Online Payment Challenges and How to Handle Them in 2024

According to Statista, the total value of digital transactions is expected to have an annual growth rate of 11.80%, resulting in a projected total of US$14.78 trillion by 2027.

As online transactions continue to grow, there has been a corresponding increase in fraudulent activity. Experts estimate that global losses resulting from cybercrime have exceeded $6 trillion in 2022. According to Cybersecurity Ventures, the global annual cost of cybercrime is predicted to reach $9.5 trillion USD in 2024. 

Ihor Demkovych, Head of Engineering at Geniusee, will talk about the main issues with online payments and how to deal with them.

How do online payments work?

Online payments have a  variety of different forms, including bank cards, internet banking, payment terminals, SMS, and more. These payments are facilitated by operators, such as banks or payment terminals, which in turn use  payment systems like Visa, MasterCard, PayPal, and others. 

Here’s how these systems typically work:

1. The payer deposits funds into their account, creating a balance from which payments can be made
2. Using the interface provided by the operator, the payer specifies the amount to be transferred to the recipient
3. This information is used to generate a payment order, which instructs the payment system to carry out a non-cash transfer of funds

The main challenge with electronic payments lies in ensuring that the payment order is genuinely initiated by the payer and not by someone impersonating them.

As you know, different types of digital payments have their own unique characteristics. When using a bank card, the payer transfers funds from their personal bank account. The card acts as the “key” to access the bank account, and it can be used for payment in two ways: either through a specialized terminal (such as an ATM or store cash register) or through a website. 

When making a payment through a terminal, the payer verifies their own identity by using the card itself and entering their PIN code, which is known only to them. When making a payment through a website, confirmation of payment is based on the information printed on the card (such as the card number, name of the cardholder, expiration date, and the CVC/CVV code). The payer must input this information into the appropriate fields on the online form. In this scenario, the CVC/CVV code acts as a password that should only be known by the payer themselves.

Remote Banking Systems

Remote Banking Systems (RBS), or “internet banking,” is an alternative to debit or credit cards. Typically, RBS involves accessing a website that provides direct access to your bank account, allowing you to carry out various transactions, including non-cash payments. To access your account, you must enter your username and password. Unlike mobile payments made with a bank card, the RBS system offers multiple levels of security, such as confirming transactions with one-time passwords sent via SMS or electronic signatures.

With RBS, clients have access to various payment options:

1. One-time payments: Clients can make individual payments as needed
2. Template payments: Clients can fill out a template form once, providing recipient details, and subsequently only need to indicate the payment amount for future transactions
3. Automatic payments: These are recurring template payments that are automatically processed at a specified frequency (i.e monthly)

RBS also offers clients additional banking options based on the services and agreements between the client and the bank. The availability of these options may vary depending on the specific bank and services provided.

Electronic wallet

Another method of online payment is through an e-wallet, which involves the transfer of virtual money that represents real currency. Electronic wallets, like bank cards, are also used for online purchases of goods and services. Users can top up their electronic wallets in different ways, such as using a bank card, a prepaid card specifically designed for this purpose, or a payment terminal.

The primary distinction between e-wallets and a bank account lies in the fact that e-wallets are typically not operated by banks. This eliminates certain restrictions imposed by banking regulations, but it also means that e-wallet users do not have the same guarantees provided to bank customers.

The Top 5 problems with online payments

1. Personal data security

Many companies fail to comply with regulations regarding the storage of sensitive employee and customer data, leading to frequent data leaks. This is particularly problematic for small online stores and services that lack the necessary security measures for personal information.

To protect personal information within an organization, it is crucial to implement data leakage control (DLP) systems, along with event monitoring and incident detection tools. Companies have the option to either adopt an internal system or outsource to specialized providers.

