APRP Risk Assessment & Mitigation — Questions and Answers
Question 1: What is a payment risk assessment?
- A systematic evaluation of threats, vulnerabilities, and potential impacts to the payment system and its stakeholders (Correct answer)
- An assessment of the risk of a check bouncing
- A review of the risk of accepting new payment methods
- Only an evaluation of fraud losses
Correct answer: A systematic evaluation of threats, vulnerabilities, and potential impacts to the payment system and its stakeholders
Payment risk assessment identifies and evaluates threats (fraud, cyber attacks, operational failures), assesses vulnerabilities in systems and processes, and quantifies potential financial and reputational impacts.
Question 2: What is a chargeback and how does it impact merchants?
- A transaction reversal initiated by the cardholder's bank, resulting in the merchant losing the sale amount plus fees (Correct answer)
- A fee charged by the bank for processing a transaction
- A bonus payment to the merchant for high sales volume
- A refund processed by the merchant directly
Correct answer: A transaction reversal initiated by the cardholder's bank, resulting in the merchant losing the sale amount plus fees
Chargebacks reverse transactions, with merchants losing the sale revenue, goods/services, and paying chargeback fees. Excessive chargebacks can result in higher processing rates or account termination.
Question 3: What is the role of velocity checking in payment risk management?
- Monitoring the frequency and speed of transactions to detect unusual patterns that may indicate fraud (Correct answer)
- Checking the internet speed of payment processing systems
- Measuring how fast cashiers process transactions
- Timing how quickly customers complete checkout
Correct answer: Monitoring the frequency and speed of transactions to detect unusual patterns that may indicate fraud
Velocity checks monitor transaction frequency, amount, and timing patterns to identify potential fraud — such as multiple rapid transactions on the same card or from the same IP address.
Question 4: What is the purpose of a fraud investigation?
- To determine whether a suspected fraudulent transaction is confirmed fraud, gather evidence, and prevent future occurrences (Correct answer)
- To investigate employees suspected of tardiness
- To review vendor pricing for fraud
- Only to recover lost funds from criminals
Correct answer: To determine whether a suspected fraudulent transaction is confirmed fraud, gather evidence, and prevent future occurrences
Fraud investigations verify whether fraud occurred, identify perpetrators, document evidence for potential prosecution, recover losses where possible, and identify system improvements to prevent recurrence.
Question 5: What is cyber insurance for payment companies?
- Insurance coverage protecting against financial losses from cyber attacks, data breaches, and system failures (Correct answer)
- Insurance for internet service providers
- A warranty on payment processing hardware
- Only applicable to technology companies, not payment companies
Correct answer: Insurance coverage protecting against financial losses from cyber attacks, data breaches, and system failures
Cyber insurance covers financial losses from data breaches (notification costs, legal fees, regulatory fines), business interruption from cyber attacks, and third-party liability for compromised customer data.
Question 6: What is the principle of defense in depth for payment security?
- Multiple layers of security controls so that if one layer fails, others continue to protect the system (Correct answer)
- A military strategy unrelated to payment security
- Using only one very strong security control
- Defending against only the most common attack types
Correct answer: Multiple layers of security controls so that if one layer fails, others continue to protect the system
Defense in depth employs multiple security layers (firewalls, encryption, access controls, monitoring, physical security) so that no single point of failure can compromise the entire payment system.
APRP Risk Assessment & Mitigation
What is a payment risk assessment?