CEC Payment Processing & Security 5 — Questions and Answers
Question 1: Which of the following is a key advantage of using a hosted payment page versus an embedded payment form?
- Hosted pages provide more design flexibility for the merchant
- The payment processor handles PCI scope, reducing merchant compliance burden (Correct answer)
- Embedded forms convert better because customers stay on-site
- Hosted pages eliminate the need for an SSL certificate on the merchant site
Correct answer: The payment processor handles PCI scope, reducing merchant compliance burden
With a hosted payment page, card data never touches the merchant's servers, dramatically reducing PCI DSS scope and compliance requirements.
Question 2: What is the purpose of a 'reserve account' that acquiring banks may require from high-risk merchants?
- To fund marketing campaigns for new payment methods
- To cover potential chargebacks, refunds, or liabilities if the merchant fails (Correct answer)
- To earn interest income that offsets lower processing rates
- To pre-fund next-day settlement for faster merchant access to funds
Correct answer: To cover potential chargebacks, refunds, or liabilities if the merchant fails
Acquiring banks hold reserve funds as a buffer against merchant insolvency or excessive chargebacks to protect themselves from financial loss.
Question 3: An ecommerce site experiences a spike in orders with mismatched AVS results. What is the most appropriate response?
- Automatically fulfill all orders to avoid revenue loss
- Flag these orders for manual review or apply stricter fraud rules (Correct answer)
- Disable AVS checking to prevent false positives
- Refund all transactions immediately until the issue is investigated
Correct answer: Flag these orders for manual review or apply stricter fraud rules
AVS mismatches are a strong fraud signal; flagging or reviewing these orders balances fraud prevention against unnecessary order cancellations.
Question 4: Which of the following describes a 'zero-liability policy' in payment card security?
- Merchants are not liable for any chargebacks if they use 3D Secure
- Cardholders are not responsible for unauthorized transactions reported promptly (Correct answer)
- Payment processors absorb all fraud losses above a defined threshold
- Issuers cannot charge merchants interchange on disputed transactions
Correct answer: Cardholders are not responsible for unauthorized transactions reported promptly
Card network zero-liability policies protect cardholders from financial loss due to unauthorized use of their card, provided they report the fraud promptly.
Question 5: What does 'settlement lag' refer to in ecommerce payment processing?
- The delay between a chargeback filing and its resolution
- The time between transaction authorization and funds deposited in the merchant account (Correct answer)
- The gap between checkout page load and payment gateway response
- The period during which a refund is pending in the cardholder's account
Correct answer: The time between transaction authorization and funds deposited in the merchant account
Settlement lag is the delay—typically 1–3 business days—between when a transaction is authorized and when the merchant actually receives the funds.
Question 6: Which regulation requires US financial institutions and payment processors to implement Customer Identification Programs (CIP)?
- PCI DSS v4.0
- The Bank Secrecy Act / USA PATRIOT Act (Correct answer)
- Gramm-Leach-Bliley Act (GLBA)
- The Electronic Fund Transfer Act (EFTA)
Correct answer: The Bank Secrecy Act / USA PATRIOT Act
The Bank Secrecy Act, as amended by the USA PATRIOT Act, requires CIP procedures to verify customer identities and prevent money laundering.
Question 7: A merchant integrates Apple Pay into their ecommerce checkout. Which statement best describes the security model used?
- The merchant receives the customer's full card number encrypted with Apple's public key
- Apple Pay transmits a device-specific token rather than the actual card number (Correct answer)
- Transactions bypass the card network and settle directly between Apple and the merchant's bank
- Apple Pay stores the CVV2 on the device to enable faster repeat purchases
Correct answer: Apple Pay transmits a device-specific token rather than the actual card number
Apple Pay uses device account numbers (tokens) instead of the real PAN, so merchants never receive or store the customer's actual card number.
CEC Payment Processing & Security 5
Which of the following is a key advantage of using a hosted payment page versus an embedded payment form?