Payments, Security, Fraud and Trust

Introduction

Electronic commerce depends on a promise: a customer will transfer value through a digital channel, and the merchant will deliver a product or service as agreed. Payments therefore involve more than choosing a button labelled “Pay.” They require coordinated decisions about payment instruments, processing infrastructure, authentication, data protection, fraud detection, dispute management and customer confidence.

For marketing managers, payment performance is commercially significant. A payment method can influence conversion, average order value, international expansion and customer loyalty. At the same time, weak security can create financial losses, regulatory penalties, reputational damage and customer harm. Effective marketplace management therefore treats payments and trust as strategic capabilities rather than purely technical functions.

This chapter compares major payment methods and infrastructure, explains essential security controls, and develops practical approaches to fraud, chargebacks, account takeover and cybersecurity incidents.

Learning Objectives

By the end of this chapter, students should be able to:

1. Compare cards, bank payments, digital wallets and buy-now-pay-later services.
2. Distinguish payment methods, payment gateways, processors, acquirers and payment service providers.
3. Explain authentication, encryption, tokenisation and the purpose of PCI principles.
4. Analyse chargebacks, transaction fraud and account takeover.
5. Design a proportionate response to a payment-related cybersecurity incident.
6. Evaluate the relationship between payment experience, security and consumer trust.

1. The Payment Ecosystem

A payment transaction involves several parties. The customer initiates payment; the merchant requests payment; the issuer provides the customer’s account or card; the acquirer processes transactions for the merchant; the payment network routes card transactions; and a payment service provider (PSP) may combine gateway, processing and risk-management services.

A payment gateway securely transmits payment information between the merchant’s checkout and the payment processor or acquirer. A gateway is comparable to a communication interface: it does not necessarily provide the underlying account or settle funds. A payment processor handles transaction messages and communication with banks or networks. In practice, many commercial providers combine gateway and processing functions.

The usual card sequence is:

1. The customer submits payment details or uses a wallet.
2. The gateway sends an authorisation request.
3. The issuer approves or declines the request.
4. The merchant receives the result and confirms or rejects the order.
5. During capture and settlement, funds move through the payment system.
6. A refund, reversal or chargeback may occur later.

Authorisation is approval to proceed with a transaction; it does not always mean that funds have finally settled. Capture requests the approved amount for settlement. This distinction matters for pre-orders, subscriptions, hotel reservations and marketplaces that release seller funds only after fulfilment.

2. Comparing Payment Methods

Cards

Credit and debit cards remain important because of their broad acceptance, familiar user experience and established dispute mechanisms. Credit cards can support higher-value purchases and short-term borrowing, whereas debit cards generally draw directly from a bank account.

Advantages include international usability, recurring-payment capability and relatively rapid authorisation. Limitations include interchange and scheme fees, fraud exposure, expiry or replacement problems, and chargebacks. Merchants must also manage failed authorisations and avoid storing unnecessary card data.

Bank transfers and account-to-account payments

Bank transfers can be less expensive than cards and are useful for high-value transactions, business purchases and markets with strong real-time payment systems. They may reduce card-related chargebacks, although mistaken transfers, social engineering and unauthorised account access remain risks. The customer experience may be weaker when payment confirmation is delayed or when the user must leave the merchant website.

Digital wallets

A digital wallet stores payment credentials, identity information or value and allows users to pay through an app, device or online account. Wallets may use tokenised card credentials and device authentication such as biometrics or a passcode. They can improve mobile conversion by reducing manual entry.

Wallets also create dependence on a platform provider and may limit access to transaction data. If a customer’s wallet account is compromised, several linked merchants may be affected. Merchants should therefore treat wallet payments as convenient but not automatically risk-free.

Mobile and contactless payments

Near-field communication (NFC) enables short-range contactless payment. In many implementations, the device supplies a token rather than the underlying card number. Contactless payments are fast and convenient, but transaction limits and offline approval rules may apply.

