cut off an Internet connection ?

Clairvaux said:

What makes you think the router is the culprit?

Because you said this:

My Internet connection periodically cuts off without any obvious cause. This might happen once a day, or every other day.

Maybe the router is going South or needs a firmware update. Perhaps it's even been hacked.

Something is failing at the DNS side from what it looks like.

Have you tried a simple reset? You have to do this in the router. Not turning it off and on again. You'll lose all your settings in the process. So the router should have a backup config. option.

The other vector could be your computer. Try resetting the TCP/IP stack.

Open a command prompt window as Admin. Run the following commands individually:

netsh winsock reset catalog
netsh int ipv4 reset reset.log
netsh int ipv6 reset reset.log


Restart the computer.

You can also run Adwcleaner and go to the settings and turn on; reset firewall, reset IPSec, reset proxy, reset IE polices, reset winsock, reset TCP/IP, reset hosts files.

AdwCleaner - Free Adware Cleaner & Removal Tool | Malwarebytes

Since DSL uses the phone line, the probability of ingress is great with older lines. To confirm this, turn on the ICMP echo ping allow in your router and try Smokeping.

3 SmokePing Tools FAQ | DSLReports, ISP Information

Speed tests, ping tests and bandwidth tools | DSLReports, ISP Information

Thank you. I will do that and report back.

That is a very, VERY slow connection and it's no wonder you have so many issues.

Check if there are any LSP hooks. LSP-Fix - a free program to repair damaged Winsock 2 stacks

Go into safe mode with networking and try your software again. Does it work? Try your secure mail, etc.

Smokeping needs to ping your router. That's why I told you that you need to go into your router and allow pings. You only do this for 24 hours, then you can block pings once again. It's really not so much of a problem you need to worry about in terms of being "hacked." It's just a ICMP packet sent to your router and your router responds back. The great thing about Smokeping is it will indicate whether you have a bad line or not.

Did ADWcleaner find any ADware?

If you want great secure email, I recommend Protonmail. And with their paid option you can use it with the Thunderbird email client. They also have an App.


To put your Internet connection speed into perspective, your download rate is only around 246 KB per second. That was the equivalent of 3G cell data speed about 10 or so years ago.

That is a very, VERY slow connection and it's no wonder you have so many issues.

The funny thing is, it does not feel slow. I browse intensively, and it seems good enough. Except when it breaks, of course. Now it has reverted to its "normal", failed state, where OK'ing Verified by Visa closes the connection.

I checked the router's own diagnostics, and indeed some important figures are much worse than when I first installed it two years ago.

• Rate (downstream) = 2 427 Kbps (used to be 4 928 Kbps)
• SNR margin (downstream) = 6.3 dB (formerly 27 dB)
• SNR margin (upstream) = 18.7 dB (formerly 25 dB)
• Attenuation (downstream) = 34.5 dB (formerly 13 dB)
• Attenuation (upstream) = 29.1 dB (formerly 8.5 dB)

I started a Smoke Ping test.

Check if there are any LSP hooks. LSP-Fix - a free program to repair damaged Winsock 2 stacks

LSP Fix gives that error message :



That's strange. I have just "reset" Winsock three times. Once with those instructions, then with TCP Optimizer 4, and finally with ADW Cleaner.

Did ADWcleaner find any ADware?

Here are the logs :

***** [ Registry ] *****

Adware.Elex HKLM\Software\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|ENABLESHELLEXECUTEHOOKS
Adware.Elex HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|ENABLESHELLEXECUTEHOOKS
PUP.Optional.Legacy HKU\S-1-5-21-3431112999-1532402041-566182517-1001\Software\b1.org
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\AppID\OverlayIcon.DLL
PUP.Optional.Legacy HKLM\SOFTWARE\Classes\AppID\OverlayIcon.DLL
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}
PUP.Optional.Legacy HKLM\Software\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}
PUP.Optional.Legacy HKLM\Software\Classes\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}
PUP.Optional.Legacy HKLM\Software\Classes\OverlayIcon.MyOverlayIcon

***** [ Registry ] *****

Deleted HKLM\Software\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|ENABLESHELLEXECUTEHOOKS
Deleted HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|ENABLESHELLEXECUTEHOOKS
Deleted HKU\S-1-5-21-3431112999-1532402041-566182517-1001\Software\b1.org
Deleted HKLM\Software\Wow6432Node\Classes\AppID\OverlayIcon.DLL
Deleted HKLM\SOFTWARE\Classes\AppID\OverlayIcon.DLL
Deleted HKLM\Software\Wow6432Node\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}
Deleted HKLM\Software\Classes\TypeLib\{ADF1FA2A-6EAA-4A97-A55F-3C8B92843EF5}
Deleted HKLM\Software\Wow6432Node\Classes\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}
Deleted HKLM\Software\Classes\Interface\{7BCA6879-A9F8-47DE-AE05-F5CE7EA3A474}
Deleted HKLM\Software\Classes\OverlayIcon.MyOverlayIcon

If you want great secure email, I recommend Protonmail.

I prefer Tutanota. Contrary to Protonmail, you can register and use it completely anonymously, and the subject field is encrypted. Also, the paid plan is very cheap, while Protonmail's is quite expensive. Protonmail is more feature-rich, and it probably has a bigger team and more money. But anonymity trumps features anytime for me.