IT 204: E-Commerce
By the end of this case study, you will be able to analyze a real-world payment integration strategy.
A Nepali online retailer needed to expand its payment options beyond the standard methods.
Payment Card Industry Data Security Standard (PCI DSS): A set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment.
Directly handling card data is complex, expensive, and high-risk.
💡 The primary goal for any small-to-medium merchant is to reduce their PCI scope as much as possible.
The merchant chose an integration method that keeps card data completely off their servers.
Result: The merchant's system never sees or touches the raw card number. ⚡
Step through the Hosted Payment Page flow to see exactly where the customer's browser and card data are at each stage.
This HPP approach drastically simplifies PCI compliance.
For merchants that completely outsource all cardholder data functions.
For merchants who store, process, or transmit cardholder data.
Choosing an HPP allows a merchant to qualify for SAQ A, the lightest level of PCI validation.
Answer these 3 questions to determine your merchant's PCI DSS Self-Assessment Questionnaire tier.
Q1: Does your website directly collect card numbers (e.g., via a self-hosted input form or iFrame)?
Q2: Does your server store, process, or transmit any full cardholder data (PAN, CVV, expiry)?
Q3: Do you accept card payments through physical POS hardware at a brick-and-mortar store?
How can the site offer a "save card" feature without storing card data?
Tokenization: A process where sensitive card numbers are replaced with a unique, non-sensitive equivalent known as a "token." This token is useless to attackers.
Enter a fake card number and see how the gateway replaces it with a safe, meaningless token that the merchant stores instead.
This token references the card in the gateway's PCI-certified vault. It cannot be reverse-engineered to recover the original card number.
To prevent fraudulent transactions and chargebacks, 3-D Secure was integrated.
The customer's bank recognizes the transaction as low-risk and approves it instantly without any extra steps. This is the ideal user experience.
The bank requires an extra step for verification (Strong Customer Authentication - SCA). The user is prompted to enter:
Benefit: Liability for fraudulent chargebacks often shifts from the merchant to the card-issuing bank.
Adjust the transaction risk factors to see whether the bank's algorithm would trigger a Frictionless or Challenge flow.
Accepting a new payment type adds operational complexity. Automation is key.
Reconciliation: The process of matching transactions processed by the payment gateway to the funds deposited into the merchant's bank account.
This HPP and Tokenization model is a standard for enabling card payments in Nepal.
Companies like NCHL (N-PAY) and local banks provide the infrastructure for card processing.
Merchants targeting tourists or international customers often use Stripe or Cybersource via a local partner bank.
It allows Nepali SMEs to access global payment standards without massive upfront investment in security infrastructure.
A smart technical strategy directly led to improved security posture and increased revenue.
Estimate the monthly financial benefits of implementing HPP + Tokenization + 3-D Secure for a Nepali online store.
What are the core lessons from this implementation?
This case study demonstrates how strategic technology choices in payment systems can unlock growth while minimizing risk.
Next Up: Unit 4.6 - Digital Wallets and Mobile Payment Systems