Payment Gateway

A payment gateway is a technological platform that facilitates the processing of electronic payments made by customers to merchants for products or services. It functions as an intermediary between the merchant's website or point of sale system and the customer's chosen payment method, which could be a credit or debit card, a digital wallet, a bank account, or alternative payment methods, like Buy Now, Pay Later or cryptocurrecy.

A Copy-&-Pay, or Payment widget, is a type of payment gateway integration that allows merchants to process online transactions securely without having to host the payment page on their own website. Instead, the payment page is hosted by the payment gateway provider, who provides a link or a button for the merchant to add to their website or checkout page.

The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that handle branded credit cards from the major card schemes. The PCI Standard is mandated by the card brands but administered by the Payment Card Industry Security Standards Council. The standard was created to increase controls around usage of cardholder data to reduce credit card fraud. The PCI Data Security Standard specifies twelve requirements for compliance, organized into six logically related groups called "control objectives". The six groups are:

• Build and Maintain a Secure Network and Systems
• Protect Cardholder Data
• Maintain a Vulnerability Management Program
• Implement Strong Access Control Measures
• Regularly Monitor and Test Networks
• Maintain and Information Security Policy

All companies who are subject to PCI DSS standards must be PCI compliant. However, how they prove and report their compliance is based on how many transactions they process per year and how they process those transactions. The acquirer or payment brands may also choose to manually place an organization into a reporting level at their discretion.

At a high level, the merchant levels are as follows:

o Level 1 – Over 6 million transactions annually
o Level 2 – Between 1 and 6 million transactions annually
o Level 3 – Between 20,000 and 1 million transactions annually (or any e-commerce merchant)
o Level 4 – Less than 20,000 transactions annually

Validation of compliance is performed annually or quarterly, by a method suited to the volume of transactions handled:

• Self-Assessment Questionnaire (SAQ) — smaller volumes
• External Qualified Security Assessor (QSA) — moderate volumes; involves an Attestation on Compliance (AOC)
• Firm-specific Internal Security Assessor (ISA) — larger volumes; involves issuing a Report on Compliance (ROC)

Strong Customer Authentication (SCA) is one of the requirements of Payment Services Directive 2 (PSD2). Its aim is to make online and (contactless) offline payments more secure. It asks merchants to add at least 2 of the following 3 authentication pathways into their online checkout:

• Ask the customer for information they KNOW ( e.g a password )
• Something the customer HAS ( e.g a hardware token )
• Ask the customer to prove who they ARE ( e.g a fingerprint or face ID )

3D Secure, also known as a payer authentication, is a security protocol that helps to prevent fraud in CNP (card not present) payment card transactions. This additional security was initiated and created by Visa and MasterCard and it’s branded as ‘Verified by Visa’ and ‘MasterCard SecureCode’ respectively.

The payer authentication is a three-part process, so there are three parties involved in the process: the issuer (such as Visa or MasterCard), the acquirer, and the interoperability domain (such as payment system).

3D Secure 2 (3DS2) is the updated security protocol that was formerly 3D Secure 1 (3DS1). Here’s what you need to know:

• It protects customers shopping online with a credit or debit card
• It uses a secure three-way authentication process to confirm the buyer’s identity in line with the SCA requirements of the PSD2.
• It performs as many security checks as possible in the background so the customer gets a smoother shopping experience.

A 99.99% uptime for a payment gateway means that the service is expected to be operational and available to process transactions for 99.99% of the time, with a maximum allowable downtime of 4.38 minutes per month (or 52.56 minutes per year). This level of uptime is considered to be very high and is often sought after by merchants who rely on uninterrupted payment processing for their business operations.