1 Introduction

The shift towards a digital economy has led to an increase in electronic payment methods, from credit cards to online and mobile contactless payments. Secure payment is crucial in verifying and protecting transactions and customers. Despite implementing security measures such as data encryption and strong customer authentication, online fraud continues to be a concern in the industry. Standards such as the EMV Integrated Circuit Card Specification, Payment Card Industry Data Security Standard, and Revised Payment Services Directive regulate the payment services and providers, mandating various security measures to be in place.

2 Analysis

Secure payment is an essential element of digital commerce in a world where cash is becoming redundant, credit cards are becoming less and less important, and mobile devices are becoming means of payment. Secure payment relies on the verification of transactions and customers that make payments. However, this process has become increasingly challenging. It has been reported that false declines of transactions are increasing as a result of suspected fraudulent activities [1].

2.1 Definition

Secure payment refers to a variety of payment methods - typically in relation to electronic payments. Therefore, it must be considered through the lens of a variety of payment methods: Credit cards have been around since the 1950s, but the introduction of chip technology and contactless payment raises new challenges for the security of payments [2]. Online payments were reported to have been conducted for the first time in the 1990s [3]. There has been an increase in the crime of online fraud since then [4]. Since the advent of smartphones in the 2000s, mobile (contactless) payment systems have become increasingly popular [5, 6]. Additionally, voice payments using voice assistants are becoming increasingly popular [7].

As a means of combating online fraud, banks and fintech companies have implemented techniques such as fraud monitoring (e.g., through the use of emerging technologies such as artificial intelligence [8]), employee training, and active management of compliance with standards and regulations [9]. The following are among them [10]:

  • EMV Integrated Circuit Card Specification for Payment Systems: Payment card standard based on chip technology [11]

  • Payment Card Industry Data Security Standard (PCI DSS): All major credit card companies support a set of rules relating to the processing of credit card transactions [12]

  • Revised Payment Services Directive (PSD 2, Directive (EU) 2015/2366): This directive regulates the payment services and providers in the European Union (EU) and the European Economic Area (EEA) [13]

These standards require various security measures which include:

  • Data encryption: The Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that enable the establishment of a secure channel between systems and preserve the confidentiality and integrity of data. As of June 30, 2018, PCI requires migration from early versions of TLS and SSL to the later versions of TLS [12].

  • Strong customer authentication (SCA): PSD 2 requires multi-factor authentication, which is the combination of multiple independent security factors (see Sect. 29.2). There are several exceptions to this requirement, such as for payments of very small amounts [13]. EMV 3-D Secure [14] is one method for implementing SCA for credit and debit cards. This protocol is designed to prevent unauthorized use of credit cards. It is offered, for example, under the name Verified by Visa or Mastercard Identity Check, and requires additional authentication with the card issuer for “card-not-present” transactions (i.e., neither the card nor the cardholder are present). Those merchants who use 3-D Secure can be assured that their payments will be received [15].

  • Account verification, address verification service (AVS), and card verification value (CVV2) are all methods of validating payment accounts offered by credit card companies. With the exception of U.S. and U.K. card issuers, AVS and CVV2 participation is optional [16, 17].

2.2 Trends

It is estimated that the total value of digital payments will reach $8.49 trillion in 2022. By 2026, it is forecast that the market will reach $13.75 trillion with an annual growth rate of 12.82% [18]. Table 32.1 provides a summary of key trends in secure payments in the coming years. As a prerequisite to the use case trends listed in the table, secure payment is necessary, emphasizing the importance of secure payment for the development of new applications in retail.

Table 32.1 Key trends in secure payments
Full size table

3 Consequences for Switzerland

PSD 2 is only applicable to EU member states; therefore, implementation in Switzerland is voluntary, and there is no corresponding regulation. SEPA membership, however, requires equivalence in a number of areas [31].

According to a study conducted in 2021 on the Swiss payment market, the number of cash payments is decreasing drastically as a result of the COVID-19 pandemic. Online shopping and the use of credit cards are both on the rise, with the latter being the most popular method of payment [32]. The popularity of mobile payment options is also increasing [33].

In the secure payment market, several Swiss startups are active. NetGuardians SA (Yverdon-les-Bains, JU) develops artificial intelligence-based fraud detection solutions for the banking industry. A payment ecosystem offered by Datatrans AG (Zürich, ZH) allows its customers to access secure payment methods that are most advantageous to them.

The recent outages of digital payment services have raised public awareness of their vulnerability to disturbances caused by service providers or infrastructure providers [34, 35]. In an incident involving Twint, Switzerland’s number one mobile payment provider, a payment was wired to a previous owner of the intended recipient’s mobile number, illustrating the challenges associated with ensuring secure payments with modern methods of payment [36].

3.1 Implementation Possibilities: Make or Buy

Typically, secure payment is implemented by commercial payment service providers, such as credit card issuers or infrastructure operators, such as SIX. A number of open-source solutions are currently available for automated clearing house (ACH) payment (e.g., OpenACH), which is used to transfer money from one bank account to another [37]. Additionally, there are open-source payment gateways (e.g., Open-Source Payment Gateway), which facilitate the transfer of payment information. The providers of these open-source solutions claim that their products facilitate integration with existing systems on the client side and provide better customization due to their modularity and adaptability. It is important to note that while the source code is available, open source does not necessarily mean that the solution is free. In addition to PCI compliance, it still requires an underlying infrastructure and computing power.

3.2 Variation and Recommendation

Secure payment ecosystems can be established using distributed ledger technologies such as blockchain [38]. Due to technological advancements, current disadvantages such as inefficiency and elevated power consumption are expected to be mitigated in the future, making it a viable alternative to existing secure payment methods [39].

4 Conclusion

Regulations require the implementation of technical solutions such as 3-D Secure 2.0, which are becoming increasingly user-friendly as time goes on. Secure payment systems are the foundation of innovation in industries such as retail.