Glossary Terms

A cardholder-authentication protocol for online card payments. The issuer verifies the shopper during checkout, which can shift fraud-chargeback liability away from the merchant. [1]

The EMVCo-specified successor to the original 3D Secure. It passes richer transaction data to the issuer and supports flexible authentication methods, so more payments can be approved without an extra challenge step. [1]

Automated Clearing House: the US electronic network that moves direct deposits and direct payments between bank accounts for consumers, businesses and governments, without cards, wires, checks or cash. [2]

A mode of the AES block cipher in which each plaintext block is combined with the previous ciphertext block before encryption, so identical plaintext blocks produce different ciphertext. Specified in NIST SP 800-38A. [3]

The simplest AES mode: each block is encrypted independently with the same key, so identical plaintext blocks yield identical ciphertext. Specified in NIST SP 800-38A and generally unsuited to data with repeating patterns. [3]

Account Funding Transaction: a card transaction that moves money from a cardholder's account to fund another account, such as a wallet, rather than purchasing goods.

A software system trained on data to learn patterns, then used to make predictions, classify inputs or generate content.

Describes operations that don't happen in lockstep: one system starts a request and carries on, and the result arrives later on its own timeline.

The share of card payments for which 3D Secure authentication was attempted, out of all card payments.

The share of 3D Secure authentication attempts that succeeded.

An individual with significant responsibility to control, manage or direct a business, such as an executive officer or senior manager. Often used as the 'control person' in onboarding and KYC. [4]

The percentage of attempted card payments that issuers approve.

A fraud check that compares the billing address a customer gives with the address on file at the card issuer; the issuer returns a match code to the merchant.

An individual who directly or indirectly owns 25% or more of a legal entity. Under FinCEN's CDD Rule, one person with significant control is also identified. [4]

How often invoices are generated and sent to customers, independent of the service period.

Short-term financing that lets a customer take a purchase now and pay in installments, commonly four or fewer and often interest-free. [5]

Collecting funds that were previously authorized. Authorization places a hold on the cardholder's available credit; capture requests that the money actually be transferred, often later in settlement.

Funds are captured as soon as a charge is authorized, with no separate step.

Funds are captured in a separate step after authorization, for example once an order ships.

A step where the issuer verifies the cardholder before approving a payment, such as a one-time code sent to the cardholder's phone. [1]

The institution that issues a payment card to a cardholder, usually a bank, or the card network itself in the case of American Express.

Fees charged by card networks, principally interchange and scheme (assessment) fees.

Organizations such as Visa, Mastercard, American Express and Discover that operate the infrastructure and rules for card transactions between merchants' and cardholders' banks.

A transaction in which the physical card is not read by the merchant, such as online, phone or mail orders, and card-on-file or recurring payments.

A surrogate value that replaces the cardholder's primary account number (PAN) so the real number isn't stored or transmitted. [6]

A card that requires the full balance to be paid at the end of each billing cycle, rather than allowing a revolving balance.

A reversal initiated by a cardholder's bank after the cardholder disputes a transaction; the disputed funds are debited from the merchant until the dispute is resolved.

A browser security feature in which a site sends instructions telling the browser what its code may do. It helps mitigate attacks such as cross-site scripting (XSS) and data injection. [7]

The 3- or 4-digit security code on a card (CVC, CVV or CID depending on the brand), used in card-not-present transactions to help confirm the cardholder has the physical card.

Technology that is no longer recommended and may stop working after an announced date.

An app or service that stores payment credentials and lets customers pay from a phone or other smart device, often by contactless tap.

A code returned with a 3D Secure authentication result that shows how and whether the cardholder was authenticated; it is used to determine liability shift eligibility.

The global specifications for chip-card and contactless acceptance, originally developed by Europay, Mastercard and Visa and now managed by EMVCo.

A Datacap command that loads parameters from the active deployment onto the PIN pad so it can run EMV transactions. Required for new installs and whenever deployment parameters change. [8]

The Federal Deposit Insurance Corporation: a US agency that insures deposits, supervises banks and resolves failures to maintain stability and public confidence in the financial system. [9]

The two parts of a fee. For a rate of 2.04% + $0.10, 2.04% of the amount is the variable portion and $0.10 per transaction is the fixed portion.