Cash on delivery

Cash on delivery can build confidence in markets where consumers distrust online payment or lack cards. However, it increases delivery failure, handling cost, cash-management risk and uncertainty about demand. It is a logistics and credit-risk decision as much as a payment decision.

Buy-now-pay-later (BNPL)

BNPL allows a customer to receive goods immediately and repay over a schedule, sometimes without interest to the customer. The provider generally pays the merchant, subject to fees, and assumes some repayment risk.

BNPL may increase conversion and average order value, particularly for discretionary or higher-priced products. Risks include provider fees, customer over-indebtedness, regulatory scrutiny, repayment defaults and reputational association with unaffordable borrowing. Merchants should not judge success solely by immediate sales; they should also monitor refunds, complaints, repeat purchasing and customer welfare.

A sound payment strategy offers a focused portfolio rather than every possible method. The decision should consider customer segments, geography, product risk, transaction value, settlement timing, fees, refund processes, fraud exposure and regulatory requirements.

3. Authentication, Authorisation and Non-repudiation

These terms are related but distinct.

• Authentication establishes who the user is.
• Authorisation determines what an authenticated person or system is permitted to do, and in payments also refers to issuer approval of a transaction.
• Accounting or auditability records what happened.
• Non-repudiation seeks reliable evidence that a party performed an action, although no control eliminates every legal dispute.

Customer authentication may use knowledge factors, possession factors or inherence factors. A password is knowledge; a registered device or one-time code is possession; a fingerprint is inherence. Multi-factor authentication (MFA) combines independent factors. Two passwords are not normally two independent factors.

Strong customer authentication may use risk-based or step-up methods. A low-risk purchase on a recognised device may proceed with minimal friction, while a high-value transaction, new delivery address or unusual login may require additional verification. The managerial challenge is to reduce fraud without unnecessarily reducing conversion.

3-D Secure is a card-not-present authentication framework. Depending on the risk assessment, the customer may experience a frictionless flow or be asked for an additional challenge. Authentication can shift certain liability arrangements, but it is not a complete fraud solution: compromised legitimate accounts may still pass authentication.

4. Encryption and Tokenisation

Encryption transforms readable data (plaintext) into unreadable ciphertext using an algorithm and key. Authorised systems decrypt it when required. Transport Layer Security (TLS) protects data in transit between systems, such as a browser and a checkout server. Encryption at rest protects stored data, such as databases and backups.

Encryption does not solve every security problem. If an attacker obtains decryption keys, compromises an authorised application or deceives a legitimate user, encrypted storage may not prevent misuse. Key management, access control, patching, monitoring and secure development are equally important.

Tokenisation replaces sensitive data with a token that has limited value outside a controlled system. A payment token may represent a card credential without revealing the primary account number to the merchant. The token vault or payment provider maps the token to the underlying credential.

Encryption and tokenisation differ. Encryption is a reversible transformation using a key; tokenisation substitutes a reference. Tokenisation can reduce the number of systems exposed to card data and may reduce compliance scope, but it does not automatically remove all obligations. A merchant still has responsibilities for its checkout, provider relationships, access controls and security practices.

Good practice includes:

• using TLS and valid certificate management;
• prohibiting sensitive payment data in logs, URLs and analytics tools;
• limiting access according to job role;
• separating production, testing and development data;
• protecting cryptographic keys separately from encrypted data;
• regularly patching payment applications and dependencies;
• testing backups and recovery procedures.

5. PCI Principles and Governance

The Payment Card Industry Data Security Standard (PCI DSS) is an industry security standard for organisations that store, process or transmit payment-card data. Its detailed requirements change over time, but its underlying principles include secure configuration, protection of stored data, encrypted transmission, vulnerability management, access control, monitoring and regular testing.

PCI compliance is not identical to security. Compliance is evidence that specified controls and processes are in place at a point in time or within a defined assessment scope. Security is the continuing reduction and management of risk. A compliant organisation can still suffer a breach if controls are poorly operated or a new vulnerability is exploited.

