I believe this is a new(ish) initiative from the card companies that indeed does try to verify the transaction through the use of a PIN-like code. More here:
http://www.visaeurope.com/personal/onlineshopping/verifiedbyvisa/main.jsp (http://www.visaeurope.com/personal/onlineshopping/verifiedbyvisa/main.jsp)
http://www.mastercard.com/us/personal/en/cardholderservices/securecode/index.html (http://www.mastercard.com/us/personal/en/cardholderservices/securecode/index.html)
Although the links are US sites, this does also seem to apply to the UK as I've seen it myself when making purchases. However, if you are unsure at all, then the usual stuff applies to buying online, checking the URL, checking with the merchant. I should think that VSTEP should be able to confirm or deny that their electronic sales people (whether in-house or contracted out) use this method.
Cheers,
- Smiffa