<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-8.webp" alt="M2P Fintech" title="" width="100%" height="383">Over the last few years, e-commerce and <a class="link" href="https://m2pfintech.com/blog/the-rise-of-digital-payments/" target="">digital payments</a> have become a comfortable cosmos for millions of shoppers worldwide. Card-Not-Present (CNP) transactions, in particular, constitute a major chunk of online payments.<h2 class="heading-node" id="cbf4">Card-not-present transactions</h2>Essential to both in-store and online businesses, CNP payments reduce the risk of customer churn and cart abandonment. Imagine a customer does not have a physical credit or has a visibly battered card that cannot be scanned. They can still pay for the purchase using the CNP facility across the counter or telephone or digital channels.But like most things in life, CNP payments are a double-edged sword. They are highly sophisticated yet so vulnerable to security breaches. When a scamster gets hold of the credit card number, name, three-digit security code (CVV), and expiration date, stealing cash and identity becomes a cakewalk.<blockquote class="block-node" id="o40ybrinh">As of 2021, CNP frauds were 81% more common than card-present scams, resulting in tremendous costs to banks and merchants.</blockquote><h2 class="heading-node" id="66f3">Cost of payment fraud</h2>The cost associated with payment fraud is immense for banks, merchants, and payment service providers. They’ll have to deal with customer refunds, additional chargeback fees, fines, and investigation charges. Though the amount is usually refunded to the victim, it still causes distress and mistrust.<h2 class="heading-node" id="b033">Best way to prevent CNP fraud — PCI 3DS</h2>The way to avert CNP fraud is to implement stringent controls that validate the identity of the cardholder. PCI 3D Secure plays a significant role in enabling identity validation and access control, thereby reducing the costs and inefficiencies associated with payment fraud in a CNP scenario. Banks and card payment service providers need to comply with PCI 3DS protocols to fortify transaction security.<h2 class="heading-node" id="deaa">What is PCI 3DS?</h2>PCI 3DS is an advanced EMV messaging procedure that authenticates cardholders when making online purchases. It facilitates seamless data exchange between merchants, cardholders, and card issuers, thereby providing an additional layer of security to avoid CNP fraud and make e-commerce secure.<h2 class="heading-node" id="f06c">Key components of PCI 3DS Core Security Standard</h2>The PCI 3DS Core Security Standard serves as a framework for EMV 3DS functions to execute security controls. It supports the integrity and confidentiality of 3DS transactions and pertains to institutions that leverage 3DSS, DS, and ACS, the key components of the PCI 3DS security standard.Here’s a quick peek into what each component means.•&nbsp;3DS Server (3DSS)&nbsp;contributes the functional interface between the 3DS requester environment and the DS.•&nbsp;3DS Directory Server (DS)&nbsp;holds the list of valid card ranges for which authentication may be available. Further, it also coordinates communication between the 3DSS and the ACS systems to ascertain whether authentication mechanisms are available for a particular card number and device type.•&nbsp;3DS Access Control Server (ACS)&nbsp;comprises the authentication rules and is managed within the issuer domain.The physical and logical security requirements for the PCI 3DS Core Security Standard are structured as follows.Baseline Security Requirements<ul class="list-node" id="qtc61d1ze"><li>These are technical and operational security requirements that reflect general information security principles and practices common to industry standards.</li><li>These requirements should be considered for all types of environments.</li></ul>3DS Security Requirements<ul class="list-node" id="qgbh7rkln"><li>They provide security controls specifically intended to protect 3DS data, technologies, and processes.</li></ul><h2 class="heading-node" id="1289">Difference between PCI 3DS and PCI DSS</h2>The PCI 3DS and PCI DSS are two separate standards intended for varying requirements and entities. The PCI 3DS applies to environments where 3DSS, ACS, and/or DS functions are performed, whereas PCI DSS applies wherever payment card account data is stored, processed, or transmitted.If you want to know more about PCI DSS, check out our blog on the&nbsp;<a class="link au nb" href="https://medium.com/m2p-yap-fintech/12-requirements-of-pci-dss-157747451888" rel="noopener">12 REQUIREMENTS OF PCI DSS.