E-Commerce Development Payment Processing 4 — Questions and Answers
Question 1: Which 3DS2 (3D Secure 2) feature reduces checkout friction compared to 3DS1?
- It eliminates the need for any customer authentication
- It uses risk-based authentication that may silently approve low-risk transactions (Correct answer)
- It requires a static password for every transaction
- It skips authentication for transactions under $10
Correct answer: It uses risk-based authentication that may silently approve low-risk transactions
3DS2 supports frictionless flow where the issuer can approve low-risk transactions based on data signals without redirecting the customer to enter a code.
Question 2: What does the term 'interchange fee' refer to in card payment processing?
- The fee charged by the payment gateway for API access
- The fee paid by the acquiring bank to the card-issuing bank per transaction (Correct answer)
- The currency conversion fee on international transactions
- The monthly fee charged by the merchant account provider
Correct answer: The fee paid by the acquiring bank to the card-issuing bank per transaction
Interchange is the fee that flows from the merchant's acquiring bank to the customer's issuing bank, making up the largest portion of processing costs.
Question 3: What is the correct approach to handling a failed webhook delivery from a payment processor?
- Log the failure and wait for the customer to retry checkout
- Implement exponential backoff retry logic and verify events using the processor's API (Correct answer)
- Send the customer an email requesting they repay
- Mark the order as failed immediately
Correct answer: Implement exponential backoff retry logic and verify events using the processor's API
Webhooks can fail due to temporary network issues, so implementing retries with exponential backoff and verifying event authenticity via the processor's API is best practice.
Question 4: Which payment flow should you use when collecting payment details upfront but charging the customer later (e.g., after service delivery)?
- Immediate capture on checkout
- Authorization-only with a delayed capture (Correct answer)
- Recurring subscription with a free trial
- Pre-order with a refund on cancellation
Correct answer: Authorization-only with a delayed capture
Authorization-only captures card holder funds availability now but delays the actual charge until the service is delivered, after which you manually capture.
Question 5: What is a 'retrieval request' in the context of chargeback management?
- A customer's request to retrieve their order history
- An issuing bank's request for transaction evidence before initiating a chargeback (Correct answer)
- A merchant's request to reverse a refund
- A network request for updated card BIN data
Correct answer: An issuing bank's request for transaction evidence before initiating a chargeback
A retrieval request is the issuer asking the merchant for documentation about a transaction, often a precursor to a formal chargeback if not responded to.
Question 6: Which security measure should be applied to webhook endpoint URLs to prevent spoofed payment notifications?
- Restrict access by IP whitelist only
- Verify the webhook signature using the processor's signing secret (Correct answer)
- Require OAuth 2.0 bearer token from the processor
- Use HTTPS with mutual TLS client certificates
Correct answer: Verify the webhook signature using the processor's signing secret
Payment processors like Stripe sign webhook payloads with a secret; verifying this signature ensures the notification genuinely came from the processor.
Question 7: When integrating PayPal Express Checkout, what does the 'EC token' returned after SetExpressCheckout represent?
- The final payment confirmation ID
- A temporary identifier for the checkout session before buyer approval (Correct answer)
- The merchant's API access token
- The customer's PayPal account ID
Correct answer: A temporary identifier for the checkout session before buyer approval
The EC token is a temporary session token that identifies the pending checkout; it is exchanged for the final transaction after the buyer approves payment on PayPal.
E-Commerce Development Payment Processing 4
Which 3DS2 (3D Secure 2) feature reduces checkout friction compared to 3DS1?