Consumers and organizations have a variety of options for making and receiving payments. While these payment types share the ultimate goal of transferring funds from payer to payee, the path those funds travel and the approaches employed for safely and securely completing transactions vary. The Secure Payments Task Force developed the Payment Lifecycles and Security Profiles as an educational resource and to provide perspectives related to:

  • The lifecycles of the most common payment types, covering enrollment, transaction flow and reconciliation
  • Security methods, identity management controls and sensitive data occurring at each step in the payment lifecycles
  • Relevant laws and regulations, and other references, as well as challenges and improvement opportunities related to each payment type

The profiles employ a consistent format for describing the lifecycle of each payment type. The lifecycle template is not designed to represent the nuances of specific payment transaction flows, but as a broad taxonomy that can be applied across different payment types for understanding and comparing controls and risks. The profiles are not all-encompassing in describing the layered security strategies that may be employed by specific networks, providers or businesses and shouldn’t be considered an assessment of overall security of different payment types. The improvement opportunities noted in the profiles highlight areas for further industry exploration and are not intended as guidance or specific solutions to be implemented.

These valuable resources were developed through the collaborative efforts of more than 200 task force participants with diverse payments and security expertise and perspectives. It is the hope of the task force that by helping industry stakeholders better understand these payments processes, the security and risks associated with these processes, and potential improvement opportunities, they will be well positioned to take action to strengthen their payment security practices.

Note: These materials were created by the Secure Payments Task Force and are intended to be used as educational resources. The information provided in the Payment Lifecycles and Security Profiles does not necessarily reflect the views of any particular individual or organization participating in the Secure Payments Task Force. The document is not intended to provide business or legal advice and is not regulatory guidance. Readers should consult with their own business and legal advisors.

Feedback and/or questions related to the Payment Lifecycles and Security Profiles can be submitted by using the “provide feedback” form.

Wallet Definition: A payment card (e.g. credit or debit) funded transaction whereby a cardholder leverages a digital container accessed by a mobile device (e.g. a smartphone) that stores wallet applications, tokenized payment credentials, loyalty cards, and coupons and is used to make proximity and remote mobile payments. Tokenized payment credentials are either stored securely in the mobile phone [if near-field communication (NFC)] or in the cloud. Wallet transactions may be completed using NFC “pay” wallets (e.g. Apple Pay, Samsung Pay, Android Pay), cloud-based card-on-file wallets (e.g. PayPal, Pay, Amazon), cloud-based card-on-file card network digital “checkout” wallets (e.g. Express Checkout by American Express, Masterpass, Visa Checkout) and closed-loop merchant or financial institution quick reference (QR) code closed wallets (e.g. Chase Pay, Walmart Pay). These transactions may also have the ability to support biometrics, PIN and signature for consumer authentication.

Enrollment

Payer ID / Enrollment

Enrollment of a payer includes identity (ID) proofing, management of users (enrollment, de-enrollment, and changes) and determination of authority based on role

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

User provides (or issuer provides in auto-enrollment scenario) participating credit/debit card information with additional personally identifiable information (PII) authentication data to Wallet Service Provider to be verified by issuer to complete provisioning. Final provision incorporates a tokenization request to a token service provider to request a payment token for the previously issued card to be provisioned to wallet.

The PIN associated with the account may be communicated to the cardholder via direct outreach, email, or physical mail.

For Card Not Present authentication, merchant identifies required information based on relationship with customer; enrollment could mean the cardholder establishes an account or profile with the merchant.

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Payee ID / Enrollment

Enrollment of a payee includes identity (ID) proofing management of users (enrollment, de-enrollment and changes) and determination of authority (based on role)

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Acquirer approves merchant

Merchant is registered in advance and identification data is attributed when registered by the acquirer.

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Transaction*

Payer Authentication

Verification of payer when originating payments

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Many wallet providers require local device authentication to access the wallet before any payment requests can be initiated.

Once payment is initiated, cardholder and card verification methods may include Tokenized Primary Account Number (PAN), expiration date, out-of-band authentication/verification, Dynamic Card Verification Value (dCVV), cryptogram.

PIN / Passcode

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Initiation: Access Mode / Network

Environment in which the payment origination is requested

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

On-premise: NFC/MST/QR Code acquired

In-app: Wallet service payment integration with application providers

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Initiation: Device / Method Used to Initiate Payment

Type of interaction or device used to enter payment account information

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Contactless reader at the Point of Sale (POS), phone, tablet, wearable, PC, Internet of Things (IOT)

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Initiation: Funding Account for Payment

Entry and/or identification of the funding account (with format checks)

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Demand Deposit Account (DDA) or credit account

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Initiation: Payment Initiation Mechanism

Payment network, system and/or third-party accessed

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Merchant, acquirer, association or network, processor

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Payer Authorization: Payment Network Traversed

“Rails” used to route authorization requests to holder of funding account

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Authorization occurs through payment networks (e.g. credit and debit networks). If tokenized, de-tokenization through Token Service Provider must occur to allow authorization.

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Payer Authorization: Transaction Authorization

Determination of whether to approve/ decline a transaction including authorization time-frame obligations, and any recourse decisions

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Transactions are approved or declined within payment network service level agreements (SLAs).

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Format Exchange

Payment instructions, rules and formatting

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Payment network rules dictate format exchange.

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Receipt: Acknowledgement / Guarantee

Notification and confirmation of payment completion including terms for use

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Transaction is confirmed but fulfillment maybe delayed until authorization (guarantee of funds).

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Payee Authentication

Mode of access to funds (or accounts)

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Acquirer authenticates merchant.

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Clearing and Settlement: Settlement / Exchange of Funds

Actual movement of funds to settle funding arrangements and applicable fees

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Settlement occurs per payment network rules (e.g. credit and debit networks).

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

Reconciliation

Reconciliation / Exception Handling

Process and responsibilities associated with reconciling and handling any exceptions or problems with a payment

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Cardholder is required to report dispute within specified timeframe defined by payment network rules and law.

Overview of Security Methods and Associated Risks

Expand

Inventory of Sensitive Payment Data and Associated Risks

Expand

User Protection / Recourse

Applicable rules and regulations and legal means of recourse

Payment Type Operation

Wallet (via Contactless or In App)

Note: For Wallet transactions that leverage Contactless technology, please also refer to the Contactless Payment Lifecycle and Security Profile.

Determined by payment network rules and applicable consumer protection laws and regulation

Regulation Z consumer protections apply to consumer credit and Regulation E applies to debit.

 

Last Updated: 02/21/2018

Footnotes

1Card Verification Values: Card Verification Values represent data elements that are (1) encoded on the magnetic stripe or the chip of a payment card; or (2) printed on the physical payment card and are used to validate the card information during the transaction authorization process. Card Verification Values encoded on the magnetic stripe (e.g. CAV, CVV, CVC, CSC) or on the chip (e.g. dCVV, iCVV) are generated via a secure cryptographic process and may be static or dynamic data used to validate the card during the authorization process. Card Verification Values printed on the physical card (e.g. CID, CAV2, CVC2, CVV2) may be three-digit or four-digit codes printed on the front or back of the physical card that are uniquely associated with the physical card and ties the primary account number to the physical card. Note: Payment network rules and the PCI Security Standards Council provide additional definitions of Card Verification Values.

*Note: Payments/Transfers Flow in Both Directions