</a>Most 3D secure entities possess both PCI 3DS and PCI DSS responsibilities. In some cases, a 3DS entity does not store, process, or transmit any payment card account data. For instance, in the case of EMV payment tokens, the 3DS entity is involved ONLY in 3DS transactions. The 3DS entity may not be subject to PCI DSS in this scenario. In all other cases, entities should refer to their acquirer and/or the payment brand(s) to determine their compliance obligations to a PCI standard.So, are you looking to get PCI DSS certified and compliant? We can help.<a class="link au nb" href="https://m2pfintech.com/" target="_blank" rel="noopener ugc nofollow">M2P</a>&nbsp;has extensive experience in ensuring compliance for numerous players in the card payment industry. Write to us at&nbsp;<a class="link au nb" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener ugc nofollow">business@m2pfintech.com</a>, and let’s get started!Here’s to more dynamically authenticated 3DS transactions!<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Prevent CNP Frauds with PCI 3DS

3D Secure: Your Barrier against Cyber Attacks

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/04/pci-dss.webp" alt="M2P Fintech" title="" width="100%" height="253">The payment industry is constantly growing where every upgrade plays an important role in developing trust among users by protecting their sensitive data. So, every business that is an active participator needs to meet few security standards that act as Armour.One such globally recognized standard is PCI DSS.The PCI Security Standards Council came up with a Payment Card Industry Data Security Standard (PCI DSS) framework to protect credit and debit card transactions and card holders’ data from breaches. It is a mandate for every merchant and service provider to abide by this protocol for a smooth customer experience.<h2 class="heading-node" id="e2ee" style="text-align: justify">How was PCI DSS created?</h2>It all began during the internet boom in the late 1990s, when the initial stage of e-commerce brought in many fraudsters and excitement. When the retailers, merchants, card networks, consumers widely accepted the emerging web-driven transactions, they witnessed a steady increase in credit card fraud and scams. That is when the card networks like American Express, MasterCard, and Visa started to dig deep into the issue to create standards for payment processing systems.With Visa taking the lead in 2001 “Cardholder Information Security Program” standard was introduced, followed by the other companies implementing their security standards. But it did not meet the expectations of the merchants and POS terminals as they need to comply individually with the company-specific standards. This resulted in great difficulty for merchants as they have to comply with different standards when they are approaching multiple card networks. So, the collaboration of the major card networks such as American Express, Discover, JCB, Mastercard, and Visa birthed PCI DSS version 1.0 in December 2004.Later in 2006, the Payment Card Industry Security Standards Council (PCI SSC) was formed by a joint venture of MasterCard, American Express, Visa, JCB International, and Discover Financial Services to manage PCI development and alignment of policies to PCI DSS. PCI SSC ensures that the entities are committed to secure credit card data.PCI DSS is now a globally recognized directive where every merchant who accepts card payments must comply with the latest version, PCI DSS 3.2.1, which was released in May 2018.<h2 class="heading-node" id="edca" style="text-align: justify">Why do merchants need to comply with PCI DSS?</h2>Since there are over multiple card transactions taking place in the market, a safe business environment becomes the prime concern for the merchants to lead a long haul. A business compliant with PCI DSS always earns customers’ trust for their sensitive card information and helps boost the sale and customer confidence. As every business relies on partners, acquirers, or fellow industry mates, being a PCI DSS Compliant helps improve one’s reputation and strategies.Data breaches, payment card data theft, can be avoided as it is stored securely and monitored on a regular basis. In addition, PCI DSS even helps in improving IT infrastructure efficiency with its compliance levels and requirements.<h2 class="heading-node" id="de60" style="text-align: justify">PCI DSS Compliance levels</h2>There are four levels of PCI DSS Compliance based on the number of annual payment card transactions a business handle.Level 1:&nbsp;over 6 million TXNLevel 2:&nbsp;1 to 6 million TXNLevel 3:&nbsp;20,000 to 1 million TXNLevel 4:&nbsp;fewer than 20,000 TXNCheck out our guide to the&nbsp;<a class="link au mj" href="https://m2pfintech.com/blog/pci-dss-a-quick-guide-to-its-levels/" rel="noopener">PCI DSS Levels</a>&nbsp;and their impact on compliance.