There are various payment security standards that eCommerce retailers should adopt to ensure that they are offering a secure payment process. Payment security certification providers can audit your compliance with these standards if you would like to obtain a quality seal to show how secure your payment process is.

PCI DSS standard for credit card payments

PCI DSS stands for Payment Card Industry Data Security Standards. These are the payment security guidelines that you should adhere to when processing payments made by credit card. Various credit card companies worked together to develop the PCI DSS framework, with the goal of creating a global standard to boost data security. To name just one example: online retailers are only allowed to save their customers’ credit card information if they are PCI DSS-certified.

It is the retailer’s obligation to regularly prove that they are complying with the security guidelines. To become PCI DSS-certified, you must furnish the following proofs of security:

• Annual self-assessment: This covers general information about your company, your relationships with other companies and technical details on how you process credit card information.

• Quarterly vulnerability scans: These help to detect any weak points in your systems or websites which might enable hackers to gain access to your customers’ credit card details. They include an evaluation of your network components, the operating systems and applications you use, and other parts of your infrastructure.

• Annual onsite audits The onsite security audit is primarily aimed at large companies that handle millions of transactions per year. It involves an inspection of server sites, employee interviews, auditing of process documentation and hardening standards, as well as a system configuration audit.
  
  

PSD 2

The Payment Services Directive 2 (PSD2) is a payment security standard that applies primarily to payments made in EU/EEA currencies. Its purpose is to increase payment security in digital transactions and ensure greater consumer protection. To comply with PSD2, credit card companies Visa and Mastercard have worked together with credit card industry association EMVCo to develop the 3-D Secure protocol. The latest version of the protocol, 3-D Secure 2, is PSD2-compliant and applies to all EU countries and Switzerland.

Two-factor authentication: Stronger payment security for your customers

Under PSD2, all online retailers accepting payments in EU/EEA currencies must secure their transactions using Strong Customer Authentication (SCA), as of 1 January 2021. This involves the use of two-factor authentication, based on at least two of these three factors:

• Knowledge: Something that only the customer knows, such as their password

• Possession: Something that is in the customer’s physical possession, such as their smartphone, on which they receive a transaction authentication number (TAN)

• Inherence: A unique personal characteristic, such as a fingerprint.

Example: If a customer wants to pay by bank transfer, they first have to enter their password to access their online banking platform. After that, they have to confirm their identity using facial recognition on their smartphone before the payment process can be completed.

Additional payment security for retailers

Two-factor authentication ensures increased payment security, not only for consumers, but also for retailers. It is a quick, easy and cost-effective way of verifying user identity and reducing the risk of fraud. PSD2 also makes transactions more secure for instant payment services like Giropay. For retailers, these payment methods are especially secure, because:

• The order is paid immediately and the payment process is directly authenticated. This enables you to process and ship the order more quickly.

• Customers cannot immediately reverse an authenticated payment. This reduces the risk of retracted payments for online retailers.

Another important aspect of increased payment security under PSD2 is that online retailers must keep their payment processes as short and clearly structured as possible. If a customer has to click through too many steps, it imposes an unnecessary hurdle for completing the checkout process.

Reasonable payment options

In many countries, like Germany, online shops are required to offer at least one common payment option which is free of charge. This requirement is also relevant for payment security. The District Court of Frankfurt has ruled that the bank transfer method Sofort cannot be classified as ‘reasonable’. That is because it requires users to enter their bank account login details, including a PIN and TAN, in an environment that is outside their usual online banking platform. This poses an increased risk of data privacy violation. If you want to integrate secure payment methods into your shop system, it is important to also keep track of which customer data will have to be transferred to third parties.

With that in mind, here is a list of payment methods that are considered common and reasonable:

• Buy now, pay later (payment by invoice)

• Pay in advance (e.g. bank transfer)

• SEPA direct debit

• PayPal

• Major credit cards