CEC Payment Processing & Security 2 — Questions and Answers
Question 1: What does the term 'chargeback ratio' refer to in ecommerce payment processing?
- The percentage of transactions disputed by cardholders relative to total transactions (Correct answer)
- The fee charged by processors for each declined transaction
- The ratio of credit card to debit card transactions
- The percentage of payments processed through international gateways
Correct answer: The percentage of transactions disputed by cardholders relative to total transactions
Chargeback ratio is the number of chargebacks divided by total transactions, and card networks penalize merchants who exceed thresholds (typically 1%).
Question 2: Which tokenization method replaces a customer's stored payment card data with a non-sensitive placeholder?
- Format-preserving encryption
- Network tokenization (Correct answer)
- Hashing with salt
- SSL/TLS wrapping
Correct answer: Network tokenization
Network tokenization, offered by card networks like Visa and Mastercard, replaces the PAN with a network-issued token that is tied to a specific merchant or device.
Question 3: An ecommerce merchant processes $500,000/month in card-not-present transactions. Which PCI DSS merchant level applies?
- Level 1
- Level 2 (Correct answer)
- Level 3
- Level 4
Correct answer: Level 2
PCI DSS Level 2 applies to merchants processing 1 million to 6 million card-not-present transactions annually, which equates to roughly $83K–$500K+ per month in volume context.
Question 4: What is the primary purpose of a payment facilitator (PayFac) model in ecommerce?
- To provide merchants with direct acquiring bank relationships
- To allow sub-merchants to accept payments under a master merchant account (Correct answer)
- To encrypt card data at the point of entry
- To manage chargeback disputes on behalf of cardholders
Correct answer: To allow sub-merchants to accept payments under a master merchant account
A PayFac sponsors sub-merchants under its own master merchant account, enabling faster onboarding without each business needing its own acquiring bank relationship.
Question 5: Which fraud prevention technique uses behavioral data like typing speed and mouse movement to verify identity?
- Address Verification Service (AVS)
- Behavioral biometrics (Correct answer)
- 3D Secure authentication
- Card Security Code (CVV) validation
Correct answer: Behavioral biometrics
Behavioral biometrics analyzes how users interact with devices—typing cadence, mouse patterns—to passively verify identity without friction.
Question 6: What does 'interchange-plus' pricing mean for a merchant accepting credit cards?
- A flat rate per transaction regardless of card type
- The actual interchange cost plus a fixed processor markup (Correct answer)
- A tiered pricing structure based on monthly volume
- A discounted rate for high-volume merchants only
Correct answer: The actual interchange cost plus a fixed processor markup
Interchange-plus (cost-plus) pricing passes the exact interchange fee set by card networks to the merchant plus a fixed processor markup, offering full transparency.
Question 7: In the context of ecommerce security, what is a 'man-in-the-browser' attack?
- A phishing attack targeting browser bookmark data
- Malware that intercepts and modifies browser transactions in real time (Correct answer)
- A DNS hijacking technique redirecting users to fake payment pages
- A brute-force attack on browser-stored passwords
Correct answer: Malware that intercepts and modifies browser transactions in real time
Man-in-the-browser (MitB) attacks use trojans embedded in the browser to intercept and alter transactions after the user has authenticated, bypassing standard SSL protections.
CEC Payment Processing & Security 2
What does the term 'chargeback ratio' refer to in ecommerce payment processing?