<h2 class="heading-node" id="a8f1" style="text-align: justify">Requirements for PCI DSS Compliance</h2>Every system entity and component associated with Cardholder Data Environment (CDE) must comply with the PCI DSS mandate. It includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures.PCI DSS sets forth 12 requirements for every PCI DSS complaint established by the PCI Security Standards Council:<h3 class="heading-node" id="757b" style="text-align: justify">1. Firewall Configuration</h3>Firewalls are installed and configured to protect card holders’ data from any malware. It helps the prevention systems effectively to defend the hackers from unauthorized access to private data.<h3 class="heading-node" id="625d" style="text-align: justify">2. Password Security</h3>Businesses should not use vendor-supplied defaults for system passwords and other security parameters in their routers, modems, point of sale (POS) systems, and other third-party products. Instead, basic precautions and configurations like changing the password should be followed as the public can easily access the generic passwords and security measures.<h3 class="heading-node" id="ad5f" style="text-align: justify">3. Protection of Cardholder Data</h3>The stored cardholders’ data must be encrypted with two-fold protection and certain algorithms. Also, the primary account numbers (PAN) must be regularly scanned and monitored to avoid any unencrypted data.<h3 class="heading-node" id="1dad" style="text-align: justify">4. Encryption of Transmitted Data</h3>The cardholders’ data should be encrypted when transmitted across open, public networks like payment processors, home offices from local stores, etc. Sharing the account numbers to unknown locations must be avoided.<h3 class="heading-node" id="9653" style="text-align: justify">5. Antivirus Software</h3>All the systems used for interacting, sharing, storing PAN must be protected against malware by regularly using and updating antivirus software or programs. Also, POS providers must employ anti-virus measures and maintain up-to-date antivirus programs to prevent systems from malware.<h3 class="heading-node" id="f58e" style="text-align: justify">6. Secure Systems and Applications</h3>To add another layer of protection to the data, the providers must develop and maintain secure systems and applications. These systems and applications that are used as the storage of data for interaction must be updated regularly.<h3 class="heading-node" id="f835" style="text-align: justify">7. Restriction of Access</h3>The cardholders’ data are restricted to access by business need-to-know, and the sensitive data must be accurately documented and updated regularly.<h3 class="heading-node" id="bffa" style="text-align: justify">8. Unique Access ID</h3>Individual credentials and ID are assigned to each person with computer access to card holders’ data. Single access ID and password should not be used as it results in more vulnerability and slow response time.<h3 class="heading-node" id="57e9" style="text-align: justify">9. Restriction of Physical Access</h3>Card holders’ data must be physically stored in a secured location where any physical access is restricted. Physically written, typed, or digitally stored data must be secured in the room, and in case of any access, it should be added to the access logs.<h3 class="heading-node" id="7c0d" style="text-align: justify">10. Maintain Access Logs</h3>As mentioned in the previous requirement, all access to network resources and cardholder data must be tracked and monitored in the access logs. This proper record keeping and documentation must be maintained with utmost accuracy as it is related to sensitive data.<h3 class="heading-node" id="aecf" style="text-align: justify">11. Testing Security Systems and Processes</h3>Regularly testing/scanning security systems and processes result in less vulnerability as it involves many digital data, software programs/products, physical locations, etc.<h3 class="heading-node" id="625c" style="text-align: justify">12. Document Policies</h3>Document policies that address information security for all personnel must be maintained right from storing to transmitting/using data after POS.So, with these twelve requirements, PCI DSS comprises six objectives to ensure optimal security for merchants who accept, process, transmit, or store payment card information.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/06/image-1.webp" alt="M2P Fintech" title="" id="jxi8l3syj" width="100%" height="253">With PCI DSS’s strong objectives and compliance requirements, the security of the payment industry is strengthened. These measures help and encourage data security and facilitate the adoption globally. So, hereby businesses that handle card payments need to be a part of this global payment card data security solution and focus on increasing the intensity to move forward by becoming ‘PCI DSS Complaint.’Look forward to our upcoming blogs as we uncover PCI SSC’s other standards such as PCI 3 DS, PA DSS, PCI PIN Security, and PCI SSF.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