A merchant can reduce exposure by using hosted payment pages or tokenised provider components. Nevertheless, outsourcing does not transfer all responsibility. The merchant must select competent providers, define responsibilities contractually, monitor provider assurance, secure its own website and ensure that payment pages have not been altered by malicious code.

A practical governance programme should include a data-flow map, asset inventory, risk register, supplier review, access reviews, security training, incident playbooks and periodic technical testing. Marketing and e-commerce teams should be involved because tracking scripts, promotions, landing pages and customer-data integrations can affect payment security.

6. Fraud in E-Commerce

Fraud is intentional deception for financial or other benefit. Payment fraud is not a single behaviour; it includes stolen-card use, identity fraud, refund abuse, promotion abuse, triangulation fraud, friendly fraud and account takeover.

Transaction fraud

In card-not-present fraud, an offender uses stolen payment credentials to purchase goods remotely. Warning signs can include unusual device characteristics, mismatched billing and delivery information, rapid high-value ordering, multiple cards used from one device, repeated declines and delivery to a high-risk location. No single signal proves fraud. Legitimate customers may travel, use virtual private networks or send gifts.

A risk-based fraud system combines signals, creates a risk score and applies an action such as approve, challenge, review or decline. It should be calibrated using outcomes rather than intuition. Excessive declines create false positives, where legitimate customers are rejected. Excessive approvals create false negatives, where fraud is accepted.

Useful operational metrics include:

Here, fraud losses should be defined consistently, and total processed sales should use the same period and currency basis. The measure may exclude or include fees, goods recovered and chargeback costs; the chosen definition must be documented.

A merchant processing $500,000 in sales and suffering $4,000 of confirmed fraud losses has a fraud loss rate of 0.8%, because $4,000 ÷ $500,000 × 100% = 0.8%. This metric alone is insufficient: a low rate achieved through aggressive declines may conceal lost legitimate revenue.

Account takeover

Account takeover (ATO) occurs when an attacker gains control of a legitimate customer or seller account. Common routes include credential stuffing, phishing, malware, SIM-related attacks, reused passwords and social engineering. Consequences include unauthorised purchases, stored-value theft, loyalty-point abuse, address changes and reputational damage.

Controls include breached-password screening, MFA, login-rate limits, device and session monitoring, anomaly detection, reauthentication for sensitive changes, notification of new devices and careful customer-support verification. Support staff should not reset accounts solely because a caller supplies easily discoverable personal information.

Marketplace and seller fraud

Marketplaces face counterfeit goods, fake sellers, non-delivery, review manipulation, payment diversion and collusion. Seller onboarding should include identity and business verification proportionate to risk. Other controls include delayed payouts for new sellers, transaction monitoring, buyer protection, evidence requirements and independent complaint review.

7. Chargebacks and Disputes

A chargeback is a payment reversal initiated through the cardholder’s issuer or payment system. It may arise from unauthorised use, processing errors, duplicate billing, non-receipt, defective goods or a customer dispute. A customer refund requested directly from the merchant is different from a chargeback, although both affect financial reporting and customer experience.

The chargeback process usually includes a claim, notification to the merchant, temporary or permanent reversal, merchant evidence, issuer or network review and a final decision. Rules and time limits vary by payment system and jurisdiction, so merchants must follow current network and provider requirements.

A strong dispute-management process preserves:

• order confirmation and checkout records;
• authentication results and authorisation codes;
• delivery evidence, tracking and signature where appropriate;
• product descriptions and terms shown at purchase;
• customer-service communications;
• refund and cancellation records;
• device and account evidence, handled lawfully and proportionately.

The objective is not to reject every dispute. A legitimate dispute should be resolved fairly and quickly. Friendly fraud describes disputes in which a customer, intentionally or mistakenly, claims that a legitimate transaction was unauthorised or that goods were not received. Treating every disputing customer as dishonest damages trust. Clear descriptors on statements, easy refunds and responsive support can prevent avoidable disputes.

