Payment Security Protocols
Expert-defined terms from the Certificate Programme in Payment Technology Integration course at London School of Planning and Management. Free to read, free to share, paired with a globally recognised certification pathway.
3D Secure (3DS) #
3D Secure (3DS)
Concept #
3D Secure is a protocol designed to reduce the risk of credit card fraud in online transactions. It adds an extra layer of authentication by requiring cardholders to verify their identity during the checkout process.
Explanation #
3DS involves a three-domain model, consisting of the acquirer domain, issuer domain, and interoperability domain. When a customer makes an online purchase, they are redirected to a page hosted by their card issuer for authentication. This process helps merchants shift the liability for fraudulent chargebacks to the card issuer, providing an extra layer of security for online transactions.
Acquirer #
Acquirer
Concept #
An acquirer is a financial institution that processes credit or debit card transactions on behalf of a merchant.
Explanation #
Acquirers facilitate the transfer of funds between customers and merchants by handling the authorization, clearing, and settlement of transactions. They provide merchants with a merchant account, which is a specialized bank account that enables them to accept card payments.
Address Verification Service (AVS) #
Address Verification Service (AVS)
Concept #
AVS is a fraud prevention tool used in credit card transactions to verify the cardholder's billing address.
Explanation #
AVS compares the billing address provided by the cardholder during the transaction with the billing address on file with the card issuer. A mismatch can indicate potential fraud, leading the merchant to take additional steps to verify the cardholder's identity or decline the transaction.
Card Verification Code (CVC) / Card Verification Value (CVV) #
Card Verification Code (CVC) / Card Verification Value (CVV)
Concept #
CVC or CVV is a security feature printed on credit or debit cards to help prevent fraud in card-not-present transactions.
Explanation #
CVC or CVV is a three- or four-digit code located on the back of the card (for Visa, MasterCard, and Discover) or the front (for American Express). Merchants can require customers to provide this code during the checkout process to ensure that they have physical possession of the card.
Chargeback #
Chargeback
Concept #
A chargeback is a reversal of a credit card payment initiated by the card issuer, typically due to a customer dispute or fraud.
Explanation #
Chargebacks can result in merchants losing revenue and incurring fees. They can be caused by various reasons, such as customer dissatisfaction, fraud, or processing errors. Merchants have the opportunity to contest chargebacks, providing evidence to support their case.
Cryptocurrency #
Cryptocurrency
Concept #
Cryptocurrency is a digital or virtual form of currency that uses cryptography for secure financial transactions.
Explanation #
Cryptocurrencies operate independently of a central bank and offer a decentralized payment system. They rely on complex algorithms and cryptographic techniques to validate transactions and maintain security.
Distributed Denial of Service (DDoS) Attack #
Distributed Denial of Service (DDoS) Attack
Concept #
A DDoS attack is a malicious attempt to disrupt the normal functioning of a network, server, or website by overwhelming it with traffic.
Explanation #
DDoS attacks can target payment systems, causing outages, slowing down transactions, or compromising security. Attackers use a network of compromised computers (botnets) to send a flood of requests to the target, making it unavailable for legitimate users.
Endpoint Security #
Endpoint Security
Concept #
Endpoint security refers to the practice of protecting individual devices, such as computers, laptops, and mobile devices, from cyber threats.
Explanation #
Endpoint security is crucial for organizations and individuals to protect sensitive data and maintain the integrity of their systems. It involves implementing security measures such as antivirus software, firewalls, and intrusion detection systems to prevent unauthorized access and data breaches.
Firewall #
Firewall
Concept #
A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.
Explanation #
Firewalls can be hardware- or software-based and are essential for protecting networks and devices from unauthorized access, malware, and other cyber threats. They act as a barrier between a trusted internal network and an untrusted external network (e.g., the internet).
Fraud #
Fraud
Concept #
Fraud is the deliberate use of deception or dishonesty to gain an unfair or unlawful advantage, typically involving financial transactions.
Explanation #
Fraud can occur in various forms, such as identity theft, account takeover, or payment card fraud. It can result in financial losses, damage to reputation, and legal consequences for both individuals and organizations.
Gateway #
Gateway
Concept #
A payment gateway is a service that authorizes credit card or direct payment processing for e-commerce transactions.
Explanation #
Payment gateways facilitate the communication between a merchant's website and the payment networks, enabling secure and efficient transaction processing. They encrypt sensitive payment data and transmit it to the acquiring bank for authorization.
Hash Function #
Hash Function
Concept #
A hash function is a mathematical function that maps data of arbitrary size to a fixed size, creating a unique digital fingerprint.
Explanation #
Hash functions are used in various applications, including data integrity checks, password storage, and blockchain technology. They are designed to be non-reversible, making it computationally infeasible to derive the original data from the hash value.
HTTPS (Hypertext Transfer Protocol Secure) #
HTTPS (Hypertext Transfer Protocol Secure)
Concept #
HTTPS is a secure version of the HTTP protocol used for transmitting data over the internet.
Explanation #
HTTPS utilizes encryption technologies such as SSL/TLS to protect the integrity and confidentiality of data transmitted between a web server and a client (browser). It is essential for securing online transactions, protecting user data, and maintaining trust in online services.
Intrusion Detection System (IDS) #
Intrusion Detection System (IDS)
Concept #
An IDS is a security tool that monitors network traffic and alerts system administrators of potential security breaches or policy violations.
Explanation #
IDS can be host-based or network-based and help organizations detect and respond to cyber threats, such as malware, unauthorized access, or policy violations. They analyze network traffic and system logs for signs of suspicious activity, triggering alerts when threats are detected.
Malware #
Malware
Concept #
Malware is a type of software designed to disrupt, damage, or gain unauthorized access to computer systems.
Explanation #
Malware can take various forms, such as viruses, worms, trojans, ransomware, or spyware. It can be used to steal sensitive data, disrupt services, or compromise system security. Protecting against malware involves implementing security measures such as antivirus software, firewalls, and regular software updates.
Mobile Payment #
Mobile Payment
Concept #
Mobile payment is a method of payment that enables customers to make transactions using their mobile devices.
Explanation #
Mobile payment methods include in-app purchases, mobile web payments, and proximity payments using NFC technology. They offer convenience and security, enabling customers to make purchases without carrying physical cards or cash.
Multi #
Factor Authentication (MFA)
Concept #
MFA is a security measure that requires users to provide two or more forms of identification to access a system or perform a transaction.
Explanation #
MFA combines something the user knows (e.g., password), something the user has (e.g., security token), or something the user is (e.g., biometric data) to verify their identity. It provides an additional layer of security, making it more difficult for attackers to gain unauthorized access.
Network Security #
Network Security
Concept #
Network security refers to the practice of protecting network infrastructure and data from unauthorized access, misuse, or exploitation.
Explanation #
Network security involves implementing various security measures, such as firewalls, intrusion detection systems, and virtual private networks (VPNs), to protect network resources and