PCI DSS: The Payments’ Armour

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Wordpress-main-.webp" alt="M2P Fintech" title="" width="100%" height="356">Know Your Customer/Know Your Client (KYC) is a mandatory process that verifies and authenticates a customer’s identity. All legal and financial institutions must validate their customers to prevent any illegal or fraudulent activities as per Reserve Bank of India’s norms.&nbsp; Under the guidance of the Prevention of Money Laundering Act, 2002 (PMLA), the RBI mandates that all banks and financial institutions implement KYC procedures.&nbsp; KYC starts with verifying Proof of Identity (POI) and the Proof of Address (POA) and by which banks, insurance companies, and other organizations obtain information and better understand their customers. It is applicable for both new and existing customers and is the first step in account creation or even to allow a transaction.&nbsp;<h2 class="heading-node" id="9083">Why is KYC mandatory?</h2>As per the Reserve Bank of India’s mandatory regulation, KYC came into legal effect in 2002. The RBI mandates that all financial and legal institutions should assess their customers.&nbsp; KYC’s objective is to help banks and other financial institutions to assess and validate their customers. An effective KYC alleviates and combats all illicit activities. A financial institution can identify potential threats, criminal, and other illegal activities while verifying the KYC required documents. In a nutshell, a financial institution or a business/corporate uses KYC for,&nbsp;<ul class="list-node" id="32oq3a921"><li>Building and Verifying a Customer’s Identity&nbsp;</li><li>Understanding Customer’s Activities&nbsp;</li><li>Evaluating the risks involved with the Customer’s Activities</li></ul><h2 class="heading-node" id="2ff5">How does KYC work?</h2>The KYC process is carried out seamlessly with the following simple steps:&nbsp;<ul class="list-node" id="pce88galo"><li>First, the applicant’s PAN/ AADHAR details are collected and validated.&nbsp;</li><li>The applicant further supports the information provided by entering the required details on the website.&nbsp;</li><li>The applicant’s document goes through various checks and authentication processes by the financial entity.&nbsp;</li><li>Once the documents are verified, and once named eligible, then the applicants are onboarded.&nbsp;&nbsp;</li></ul><h2 class="heading-node" id="23fe">Evolution of KYC</h2>Back in 2002, the Reserve Bank of India (RBI) made KYC a legal and mandatory procedure for all financial institutions, preventing misuse of the sensitive information held by banks and restricting money laundering activities. Evolving from a Paper-based physical attestation method to video adoption, KYC has come a long way. The paper-based KYC demands more physical input because of various document requirements. In contrast, the e-KYC makes the verification procedure less complicated by reducing the physical work of businesses and clients where the data is stored and verified entirely online.&nbsp;&nbsp; The e-KYC or paperless KYC verification procedure became more preferred by customers once the internet boomed. Now doing e-KYC is made even more accessible as the Government of India has launched Digi Locker under its Digital India initiative. It is a digital document wallet that helps its users to store authentic documents virtually and is highly secured by Aadhaar/OTP authentication.<h2 class="heading-node" id="5fbe">Types of KYC</h2><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Wordpress-03.webp" alt="M2P Fintech" title="" width="100%" height="284"><h3 class="heading-node" id="ympukq7zn">1. Aadhaar-based KYC</h3>Aadhaar-based KYC verification follows the regulations of The Unique Identification Authority of India (UIDAI) and verifies proof of identity and residence through one’s Aadhaar number. In addition, the UIDAI provides information to service providers to activate customer services such as bank accounts, mobile connections, etc.&nbsp; Every Aadhaar cardholder can quickly and easily complete their KYC process. Aadhaar based KYC is an efficient, paperless process that adheres with government standards.&nbsp; The Aadhaar based KYC authenticates data in two different ways:&nbsp; OTP-based  - The financial institution verifies the customers’ identity by triggering an OTP to their Aadhaar linked mobile number.&nbsp;&nbsp; Biometric-based  - For Identification and Verification, the financial institution uses the biometrics of the customer by using UIDAI (Unique Identification Authority of India) approved scanners.<h3 class="heading-node" id="ebxjgryx3">2. In-Person Verification (IPV) KYC</h3>The In-person KYC procedure was used by the Security and Exchange Board of India (SEBI) for mutual fund investors. Unlike the other prevalent methods, in-person verification requires the individual to undergo the process offline in an institution, KYC kiosk, or at an AMC. IPV has now upgraded their process via OTP mechanism.