Overview

To expand beyond COD/wallets, the retailer added card payments. Rather than store or touch card data, it used a hosted payment page with tokenization and 3‑D Secure.

Implementation

  • Redirect/embedded HPP (Hosted Payment Page) to keep card data out of scope.
  • Tokenization for saved cards; vault managed by gateway under PCI DSS.
  • 3‑D Secure (SCA) flows integrated with clear UX for challenge/frictionless outcomes.
  • Reconciliation automation: daily settlement files → accounting system.

Outcomes

  • Card acceptance with minimal PCI scope; reduced disputes via 3DS.
  • Improved conversion for high‑ticket items where wallet balance was limiting.

Lessons (Unit 4 lens)

  • Choose the lightest PCI footprint feasible (SAQ A over SAQ D).
  • Clear error handling and retries minimize checkout abandonment.

Chapters covered

  • Security environment and standards (4.1)
  • Payment systems and flows (4.5)