Unit 4.1
Unit 4 Intro: E-commerce Security and Payment Systems
Learning Objectives
By the end of this chapter, you will be able to:
- ✅ Define the six key dimensions of e-commerce security.
- ✅ Explain why security is a critical foundation for online commerce.
- ✅ Identify the unique security challenges within the Nepali e-commerce environment.
Why Security Matters ⚡
For e-commerce to function, a fundamental element must be present: Trust.
Both customers and merchants must be confident that their data and their money are safe.
In this unit, we will explore:
- Major Security Threats
- Key Technology Solutions (like Encryption)
- Essential Management Policies
- Electronic Payment Systems
🎬 Watch: What a Breach Costs a Retailer
Customer Trust
📊 Marketing Funnel Visualizer
Illustrative simulation; not measured Nepal benchmarks or guaranteed campaign results. These marketing activities are retained from the source; their placement needs Arjan’s review.
The E-commerce Security Environment
The security environment is complex and constantly evolving. To build a comprehensive security plan, we must understand its core dimensions.
The Six Key Dimensions of Security 📊
- Integrity
- Nonrepudiation
- Authenticity
- Confidentiality
- Privacy
- Availability
CIA: Three Objectives, Six Dimensions
Confidentiality
Only authorized people can read the data.
Example: protect customer addresses.
Integrity
Data remains accurate and is not changed without authorization.
Example: the payable amount matches the approved order.
Availability
Authorized users can use the service when needed.
Example: checkout works during a sale.
CIA is a useful foundation, not a replacement for our six dimensions. Authenticity, nonrepudiation and privacy add identity, evidence and appropriate data use.
A site displays the wrong price but stays online. Which CIA objective is affected most directly?
Integrity; being online does not prove the data is correct.
CIA Objectives
🔍 SEM Keyword Bidding Simulator
Illustrative simulation; not measured Nepal benchmarks or guaranteed campaign results. These marketing activities are retained from the source; their placement needs Arjan’s review.
Dimensions 1 & 2
1. Integrity
Ensuring information is not altered by an unauthorized party during transmission or on a website.
Example: Preventing a hacker from changing the price of an item from Rs. 1000 to Rs. 1 while it's in your shopping cart.
2. Nonrepudiation
The ability to ensure that participants cannot deny (repudiate) their online actions.
Example: A customer cannot deny placing an order, and a merchant cannot deny sending a shipment.
Order Evidence Trail
Nonrepudiation: Build an Evidence Trail
A buyer says “I never ordered that phone.” The seller says it was delivered. What evidence should each side retain?
Customer perspective
Order confirmation, amount, merchant identity and payment reference.
Merchant perspective
Authenticated order event, payment status, timestamps and delivery acknowledgement.
Protect the integrity of records and link them to an identity. A screenshot alone can be edited; a login alone does not prove who controlled the account.
Nonrepudiation supports resolving disputes; it does not eliminate fraud, mistakes or legal challenges.
Dimensions 3 & 4
3. Authenticity
The ability to identify the identity of a person or entity you are dealing with online.
Example: Knowing you are giving your credit card details to daraz.com.np and not a fake phishing site.
4. Confidentiality
Ensuring messages and data are available only to those authorized to view them.
Example: Your credit card number is encrypted so that a snooper on the network cannot read it.
Genuine or Lookalike?
Dimensions 5 & 6
5. Privacy
The ability to control the use of personal information provided to an e-commerce merchant.
Example: You have the right to know how a merchant uses your purchase history and personal data.
6. Availability
Ensuring an e-commerce site continues to function as intended and is accessible to legitimate users.
Example: The website is protected from Denial-of-Service (DoS) attacks and remains online during a big sale event.
🎬 Watch: Don't Tell vs Don't Look
Private Data, Confidential Database?
A shop encrypts its customer database and restricts staff access. It then uses delivery phone numbers for unrelated advertising without an appropriate basis.
Can confidentiality be strong while privacy is weak?
Yes. Confidentiality asks who can see the data. Privacy also asks why it was collected, how it is used, who receives it and how long it is kept.
- Customer: clear notice and appropriate control over personal-data use.
- Merchant: collect what is needed, limit purposes and retention, and secure access.
- Legal duties depend on jurisdiction; encryption is not a complete privacy programme.
🎯 Channel Comparison: Which Marketing Channel? (1/3)
Illustrative simulation; not measured Nepal benchmarks or guaranteed campaign results. These marketing activities are retained from the source; their placement needs Arjan’s review.
🎯 Channel Comparison: Which Marketing Channel? (2/3)
Illustrative simulation; not measured Nepal benchmarks or guaranteed campaign results. These marketing activities are retained from the source; their placement needs Arjan’s review.
🎯 Channel Comparison: Which Marketing Channel? (3/3)
Illustrative simulation; not measured Nepal benchmarks or guaranteed campaign results. These marketing activities are retained from the source; their placement needs Arjan’s review.
