Online Payments: Security and Efficiency

As the volume of online transactions increases, so does the risk of financial fraud. To tackle these challenges, the European Union has implemented measures, mostly around security, to protect consumers and businesses alike. One crucial development is the introduction of 3D Secure v2: all payments must now go through risk assessments by banks and schemes.

📘

Risk-based assessments are based on the following elements:

• Client information
• Transaction value (usually large amounts are subject to challenge)
• Transaction history
• Device information
• Behavioural history

Determining the Payment Mode: Web or Direct Card Payments Mode?

Lemonway offers API methods for two types of card payment modes: Web and Direct Payments.

Web Payments

They are used when the end-user buys a service or goods on a partner's website and then is redirected to the PSP (Payment Service Provider) payment page. The benefits of using this mode are:

• PSPs are PCI-DSS certified

• PSPs usually support multiple currencies

• PSPs support a wide range of payment methods (debit and credit cards, mobile wallets, and more)

👍

Did you know?

Neither Lemonway nor the Partner process the bank card owners' data when this mode is used.

Direct Mode Payments

They are used when our Partners want to process payments using their own payment page, without redirecting their users to another URL outside their network.

🚧

PCI-DSS Certified

Partners using this mode are obliged to maintain a high level of network security and be PCI-DSS certified.

This section outlines Lemonway’s current card payment solutions and how you can implement them on a use-case basis.

Security and 3D Secure v2

Better known by its commercial names Visa Secure, Mastercard Identity Check or American Express SafeKey, the 3D Secure protocol aims to reduce fraud and strengthen the security of online payments.

To deal with fraudulent payments, the card networks rolled out the first version of the 3D Secure protocol in 2001: Address Verification System (AVS), CVC code verification, second verification with a code... However, it added complexity to the payment process so it has been rethought to give 3D Secure v2.

One of the main differences in version 2 is that the issuer can use a large amount of data from the transaction to determine the risk of the transaction (risk-based analysis). For low-risk transactions, issuers do not further check the transaction although they authenticate it (the transaction is fluid - without strong authentication). On the contrary, for high-risk transactions, issuers will require the cardholder to authenticate himself using a code sent via SMS or a biometric via an application or other means.

In addition, the strong authentication (SCA) required from 1 January 2021 for the European Union, as specified in the Payment Service Directive PSD2, will lead to a substantial increase in the number of transactions requiring the use of 3D Secure authentication. The use of 3D Secure version 2 should limit the negative impact on conversion as much as possible.

📘

Strong Authentificaction

The DIRECTIVE (EU) 2015/2366 defines the Strong Authentification as: "an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data".

Strong authentication is a guarantee of confidentiality that is particularly useful to ensure security.

3D Secure v2 - Impact for Card Payments

The Payment Service Directive, commonly known as PSP2 requires SCA (Strong Customer Authentication) to be implemented as part of a set of new measures to combat fraud and increase security. All CIT (Customer Initiated Transactions) are required to go through the 3-D Secure v2 protocol.

What does this change for you in the short term?

Lemonway wants to ensure that card payments are processed smoothly with no declines, we will outline some recommendations and best practices to help you during this transition period.

Partners using the Web Payment mode

For PCI-DSS Partners using Direct Payment mode (no PSP page):

🚧

Not Recommended

Lemonway does not recommend you use the MoneyIn and RegisterCard method from January 2021. Instead, you should use MoneyIn3DInit and MoneyIn3DConfirm only.

Frictionless Payments

Frictionless payments are essential for a seamless, secure transaction process, and they play a key role in tackling the complexity and security concerns that accompany online payments. Frictionless payments aim to reduce the complexity and stress of the entire transaction process for you and your client. We encourage you to optimize frictionless payments with your clients by populating as much information.

Frictionless payment examples include one-click payments, contactless card transactions, and digital wallet solutions.

You will find these additional input fields in the following methods:

SOAP API v1

• Initiate a Web Payment
• Initiate a Direct Payment (PCI-DSS compliant only)

REST API v2

• Initiate a Web Payment
• Initiate a Direct Payment (PCI-DSS compliant only)

Input Reference Help

These fields are considered to have high importance for scoring (and thus bolstering both security and user experience), it is recommended that they be populated in the information that is available. The most important fields are ranked from R1 (being the most important) to R4.