<h3 class="heading-node" id="31fd">3. Digital KYC</h3>It is a paperless process where a live photo of the client and their Aadhaar is verified and processed online. It also involves submitting the Official Valid Documents (OVD’s) such as Aadhaar, Pan Card, Passport or a Driver’s license.&nbsp; The digital KYC techniques have many advantages such as,&nbsp;<ul class="list-node" id="pewatsdgk"><li>The customer’s identity verification happens in real-time,&nbsp;</li><li>The process is flexible because the customer can use any of the OVDs,&nbsp;</li><li>The process is highly secure and efficient due to privacy laws and the usage of AI technology.&nbsp;</li></ul><h3 class="heading-node" id="0da4">4. Video KYC</h3>RBI allowed the usage of Video KYC in 2020 due to the pandemic constraints. Video KYC is a procedure that verifies details of the client in a video-based process. This process involves an auditor and an agent for authentication and audit. Before establishing an account-based relationship, the agent collects the details using video-audio features and AI technology. The process is smoothened by usage of a number placard that helps authenticating the customer.&nbsp;&nbsp; Video KYC is available as:&nbsp;<ul class="list-node" id="dd9lh3yyz"><li>VCIP - Video-based Customer Identification Process&nbsp;</li><li>VIPV - Video-based In-Person Verification&nbsp;</li><li>VBIP - Video-based Identification Process&nbsp;</li></ul>&nbsp;It employs a trained individual’s audio-video interaction and automated verification methods such as geo-tagging and facial matching.&nbsp;<h3 class="heading-node" id="4d8e">5.&nbsp;Central KYC (CKYC)</h3>CKYC is a customer or financial institution submitting a Central KYC form and proof of identity and proof of address that relies on the central repository of customer records for CERSAI (Central Registry of Securitization Asset Reconstruction and Security Interest of India). The process detects any duplicate accounts and mitigates other risks.&nbsp; The C-KYC identifier is a 14-digit unique identifier assigned to a client when they upload their details for KYC. When a client opens an account without C-KYC, it may require them to repeat the whole process. But this 14-digit identifier removes that need, and the customer can use this number to update their information throughout all their accounts uniformly.<h3 class="heading-node" id="4feb">6. In-app KYC&nbsp;</h3>This KYC process brings out easy and hassle-free experiences to the customers. All the verification process happens with the help of a smartphone, where the clients can conveniently carry out bank transactions, open bank accounts, and other banking operations.&nbsp; The clients need to use their smartphones to verify their IDs or passport and begin the KYC process. The KYC also involves real-time scanning of IDs to prevent identity forgeries. It is highly secure due to the deployment of secure technologies.<h3 class="heading-node" id="a37c">7. Offline KYC</h3>Offline KYC requires the submission of all the necessary physical documents for verification. It requires filling in all the required details like Aadhaar and PAN. After this, the client must visit a nearby KRA to complete the process and receive an official application number to identify and continue the verification process. Or an agent is sent to the customer’s place to collect documents for KYC verification.<h2 class="heading-node" id="649c">So, what is KRA?</h2>KRAs are KYC Registration Agencies that maintain the SEBI (Security and Exchange Board of India) registered companies records under the KYC regulations Act, 2011. To bring uniformity and avoid duplicate KYC processes, this KRAs help regulate the KYC process that allows a company to authenticate its clients and offer better customer service.&nbsp; Five different agencies that work as KRAs in India are:&nbsp;&nbsp;<ul class="list-node" id="83rt2nv4f"><li>CVL KRA&nbsp;</li><li>CAMS KRA (Computer Age Management Services Pvt Ltd.)&nbsp;</li><li>NSDL KRA (National Securities Depository Ltd)&nbsp;</li><li>Karvy KRA (Karvy Data Management Services)&nbsp;</li><li>NSE KRA (National Stock Exchange)&nbsp;</li></ul>To conclude, KYC has evolved over the years from physical forms to real-time AI technology verification methods. KYC satisfies and provides a hassle-free experience to the customers and helps financial service providers establish a smooth relationship. If you wish to implement a robust KYC system, check out our blog on <a class="link" href="https://m2pfintech.com/blog/crack-the-kyc-jigsaw-ease-onboarding-compliance/">How to Crack the KYC Implementation.</a><a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox. Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Product

About

Compliance

Resources