A useful management measure is the chargeback rate:

The numerator and denominator must use the same reporting period and transaction population. Different networks may calculate thresholds differently, so internal reporting should not be treated as a universal network rule.

8. Cybersecurity Incident Management

An incident may involve malware, payment-page skimming, credential theft, exposed cloud storage, ransomware, unauthorised administrative access or a compromised third-party script. The first priority is to protect people and contain harm while preserving evidence.

A practical incident lifecycle is:

1. Preparation: assign roles, maintain contact lists, test backups and rehearse scenarios.
2. Detection and analysis: validate alerts, determine affected systems, establish a timeline and classify data.
3. Containment: isolate affected accounts, systems or scripts without destroying evidence.
4. Eradication: remove malicious access, rotate credentials and remediate the vulnerability.
5. Recovery: restore safely, monitor for recurrence and validate payment integrity.
6. Notification and learning: meet legal, contractual and network obligations; communicate accurately; conduct a post-incident review.

The response team may include security, IT, legal, compliance, payments, customer service, communications and senior management. An organisation should avoid speculative public statements, blaming customers without evidence or quietly deleting logs. Notification duties depend on jurisdiction, affected data, contractual terms and sector rules; specialist legal advice is appropriate.

9. Trust, Ethics and Consumer Protection

Trust is partly technological and partly relational. Customers infer trust from payment security indicators, transparent pricing, reliable fulfilment, accessible support, fair refunds and consistent privacy practices. A padlock icon alone does not establish trustworthy commerce.

Ethical payment management requires informed consent, data minimisation, non-discrimination and responsible use of automated risk systems. Fraud models may disadvantage customers from certain locations, devices or demographic groups because historical data contains bias. Managers should test disparate error rates, provide review mechanisms and avoid using sensitive attributes without lawful and ethical justification.

BNPL marketing deserves special care. Messages should not imply that borrowing is costless, universally suitable or consequence-free. Merchants should present repayment terms clearly and avoid targeting financially vulnerable customers with manipulative urgency.

Privacy regulations commonly require lawful processing, purpose limitation, security safeguards and rights for individuals, although exact duties differ by jurisdiction. Payment data should not be collected merely because it might be useful later. Data retention schedules should distinguish what is legally required from what is commercially convenient.

10. Applied Case: BrightCart Marketplace

Background

BrightCart is an illustrative regional marketplace selling electronics and home products. It accepts cards, a local bank-transfer method, two digital wallets and BNPL. Sales have grown rapidly, but its chargeback rate has increased and customer-support staff report account takeovers.

Problem

The company’s checkout stores a customer’s card reference in several internal systems. New sellers receive payouts immediately. Fraud rules focus mainly on order value and country. Support agents reset passwords after answering basic identity questions. Marketing has also installed several third-party scripts on checkout pages without a formal security review.

Analysis

The weaknesses are interconnected. Broad payment-data distribution increases exposure. Immediate seller payouts increase marketplace risk. Simple fraud rules miss low-value testing transactions and coordinated attacks. Weak support verification enables ATO. Unreviewed scripts create payment-page supply-chain risk. Declining every unusual order would reduce conversion and would not address account compromise.

Approach and solution

BrightCart adopts hosted tokenised payment components and removes payment data from marketing analytics. It maps data flows and assigns a security owner for every provider. It introduces MFA for sellers and step-up verification for sensitive customer-account changes. New sellers receive staged payouts until they establish a reliable fulfilment record.

The risk engine uses multiple signals, including device history, velocity, account age, delivery changes and payment authentication. Orders are classified as approve, challenge, manual review or decline. A customer-friendly review path is created for legitimate travellers and gift purchasers.

BrightCart establishes a dispute team, standardises evidence collection and improves statement descriptors. It adds a self-service refund process for eligible orders. Incident playbooks cover payment-page compromise, provider outage and mass account takeover. Third-party scripts are inventoried, minimised and reviewed before deployment.

