CEC Payment Processing & Security 3 — Questions and Answers
Question 1: Which EMV technology feature is most effective at preventing counterfeit card fraud at card-present terminals?
- Magnetic stripe encoding
- Dynamic cryptogram generated per transaction (Correct answer)
- Static CVV2 code printed on the card
- Card PIN verification
Correct answer: Dynamic cryptogram generated per transaction
EMV chips generate a unique cryptogram for each transaction, making it virtually impossible to create a usable counterfeit card even if the data is captured.
Question 2: What is the role of an acquirer (acquiring bank) in the payment processing chain?
- Issues credit cards to consumers and sets credit limits
- Processes transactions on behalf of merchants and settles funds (Correct answer)
- Operates the card network rails between issuer and merchant
- Provides fraud scoring services to online retailers
Correct answer: Processes transactions on behalf of merchants and settles funds
The acquiring bank maintains the merchant's account, processes transactions through card networks, and deposits settlement funds into the merchant's account.
Question 3: A customer's card is declined with response code 'Do Not Honor.' What should an ecommerce merchant do?
- Retry the transaction immediately up to three times
- Prompt the customer to use an alternative payment method (Correct answer)
- Manually override the decline and process the order
- Contact the issuing bank to reverse the decline
Correct answer: Prompt the customer to use an alternative payment method
A 'Do Not Honor' decline is a soft decline from the issuing bank; the merchant should prompt the customer to contact their bank or use a different card.
Question 4: Which of the following best describes 'strong customer authentication' (SCA) under PSD2 regulations?
- Single-factor authentication using a static password
- Verification using at least two of: something you know, have, or are (Correct answer)
- A merchant's internal fraud score threshold above 90%
- Annual PCI DSS compliance certification for European merchants
Correct answer: Verification using at least two of: something you know, have, or are
SCA under PSD2 requires at least two independent authentication factors from the categories of knowledge, possession, and inherence to verify the customer's identity.
Question 5: What is 'velocity checking' in the context of ecommerce fraud prevention?
- Measuring how quickly a payment gateway processes transactions
- Monitoring the frequency of transactions from a single source within a time window (Correct answer)
- Calculating the speed of page load for the checkout process
- Assessing how fast chargebacks are submitted after a transaction
Correct answer: Monitoring the frequency of transactions from a single source within a time window
Velocity checking flags suspicious patterns by counting how many transactions originate from the same card, IP, device, or email within a defined timeframe.
Question 6: An ecommerce site stores encrypted cardholder data in its database. Under PCI DSS, what additional requirement applies?
- The site qualifies for Self-Assessment Questionnaire A
- The encryption keys must be managed separately from the encrypted data (Correct answer)
- Storage is permitted only if the site uses a CDN
- Only the last four digits need to be encrypted
Correct answer: The encryption keys must be managed separately from the encrypted data
PCI DSS requires that encryption keys be stored and managed separately from the data they encrypt to prevent a single point of compromise.
Question 7: What distinguishes a 'soft decline' from a 'hard decline' in payment processing?
- Soft declines are permanent rejections; hard declines are temporary
- Soft declines are temporary and retriable; hard declines are permanent rejections (Correct answer)
- Soft declines apply only to debit cards; hard declines apply to credit cards
- Soft declines occur at the gateway; hard declines occur at the network level
Correct answer: Soft declines are temporary and retriable; hard declines are permanent rejections
Soft declines are temporary rejections (e.g., insufficient funds, authentication needed) that may succeed on retry, while hard declines (e.g., stolen card) are permanent.
CEC Payment Processing & Security 3
Which EMV technology feature is most effective at preventing counterfeit card fraud at card-present terminals?