2. Online store cyberattacks

Since the onset of the pandemic, numerous e-commerce platforms have encountered DDoS attacks and security breaches. To safeguard against DDoS attacks, there are specialized services provided by prominent hosting companies. These include regular digital security assessments, which are a recommended practice to thwart cyberattacks effectively. This proactive approach aids in identifying and rectifying vulnerabilities present in critical systems and overall infrastructure.

3. 3-D Secure payment confirmation page

One emerging trend is the implementation of social engineering techniques in conjunction with 3-D Secure technology. 3-D Secure payment confirmation pages have been regarded as the most effective security measure for safeguarding bank card information. The 3-D Secure protocol employs a two-factor authentication system to verify user identity during online transactions. 

However, fraudsters have become adept at creating counterfeit payment verification pages. Initially, the user is directed to a fraudulent online store and subsequently redirected to a fake payment confirmation page. On these malicious websites, users are prompted to enter their card details, including the code received via SMS for payment confirmation. Simultaneously, the attackers’ server initiates communication with an authentic 3-D Secure server, making the transaction appear as though the user initiated a transfer of funds from one card to another. Identifying these fake pages can be challenging, as they often feature the logos of well-known payment systems such as Visa and Mastercard, giving an illusion of authenticity.

It is therefore important for companies to check their partners, and to remind their clients to thoroughly research and evaluate the reputation of online stores and read reviews from other customers. Experts predict that, in the future, the implementation of 3DS 2.0 technology will serve as an additional layer of protection against fraudulent activities.

4. The “twins” of banking sites

Another threat is copycats, or “twin” sites.

These fake sites are designed to look and sound just like the real ones, making it difficult for users to tell them apart. When unsuspecting individuals visit these twin sites and enter their username and password, scammers gain access to their personal accounts on an actual bank website. To make matters worse, the scammers also link the victim’s mobile banking service to their own phone number.

To avoid falling victim to these scams, it is strongly advised to not access a bank’s website through third-party internet resources. Additionally, clients should remember that, before entering login credentials on any online banking site, it is essential to double-check the page address and ensure that it matches the one provided on their bank card. 

5. Commission requirements

In several instances, scammers send letters to victims posing as regulators, claiming that they have accounts with substantial funds held in foreign credit institutions which require payment of a commission.

If an individual receives an email regarding the receipt of a significant sum of money from an unfamiliar organization and is instructed to pay a commission, tax, or insurance in order to obtain it, we strongly advise against responding to such messages—and under no circumstances should money be transferred.

The safest methods of making online payments

Paypal

Paypal is a widely used electronic payment system in Europe and the US. Its unique feature is that it necessitates linking an international bank card, which allows you to add funds to your account.

Using Paypal is akin to having a passport for conducting international financial transactions. It is crucial to enter all the information accurately and attentively. Even the slightest discrepancy can result in inquiries from the security department and the temporary suspension of your account.

Visa & MasterCard

Visa and MasterCard payment cards are widely recognized and convenient payment methods for both domestic and international online shopping.

For online purchases, it’s recommended to have a separate virtual card like a Visa Virtual or MasterCard Virtual. These are connected to your primary bank card and provide additional security measures for online payments. 

Electronic wallets

Numerous major online retailers and services now accept payments through electronic wallets. These wallets are designed specifically for online transactions, allowing you to load the necessary funds just before making a purchase. This method of payment is much safer compared to using a payroll or credit card with a high credit limit.

When using an electronic wallet, there is no need to provide your card number, expiration date, or secret code. This ensures that, even if you accidentally land on a phishing website, scammers will not be able to gain access to your bank account.

Additionally, you may have the option to link a bank card to your electronic wallet. However, it’s important to note that this does not compromise your privacy. When making payments, the card details are not utilized and they remain confidential information—known only to you and not disclosed to the seller.

Crypto wallets

As opposed to traditional ones, money is not physically stored in a digital wallet. A cryptocurrency wallet holds a private key that controls virtual funds and tokens used for transactions. The security of user funds primarily relies on the reliability of the underlying code. This is why developers strive to incorporate security along with user-friendly features, privacy, and other commonly desired functionalities into these wallets.