Outcome

In this illustrative scenario, BrightCart reduces unnecessary declines, identifies coordinated seller abuse earlier and shortens dispute response time. More importantly, it improves control ownership and customer communication. The outcome is not “zero fraud”; rather, the firm achieves a more defensible balance among conversion, loss prevention, compliance and trust.

Learning points

1. Payment security is an ecosystem responsibility.
2. Tokenisation reduces exposure but does not eliminate governance.
3. Fraud controls must address both transactions and accounts.
4. Marketplace payout timing is a risk-management tool.
5. Customer experience and security should be designed together.

11. Contemporary Developments and Best Practice

Payment systems are evolving through open banking, real-time account payments, biometric authentication, network tokenisation, digital identity, embedded finance and artificial-intelligence-assisted fraud detection. AI can identify complex patterns across devices, accounts and transactions, but it may produce opaque decisions, false positives and privacy concerns. Human review, model monitoring, explainability appropriate to the context and documented governance remain necessary.

Best practice for an e-commerce manager includes:

• offer payment methods based on customer need and risk, not fashion;
• use reputable providers and document shared responsibilities;
• minimise stored payment data through tokenisation or hosted components;
• require MFA for privileged, seller and high-risk activities;
• monitor both fraud losses and lost legitimate sales;
• maintain reliable refund, reconciliation and chargeback processes;
• protect checkout scripts and third-party integrations;
• rehearse incidents and maintain tested recovery procedures;
• communicate clearly about prices, repayment, refunds and security;
• review automated decisions for bias and unintended exclusion.

Chapter Summary

Payments are a strategic component of e-commerce value creation and trust. Cards, bank payments, wallets, contactless methods, cash on delivery and BNPL offer different combinations of convenience, cost, reach, risk and consumer responsibility. Gateways, processors, acquirers, issuers and payment service providers perform distinct but connected functions.

Authentication establishes identity, while authorisation governs permission or approves a transaction. Encryption protects data through transformation; tokenisation substitutes a limited-use reference for sensitive payment credentials. PCI principles support secure payment-card handling, but compliance does not guarantee complete security.

Effective fraud management combines transaction monitoring, account protection, authentication, seller controls and human review. Chargebacks require accurate evidence, fair customer treatment and timely processes. Cybersecurity incidents demand preparation, containment, recovery, notification and organisational learning. Ultimately, trust results from secure technology combined with transparent, ethical and reliable customer treatment.

Key Terms

Authentication: The process of establishing the identity of a user or system.

Authorisation: Permission to perform an action; in payments, also issuer approval of a transaction.

Acquirer: A financial institution or provider that supports merchant payment acceptance.

BNPL: Buy-now-pay-later financing that allows scheduled repayment after purchase.

Chargeback: A payment reversal initiated through a cardholder’s issuer or payment system.

Encryption: Transformation of readable data into protected ciphertext using an algorithm and key.

False positive: A legitimate transaction or user incorrectly classified as risky.

Gateway: Technology that securely transmits payment information between checkout and payment infrastructure.

Issuer: The institution that provides a customer’s card or payment account.

MFA: Authentication using two or more independent factor types.

Payment processor: An organisation that handles payment messages and transaction processing.

PCI DSS: An industry standard for protecting payment-card data.

Payment token: A substitute value representing a payment credential.

PSP: A payment service provider offering one or more payment acceptance and risk services.

Risk-based authentication: Applying stronger verification when transaction or account risk is higher.

Settlement: The process through which approved funds are transferred and reconciled.

Tokenisation: Replacing sensitive data with a reference token of limited independent value.

Transaction fraud: Deliberate misuse of payment or identity information to obtain value.

Account takeover: Unauthorised control of a legitimate customer or seller account.

Review Questions

Short Answer Questions

1. What is the difference between a payment gateway and a payment processor?
2. Distinguish encryption from tokenisation.
3. Why does PCI compliance not guarantee complete security?
4. What is a chargeback?
5. Give two controls that can reduce account takeover.

