Unit 4: E-commerce Security and Payment Systems
This unit focuses on one of the most critical aspects of e-commerce: security. For online commerce to function, both customers and merchants must be confident that their data and their money are safe.
We will explore the e-commerce security environment, identifying the major threats that businesses and consumers face. We will then examine the key technology solutions used to combat these threats, such as encryption, as well as the management policies that are necessary for a comprehensive security strategy. Finally, we will look at the different types of electronic payment systems that facilitate online transactions.
Learning Objectives
By the end of this chapter, you will be able to:
- Define the six dimensions of e-commerce security.
- Compare how customers and merchants view each dimension.
- Explain the tension between security and other values such as ease of use.
- Identify the points of vulnerability in an online transaction.
- Describe the e-commerce security environment and legal framework in Nepal.
E-commerce Security Environment
The e-commerce security environment is complex and rapidly changing. It is important for businesses to understand the various security threats and to implement a comprehensive security plan to protect themselves and their customers. There are six key dimensions to e-commerce security:
graph TB
SEC[E-commerce Security Environment]
SEC --> INT[Integrity]
SEC --> NR[Nonrepudiation]
SEC --> AUTH[Authenticity]
SEC --> CONF[Confidentiality]
SEC --> PRIV[Privacy]
SEC --> AVAIL[Availability]
Figure 1: Six dimensions of e-commerce security
1. Integrity
Integrity refers to the ability to ensure that information being displayed on a website or transmitted or received over the Internet has not been altered in any way by an unauthorized party.
2. Nonrepudiation
Nonrepudiation is the ability to ensure that e-commerce participants do not deny (i.e., repudiate) their online actions.
3. Authenticity
Authenticity is the ability to identify the identity of a person or entity with whom you are dealing on the Internet.
4. Confidentiality
Confidentiality is the ability to ensure that messages and data are available only to those who are authorized to view them.
5. Privacy
Privacy is the ability to control the use of information a customer provides about himself or herself to an e-commerce merchant.
6. Availability
Availability is the ability to ensure that a website, payment system, or service remains online and accessible when customers and staff need it. A site that goes down during checkout loses sales immediately; repeated outages also erode trust. Availability is protected through reliable hosting, backups, redundancy (failover servers), DDoS mitigation, and monitoring that alerts the team before users notice a problem.
Customer and Merchant Perspectives
The same dimension looks different depending on who you are.
| Dimension | Customer’s question | Merchant’s question |
|---|---|---|
| Integrity | Has the price or my order been changed in transit? | Has anyone altered our product pages or order records? |
| Nonrepudiation | Can the seller deny the offer or promise it made? | Can a customer deny placing an order they actually placed? |
| Authenticity | Is this really the shop’s website, or a fake copy? | Is this customer really who they say they are? |
| Confidentiality | Can anyone other than the seller read my messages and card details? | Can outsiders read our customer database or business data? |
| Privacy | Will my data be sold or used in ways I did not agree to? | How do we use customer data lawfully and keep it from misuse? |
| Availability | Can I reach the site and pay when I want to? | Is the site up, fast, and able to take orders at peak times? |
Security Versus Other Values
More security is not always better. Every control has a cost:
- Ease of use: Each extra step (one-time passwords, CAPTCHAs, re-entering a PIN) adds friction, and some customers abandon the purchase. Merchants must balance safety with a smooth checkout.
- Cost and speed: Strong encryption, monitoring, and audits cost money and can slow systems down. A small shop cannot afford what a bank spends.
- Public safety and privacy: Strong encryption protects honest users but can also hide criminal activity. Governments sometimes ask for access to data, which conflicts with customer privacy.
Good security design asks how much protection a transaction needs. Checking a product page needs very little; paying Rs. 50,000 needs strong authentication.
Points of Vulnerability in an Online Transaction
An online purchase passes through three main points, and each can be attacked:
flowchart LR
C[Customer device<br/>Browser or app] -->|Internet communication channel| M[Merchant web server]
M --> DB[(Customer and order database)]
M -->|Payment request| PG[Payment gateway or wallet]
PG --> B[Bank or card network]
Figure 2: Points of Vulnerability in an E-commerce Transaction
| Point | Typical threats | Typical protection |
|---|---|---|
| Client (customer) | Malware, phishing, stolen passwords, shared devices | Antivirus, awareness, two-factor authentication |
| Communication channel | Eavesdropping (sniffing), tampering, fake Wi-Fi hotspots | HTTPS/TLS encryption, certificates |
| Server and database | Hacking, SQL injection, insider misuse, DoS attacks, data breach | Patching, firewalls, access control, backups, DDoS protection |
The next chapter covers these threats in detail.