How to protect your business from scammers

There are various indicators that can be used to determine if credit and debit cards, as well as electronic wallets, are unreliable. These indicators include: 

• A high number of payees and payers, exceeding 10 per day and 50 per month
• Abnormally high transaction volumes involving the crediting or debiting of non-cash funds by individuals, especially when there are more than 30 fraudulent transactions per day
• Transaction amounts surpassing $5,000 per day and $50,000 per month
• When the balance at the end of the trading day is less than 10% of the average daily volume of transactions 

It’s important to remind your clients to safeguard their mobile phones, as one-time transaction confirmation codes are sent to them. 

It is also advisable to disable any payment options that are not necessary. For instance, if there is no need to use payment applications for social networks or cell phones, it is recommended to deactivate their functionality.

The evolving tactics employed by fraudsters have prompted financial institutions to strengthen their security systems. For instance, major banks utilize advanced anti-fraud platforms that leverage artificial intelligence algorithms. Below are four key best practices for ensuring online payment security: 

1. Two-Factor Authentication

Two-factor authentication is a technique used to verify the identity of a user accessing an online service. It involves requesting two different forms of authentication data, providing an additional layer of security against unauthorized access to an account. This usually involves entering a login and password as the first step, followed by inputting a unique code received via SMS or email as the second step. This dual authentication process significantly enhances the protection of user accounts.

2. Tokenize customer card data

Tokenization is a form of encryption that is utilized in online transactions to safeguard bank card information. When making a purchase, one can input their card number, expiration date, and CVV in a designated field. At this stage, the user’s card information is relayed to a third-party resource capable of storing it. However, inadequate protection of this data poses a risk—which is where Tokenization comes into play, replacing a sensitive data element with a non-sensitive substitute, known as a token. Therefore, tokenization protects sensitive information while still allowing it to be analyzed and processed.

Get an SSL Certificate

SSL, or Secure Sockets Layer, is a widely used security technology that establishes a secure and encrypted connection between a web server and web browser. Its primary purpose is to protect online transactions and safeguard sensitive information, including credit card details, user credentials, and personal data. To ensure your website is secured with SSL, you need to acquire an SSL certificate from a trusted Certificate Authority (CA) and install it on your server. An SSL-secured website can be identified by the “https” prefix instead of the usual “http”.

3. Use a Personal Verification System

Digital identity verification methods, such as biometric verification, facial recognition, and digital ID, offer valuable assistance to companies, governments, and financial institutions in confirming a person’s online identity.

Digital identity verification plays a crucial role in the account opening process and in attracting clients.Once they have verified the applicant’s identity, financial institutions may proceed with conducting background checks to ensure that the individual is not involved in fraudulent activities, criminal behavior, or any other form of illicit behavior. 

Having a developer on your side is invaluable

A weak IT department poses a significant challenge for any modern business, particularly those operating online. It’s worth noting the struggles faced by companies that minimize the resources spent on their IT team. However, the ability to accept payments online requires both financial and technological considerations, and the need for skilled technical specialists arises even during the preparation stage for integrating online payment systems.

We must address the requirements set by international payment systems in order to gain access to the world of online payments. These requirements include implementing specific features, providing clear instructions for payment, delivery, and returns, and displaying a privacy policy and information about the seller on the website. 

Numerous businesses opt to create their own websites using website builders or pre-designed templates for content management systems. While these methods may be sufficient for basic website setup, integrating a payment gateway requires a deeper understanding of backend development. Making a mistake in this crucial process can have detrimental financial consequences.

When selecting a payment partner, it is essential to realistically assess your technical resources. If you do not have dedicated developers on your team, it is advisable to reconsider the idea of directly collaborating with banks. Without proper technical support, resolving issues that arise on a daily basis can become a lengthy and challenging process, ultimately working against the company’s best interests.