Long Answer Questions

1. Compare cards, bank transfers, digital wallets and BNPL as payment options for an international marketplace.
2. Explain how authentication, authorisation and MFA contribute to secure commerce.
3. Discuss the benefits and limitations of tokenisation and hosted payment pages.
4. Describe a complete chargeback-management process, including prevention and evidence.
5. Explain how an organisation should respond to a payment-page cybersecurity incident.

Analytical / Application Questions

1. A marketplace experiences increased fraud after enabling immediate payouts to newly registered sellers. Analyse the risks and recommend controls.
2. A fraud model reduces fraud losses but also causes a large increase in legitimate-order declines. How should management evaluate and redesign the system?
3. Design a payment and trust strategy for a mobile marketplace serving customers who use cards, wallets, bank payments and BNPL. Justify your method portfolio, security controls and performance measures.

Multiple Choice Questions with Answers

Question 1

Which party normally issues a customer’s payment card or account?

A. The acquirer

B. The issuer

C. The payment gateway

D. The merchant

Correct Answer: B. The issuer

Question 2

What is the primary purpose of tokenisation in payment security?

A. To increase the credit limit on a card

B. To replace sensitive data with a limited-use substitute

C. To eliminate the need for customer authentication

D. To guarantee that all transactions are approved

Correct Answer: B. To replace sensitive data with a limited-use substitute

Question 3

Which statement best distinguishes authentication from authorisation?

A. Authentication establishes identity; authorisation determines permission

B. Authentication settles funds; authorisation encrypts data

C. Authentication is used only by banks; authorisation only by merchants

D. They are identical terms in all payment contexts

Correct Answer: A. Authentication establishes identity; authorisation determines permission

Question 4

A merchant processes $200,000 in sales and records $1,000 of confirmed fraud losses. What is its fraud loss rate using the formula in the chapter?

A. 0.05%

B. 0.5%

C. 5%

D. 20%

Correct Answer: B. 0.5%

Question 5

Which practice most directly reduces the exposure created by storing card data in multiple merchant systems?

A. Increasing the number of checkout scripts

B. Using tokenised or hosted payment components

C. Removing all refund procedures

D. Allowing shared administrator passwords

Correct Answer: B. Using tokenised or hosted payment components

Question 6

What is account takeover?

A. A legitimate customer returning an order

B. An attacker gaining control of a legitimate account

C. A bank approving a transaction

D. A merchant changing its payment processor

Correct Answer: B. An attacker gaining control of a legitimate account

Question 7

Which is an example of a false positive in fraud detection?

A. A stolen card being used successfully

B. A legitimate customer’s order being incorrectly declined

C. A confirmed fraudulent order being blocked

D. A customer receiving a valid refund

Correct Answer: B. A legitimate customer’s order being incorrectly declined

Question 8

Which evidence is most relevant when contesting a non-delivery chargeback?

A. The company’s social-media follower count

B. Delivery tracking and proof of delivery

C. The colour of the merchant logo

D. The customer’s unrelated browsing history

Correct Answer: B. Delivery tracking and proof of delivery

Question 9

Which sequence best represents a standard cybersecurity incident lifecycle?

A. Preparation, detection, containment, eradication, recovery and learning

B. Marketing, pricing, promotion, sales and advertising

C. Authorisation, capture, settlement, advertising and fulfilment

D. Encryption, tokenisation, refund, delivery and acquisition

Correct Answer: A. Preparation, detection, containment, eradication, recovery and learning

Question 10

Why should BNPL be evaluated beyond its effect on immediate conversion?

A. Because it can involve customer welfare, repayment and regulatory risks

B. Because it cannot be used for online purchases

C. Because it always eliminates merchant fees

D. Because it prevents all chargebacks

Correct Answer: A. Because it can involve customer welfare, repayment and regulatory risks