Payment Processing & Security Flashcards
7 cards from real CEC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Payment Processing & Security flashcards as text
Which of the following is a key advantage of using a hosted payment page versus an embedded payment form?
Answer: The payment processor handles PCI scope, reducing merchant compliance burden
With a hosted payment page, card data never touches the merchant's servers, dramatically reducing PCI DSS scope and compliance requirements.
What is the purpose of a 'reserve account' that acquiring banks may require from high-risk merchants?
Answer: To cover potential chargebacks, refunds, or liabilities if the merchant fails
Acquiring banks hold reserve funds as a buffer against merchant insolvency or excessive chargebacks to protect themselves from financial loss.
An ecommerce site experiences a spike in orders with mismatched AVS results. What is the most appropriate response?
Answer: Flag these orders for manual review or apply stricter fraud rules
AVS mismatches are a strong fraud signal; flagging or reviewing these orders balances fraud prevention against unnecessary order cancellations.
Which of the following describes a 'zero-liability policy' in payment card security?
Answer: Cardholders are not responsible for unauthorized transactions reported promptly
Card network zero-liability policies protect cardholders from financial loss due to unauthorized use of their card, provided they report the fraud promptly.
What does 'settlement lag' refer to in ecommerce payment processing?
Answer: The time between transaction authorization and funds deposited in the merchant account
Settlement lag is the delay—typically 1–3 business days—between when a transaction is authorized and when the merchant actually receives the funds.
Which regulation requires US financial institutions and payment processors to implement Customer Identification Programs (CIP)?
Answer: The Bank Secrecy Act / USA PATRIOT Act
The Bank Secrecy Act, as amended by the USA PATRIOT Act, requires CIP procedures to verify customer identities and prevent money laundering.
A merchant integrates Apple Pay into their ecommerce checkout. Which statement best describes the security model used?
Answer: Apple Pay transmits a device-specific token rather than the actual card number
Apple Pay uses device account numbers (tokens) instead of the real PAN, so merchants never receive or store the customer's actual card number.