Worked Example: Securing a Small Online Store
A Kathmandu shop sells handmade bags through its own website and accepts wallet payments. The owner reviews each dimension:
| Dimension | Risk for this shop | Practical control |
|---|---|---|
| Integrity | An attacker changes a bank QR code on the payment page | Use the wallet’s hosted checkout; restrict admin access |
| Nonrepudiation | A customer claims they never ordered a cash-on-delivery bag | Send order confirmation by SMS or email; keep signed delivery records |
| Authenticity | A fake Facebook page copies the shop and takes payments | Verified page, official links on the website, warn customers |
| Confidentiality | Customer phone numbers and addresses leak | HTTPS on every page, strong admin passwords with two-factor login |
| Privacy | Staff use customer numbers for unrelated marketing | A written privacy policy and limits on who can export data |
| Availability | The site crashes during a Dashain sale | Reliable hosting, a content delivery network (CDN), daily backups |
None of these controls is expensive, but together they cover all six dimensions.
E-commerce Security Environment in Nepal
The e-commerce security environment in Nepal is still developing. While there have been significant improvements in recent years, there are still a number of challenges that businesses and consumers face.
Some of the specific security challenges in the Nepali e-commerce environment include:
- Prevalence of Cash on Delivery (COD): The high prevalence of COD in Nepal creates a number of security risks. For example, there is a risk of robbery of delivery personnel, and there is also a risk of customers refusing to pay for their orders.
- Lack of Awareness about Online Security: Many consumers in Nepal are not aware of the risks of online shopping. This makes them vulnerable to phishing scams and other forms of online fraud.
- A Developing Legal and Regulatory Framework: The Electronic Transactions Act, 2063 (2008) recognises electronic records and digital signatures and defines computer crimes. The Privacy Act, 2075 (2018) protects personal information, and Nepal Rastra Bank issues rules for payment service providers and wallets. The National Cyber Security Policy, 2080 (2023) sets national direction, and the Cyber Bureau of Nepal Police investigates online crime. Even so, enforcement, cross-border cases, and specific e-commerce consumer protection are still developing.
- Limited Use of Secure Payment Gateways: While the use of digital wallets is growing, many smaller businesses still take orders through social media messages and ask customers to send money to a personal account or QR code. There is no buyer protection and no record that links the payment to the order, which makes fraud easier on both sides.
Summary
E-commerce security has six dimensions: integrity, nonrepudiation, authenticity, confidentiality, privacy, and availability. Customers and merchants care about each dimension for different reasons. Security has to be balanced against ease of use, cost, and public safety, so the level of protection should match the value of the transaction. Attacks can target the customer’s device, the communication channel, or the merchant’s servers and databases. In Nepal, cash on delivery, low awareness, informal social media payments, and a still-developing enforcement framework shape the security environment, although laws such as the Electronic Transactions Act and the Privacy Act provide a base.
Key Takeaways
- The six dimensions of e-commerce security are integrity, nonrepudiation, authenticity, confidentiality, privacy, and availability.
- Customers and merchants ask different questions about the same dimension.
- More security adds friction and cost; protection should match the risk.
- The three points of vulnerability are the client, the communication channel, and the server.
- Nepal’s key laws include the Electronic Transactions Act, 2063 and the Privacy Act, 2075.
Discussion Questions
- Which of the six dimensions matters most to a customer paying by wallet in Nepal, and why?
- How can an online shop add security without making checkout so slow that customers leave?
- Why does cash on delivery create security risks of its own?
Exam-Style Questions
Short answer
- List the six dimensions of e-commerce security.
- Distinguish between confidentiality and privacy.
- What is nonrepudiation? Give an example.
- Name the three points of vulnerability in an e-commerce transaction.
Long answer
- Explain the six dimensions of e-commerce security from both the customer’s and the merchant’s perspective.
- “Security conflicts with other values.” Discuss this statement with examples.
- Describe the e-commerce security environment in Nepal, including its main challenges and legal framework.