Practical Application: The Nepali Context 🇳🇵
The e-commerce security environment in Nepal is developing rapidly, but it faces several specific challenges.
Understanding these local challenges is crucial for building successful and secure e-commerce businesses in Nepal.
Key challenges include:
- High prevalence of Cash on Delivery (COD)
- Lack of public awareness about online security
- A still-developing legal and regulatory framework
- Limited use of secure payment gateways by smaller vendors
Challenge in Nepal: COD & Payment Security
High Reliance on Cash on Delivery (COD)
While popular, COD introduces physical security risks:
- Risk of robbery for delivery personnel.
- Risk of customers refusing payment upon delivery.
- Increases cash handling complexity and costs.
Insecure Payment Methods
Many smaller businesses bypass secure gateways:
- Payments via direct bank transfer or social media messages.
- No automated verification or fraud protection.
- Higher risk of payment disputes and scams for both parties.
QR Payments Across Asia
Follow the Payment Evidence
Illustrative order: Rs 2,000. The customer shows a “paid” screenshot, but the merchant has not received a verified payment status.
- The customer authorizes a payment through the intended provider.
- The merchant verifies the provider's status through its trusted integration and matches the order, amount and payment reference.
- The merchant records the result and reconciles settlement; duplicate notifications must not create duplicate orders.
Should the warehouse ship from the screenshot alone?
No. Verify independently. This protects authenticity and integrity; it does not guarantee the buyer can never dispute the transaction.
Verify the Payment
✉️ Email Subject Line A/B Tester
Illustrative simulation; not measured Nepal benchmarks or guaranteed campaign results. These marketing activities are retained from the source; their placement needs Arjan’s review.
Challenge in Nepal: Awareness & Regulation
🔍 Lack of Awareness
Many consumers are not fully aware of online risks, making them vulnerable to:
- Phishing scams (fake login pages)
- Fraudulent sellers
- Identity theft
⚖️ Developing Legal Framework
The legal framework for e-commerce is still maturing. This can lead to:
- Difficulty in prosecuting cybercriminals.
- Unclear processes for consumer rights protection.
- Ambiguity in handling cross-border transaction disputes.
Security Conflicts with Other Values
A shop proposes a selfie and a fresh identity-document upload for every purchase, including a Rs 200 notebook.
Vote: apply to every order, apply only when risk justifies it, or never verify identity? Defend your choice.
Possible benefit
Additional evidence may reduce some impersonation risks.
Possible costs
Checkout friction, accessibility barriers, processing expense and more sensitive data to protect.
Use proportionate, risk-based controls. Minimize data and step up checks where warranted; do not assume “more data” always means “more security.”
🧮 Nepal Customer Acquisition Cost Calculator
Illustrative simulation; not measured Nepal benchmarks or guaranteed campaign results. These marketing activities are retained from the source; their placement needs Arjan’s review.
Key Takeaways 🎯
- E-commerce security is built on six core dimensions: Integrity, Nonrepudiation, Authenticity, Confidentiality, Privacy, and Availability.
- Trust is the foundation of all e-commerce. Without security, there is no trust, and therefore, no transactions.
- The Nepali e-commerce landscape has unique security challenges, including risks from COD prevalence and a need for greater consumer awareness and stronger regulation.
Mini Case: Six Dimensions, Two Viewpoints
Illustrative festival order: the app changes Rs 1,500 to Rs 15,000, a fake support account requests an OTP, and checkout goes offline. In pairs, name three dimensions at risk, then one customer need and one merchant control for each.
- Integrity: customer needs the agreed amount; merchant validates prices and totals on its server.
- Authenticity: customer needs the genuine support channel; merchant publishes verified contact paths and never requests login OTPs through support chat.
- Availability: customer needs a usable checkout; merchant plans capacity, monitoring and recovery.
Extend the answer: confidentiality protects access; privacy governs personal-data use; nonrepudiation needs trustworthy transaction evidence.
Exam Practice 📝
Short answer
- List the six dimensions of e-commerce security.
- Distinguish between confidentiality and privacy.
- What is nonrepudiation? Give an example.
Long answer
- Explain the six dimensions of e-commerce security from both the customer's and the merchant's perspective.
- "Security conflicts with other values." Discuss this statement with examples.
Revise the answers in the full note.
Sources & Media Credits
- Online shopping with card: Shixart1985, CC BY 2.0 (Wikimedia Commons).
- Integrated QR payment systems in Asia: Bamboofirdaus, CC0 (Wikimedia Commons).
- CIA, audit-trail, lookalike and payment-flow diagrams: made for IT204, CC BY 4.0.
- Videos: World Insurance Associates; Kate Dewhirst Health Law.
- Image 1: source — CC BY 2.0, Shixart1985
- Image 5: source — CC0, Bamboofirdaus
- Clip 1: source
- Clip 2: source
- NIST Cybersecurity Framework
Thank You
Next Up: 4.2 - Security Threats in Detail