E-Commerce Development Payment Processing 3 — Questions and Answers
Question 1: What does PCI DSS SAQ A eligibility require for an e-commerce merchant?
- The merchant must process fewer than 1,000 transactions per year
- All payment processing is fully outsourced and no card data touches merchant systems (Correct answer)
- The merchant uses only debit cards, not credit cards
- The merchant must use a dedicated payment server
Correct answer: All payment processing is fully outsourced and no card data touches merchant systems
SAQ A applies when the merchant outsources all cardholder data functions and uses an iframe or redirect so card data never touches the merchant's environment.
Question 2: Which payment method type is classified as a 'pull' payment?
- Wire transfer initiated by the payer
- ACH debit authorized by the account holder (Correct answer)
- Cash on delivery
- Bitcoin payment from a wallet
Correct answer: ACH debit authorized by the account holder
ACH debit is a pull payment where the merchant pulls funds from the customer's account using a pre-authorized mandate.
Question 3: What is the typical window for a customer to file a chargeback with their card issuer?
- 7 days
- 30 days
- 60–120 days (Correct answer)
- 1 year
Correct answer: 60–120 days
Most card networks allow customers 60 to 120 days from the transaction or statement date to dispute a charge and initiate a chargeback.
Question 4: Which Stripe webhook event should trigger order fulfillment in an e-commerce application?
- payment_intent.created
- checkout.session.completed (Correct answer)
- charge.captured
- customer.created
Correct answer: checkout.session.completed
The checkout.session.completed event confirms the entire checkout flow finished successfully, making it the correct trigger for fulfillment.
Question 5: What is the difference between authorization and capture in card payment processing?
- Authorization charges the card immediately; capture sends a receipt
- Authorization reserves funds on the card; capture actually moves the money (Correct answer)
- Authorization validates the CVV; capture validates the billing address
- Authorization is done by the merchant; capture is done by the customer
Correct answer: Authorization reserves funds on the card; capture actually moves the money
Authorization places a hold on the cardholder's funds, while capture is the subsequent step that actually transfers those funds to the merchant.
Question 6: When implementing Buy Now Pay Later (BNPL) via a third-party provider like Affirm, who bears the credit risk?
- The merchant
- The customer's bank
- The BNPL provider (Correct answer)
- The card network
Correct answer: The BNPL provider
BNPL providers like Affirm pay the merchant upfront in full and assume the credit risk of collecting installment payments from the consumer.
Question 7: What is the purpose of a payment processor's 'reserve' account?
- To hold funds for future refunds or chargebacks as risk mitigation (Correct answer)
- To store merchant's operating capital between payouts
- To earn interest on merchant deposits
- To collect processing fees before disbursement
Correct answer: To hold funds for future refunds or chargebacks as risk mitigation
A reserve account holds a percentage of merchant funds as a buffer against potential chargebacks, refunds, or fraud losses.
E-Commerce Development Payment Processing 3
What does PCI DSS SAQ A eligibility require for an e-commerce merchant?