Teaching case. This case is a composite based on typical Nepali businesses. Names are withheld and the figures are illustrative, chosen to make the calculations realistic.

Overview

To expand beyond COD/wallets, the retailer added card payments. Rather than store or touch card data, it used a hosted payment page with tokenization and 3‑D Secure.

Background

The retailer sold electronics and home appliances online, with average orders above Rs. 40,000. Most customers paid by cash on delivery or wallet, but wallet balance limits and the risk of carrying large amounts of cash made high-value orders difficult. Customers with credit and debit cards asked to pay by card. The retailer had a small IT team and did not want the cost and risk of storing card numbers on its own servers.

Implementation

  • Redirect/embedded HPP (Hosted Payment Page) to keep card data out of scope.
  • Tokenization for saved cards; vault managed by gateway under PCI DSS.
  • 3‑D Secure (SCA) flows integrated with clear UX for challenge/frictionless outcomes.
  • Reconciliation automation: daily settlement files → accounting system.

Outcomes

  • Card acceptance with minimal PCI scope; reduced disputes via 3DS.
  • Improved conversion for high‑ticket items where wallet balance was limiting.

Lessons (Unit 4 lens)

  • Choose the lightest PCI footprint feasible (SAQ A over SAQ D).
  • Clear error handling and retries minimize checkout abandonment.

The Numbers

  • Before card payments: 30% of high-value orders were abandoned at checkout or refused on delivery.
  • After card payments with 3-D Secure: abandonment on high-value orders fell to 18%.
  • On 500 high-value orders a month at Rs. 45,000, 12% more completed orders is 60 orders, or Rs. 27,00,000 in extra monthly sales.
  • Gateway fees of about 2% on card sales are far smaller than the margin on those extra orders.

Case Questions

  1. What is PCI DSS, and why does using a hosted payment page reduce the retailer’s PCI scope?
  2. Explain tokenization. How does it protect customers if the retailer’s website is hacked?
  3. What is 3-D Secure, and which security dimensions does it support?
  4. Using the figures, explain the business case for adding card payments.
  5. What should the checkout show customers when a card payment fails, to avoid abandonment?

Chapters covered

Use the unit notes below to review the theory this case applies in practice.