Glossary
Payment security terms, in plain language.
- 3-D Secure (3DS)
- An extra authentication step during online card payments, run by the card issuer, that can shift fraud liability away from the merchant.
- Acquirer
- The bank or processor that accepts card payments on a merchant's behalf. It decides which SAQ a merchant completes and whether to charge non-compliance fees.
- AOC (Attestation of Compliance)
- The signed form declaring the results of a PCI DSS assessment. Merchants give it to their acquirer; service providers give theirs to their customers.
- ASV (Approved Scanning Vendor)
- A company approved by PCI SSC to run the external vulnerability scans some SAQs require.
- Card testing
- Running stolen card numbers through a real checkout, usually as many small payments, to learn which cards still work. Also called carding.
- CDE (Cardholder data environment)
- The people, processes and systems that store, process or transmit card data, plus anything connected to them that could affect their security.
- Chargeback
- A payment reversed by the card issuer after a cardholder dispute, usually with a fee charged to the merchant.
- CSP (Content Security Policy)
- A browser security header listing which sources a page may load scripts and other content from. Often part of a 6.4.3 and 11.6.1 approach.
- E-skimming (Magecart)
- Malicious script injected into a payment page that copies card details as customers type them.
- Enumeration
- Automated guessing of card numbers, expiry dates or CVVs against a merchant's checkout. Visa measures it under the Visa Acquirer Monitoring Program (VAMP).
- Hosted fields
- Payment form fields served by the processor inside the merchant's page, so card numbers never touch the merchant's systems.
- PAN (Primary account number)
- The long card number on a payment card.
- PCI DSS
- The Payment Card Industry Data Security Standard, the security requirements for anyone that stores, processes or transmits card data. The current version is 4.0.1.
- PCI SSC
- The PCI Security Standards Council, which maintains PCI DSS, the SAQs and the FAQs.
- QSA (Qualified Security Assessor)
- An assessor certified by PCI SSC to perform PCI DSS assessments and write a Report on Compliance.
- ROC (Report on Compliance)
- The detailed report from a full PCI DSS assessment, required of larger merchants and service providers.
- SAQ (Self-Assessment Questionnaire)
- A PCI DSS self-assessment for merchants and service providers eligible to self-assess. There are several types, from SAQ A to SAQ D.
- Service provider
- A business that stores, processes or transmits card data for others, or that can affect the security of their CDE, such as many MSPs.
- SRI (Subresource Integrity)
- A browser feature that refuses to run a script unless its contents match a published hash. One way to integrity-check scripts under 6.4.3.
- Tokenization
- Replacing a card number with a token that is useless outside the payment provider's systems.
- VAMP
- The Visa Acquirer Monitoring Program, which flags merchants and acquirers with high fraud, dispute or enumeration levels.
- Velocity filter
- A gateway rule that limits how many transactions are accepted in a time window or from one IP address.
Protect your merchants' checkout before the next attack.
Join the CardSecurity pilot for managed service providers. 30-day trial, up to 5 merchants.