CEC Payment Processing & Security 4 — Questions and Answers
Question 1: Which payment method type typically has the lowest dispute rate in ecommerce transactions?
- Credit cards with rewards programs
- ACH bank transfers (Correct answer)
- Prepaid debit cards
- Buy Now Pay Later (BNPL) instruments
Correct answer: ACH bank transfers
ACH transfers have very low dispute rates because they are bank-to-bank transactions with strict identity verification and limited chargeback rights compared to credit cards.
Question 2: What is the function of the Card Verification Value 2 (CVV2) in card-not-present transactions?
- It encrypts the transaction data between the merchant and the processor
- It proves the customer physically has the card since it is not stored in the magnetic stripe (Correct answer)
- It verifies that the cardholder's billing address matches the bank's records
- It authorizes the transaction amount against the available credit limit
Correct answer: It proves the customer physically has the card since it is not stored in the magnetic stripe
CVV2 is not stored on the magnetic stripe or chip, so requiring it in CNP transactions helps confirm the customer has the physical card.
Question 3: A merchant enables '3D Secure 2.0' for their checkout. Which outcome is most likely for low-risk transactions?
- All transactions will require a one-time password (OTP) challenge
- Low-risk transactions will be frictionlessly authenticated using shared data (Correct answer)
- The issuer will automatically decline borderline transactions
- 3DS 2.0 adds a mandatory redirect to the card network's authentication page
Correct answer: Low-risk transactions will be frictionlessly authenticated using shared data
3DS 2.0 supports frictionless flow, where rich contextual data is shared with the issuer to authenticate low-risk transactions without presenting a challenge to the user.
Question 4: What is 'friendly fraud' in the context of ecommerce chargebacks?
- A chargeback filed by a cardholder who legitimately received the goods but claims otherwise (Correct answer)
- Fraudulent orders placed by a merchant's own employees
- A phishing email that mimics a friendly brand to steal payment data
- Discount abuse where a customer exploits promo codes multiple times
Correct answer: A chargeback filed by a cardholder who legitimately received the goods but claims otherwise
Friendly fraud occurs when a legitimate cardholder deliberately disputes a valid charge—claiming non-receipt or unauthorized use—to obtain a refund while keeping the merchandise.
Question 5: Which PCI DSS requirement specifically governs the use of firewalls to protect cardholder data?
- Requirement 2: Do not use vendor-supplied defaults
- Requirement 1: Install and maintain network security controls (Correct answer)
- Requirement 6: Develop and maintain secure systems
- Requirement 10: Log and monitor all access to network resources
Correct answer: Requirement 1: Install and maintain network security controls
PCI DSS Requirement 1 mandates installing and maintaining network security controls, including firewalls, to protect the cardholder data environment.
Question 6: An ecommerce merchant wants to reduce processing fees for premium rewards cards. Which strategy is most effective?
- Switch to a flat-rate payment processor
- Collect additional Level 2 or Level 3 transaction data (Correct answer)
- Disable acceptance of Visa Signature and World Elite cards
- Negotiate a fixed monthly fee instead of per-transaction pricing
Correct answer: Collect additional Level 2 or Level 3 transaction data
Submitting Level 2 (tax amount, customer code) or Level 3 (line-item detail) data qualifies transactions for lower interchange rates, even on premium cards.
Question 7: What is the primary security risk of using a shared SSL certificate across multiple ecommerce domains?
- It reduces TLS handshake speed causing higher cart abandonment
- A compromise of one domain can expose all domains sharing the certificate (Correct answer)
- Shared certificates are not accepted by PCI DSS compliant processors
- It prevents the implementation of HTTP Strict Transport Security (HSTS)
Correct answer: A compromise of one domain can expose all domains sharing the certificate
A wildcard or shared SSL certificate means that if the private key is compromised on one domain, all domains using that certificate are exposed.
CEC Payment Processing & Security 4
Which payment method type typically has the lowest dispute rate in ecommerce transactions?