Debit cards tied to Flexible Spending or Health Savings Accounts, funded with pre-tax dollars and limited to eligible medical purchases at qualifying merchants.

Delivering the goods or services a customer purchased, typically after payment is collected.

Total sales over a period before returns, discounts or deductions.

Goods and services tax: a consumption tax charged on most goods and services. In Canada the federal GST is 5%, collected by sellers and remitted to the government. [10]

Harmonized Sales Tax: in certain Canadian provinces, a single tax that combines the federal GST and the provincial sales tax. [10]

A fee paid by the merchant's bank (acquirer) to the cardholder's bank (issuer) on card transactions. For US debit cards, the Federal Reserve's Regulation II caps what issuers can receive. [11]

KYC: the procedures businesses use to verify a customer's identity and assess risk. It is part of anti-money-laundering (AML) compliance, including FinCEN's Customer Due Diligence Rule. [4]

Technology that remains in service but is no longer recommended for new development.

When a transaction is authenticated through 3D Secure, responsibility for certain fraud chargebacks can move from the merchant to the card issuer. [1]

The customer's written authorization to debit their bank account, obtained before the first ACH debit.

A platform that hosts storefronts or listings for multiple sellers under the platform's own brand.

Merchant Category Code: a four-digit code that classifies the type of goods or services a merchant provides.

A unique identifier assigned to a merchant by its processor or acquirer, used to identify the merchant during processing and settlement.

Nacha: the organization that establishes and oversees the rules governing the ACH Network. [2]

Non-sufficient funds: the reason an ACH debit is returned when the account lacks funds, reported with return code R01.

A PIN verification method for chip cards in which the PIN is checked by the card itself, without contacting the issuer.

A PIN verification method in which the PIN is encrypted and sent to the issuer for verification during authorization.

A payment made while the customer is actively present in the checkout flow and able to authenticate.

A refund for less than the full remaining refundable amount of a transaction.

The financial networks and infrastructure that move money from payer to payee, such as card networks, ACH and wire.

A transfer of funds to an external account, usually a bank deposit.

Adherence to the PCI Data Security Standard, which applies to entities that store, process or transmit cardholder data or could affect the security of the cardholder data environment. [12]

Information that can identify an individual, alone or combined with other data, such as name, Social Security number, biometric records, or linked financial and employment details. [13]

Provincial Sales Tax: a retail sales tax charged by some Canadian provinces on consumer purchases, separate from the federal GST.

Québec Sales Tax: Quebec's provincial sales tax, collected alongside the GST on most property and services sold in the province. [10]

A US contact-chip flow that lets the cardholder remove the card before the authorization response returns. The terminal completes the chip transaction as a deferred authorization. [14]

For tax purposes, sales to end consumers, excluding goods bought for resale.

Cancellation of a transaction before it settles.

Retail Sales Tax: a Manitoba tax on the retail sale or rental of most goods and certain services, charged at 7% and calculated before GST. [15]

The period used to measure usage and apply pricing, independent of billing cadence.

Funds from authorized and captured transactions are transferred to the merchant's account.

A contact EMV flow in which the card stays in the reader through online authorization; the transaction completes after the chip validates the issuer response with a second cryptogram, and is reversed if validation fails.

An account that holds funds, typically loaded from an external bank account.

A category assigned to a product or service that determines how it is taxed.

Transport Layer Security: the protocol that secures data in transit between a client and server by providing authentication, confidentiality and integrity. It succeeded SSL. [16]

Magnetic-stripe data format holding the card number (PAN), expiration date and issuer-defined data, used for in-person processing.

Two-factor authentication: a security process that requires two different authentication factors, such as a password and a one-time code, to verify identity.

Value-added tax: a consumption tax charged at each stage of production and distribution, ultimately borne by the end consumer.

An automated HTTPS message sent from one system to another when an event occurs, usually carrying a JSON payload.

An electronic transfer of funds from one party's bank account to another's, also called a bank or credit transfer.

A fee charged for offering an additional or expedited payment channel, such as online or phone payments. It differs from a surcharge because it pays for the convenience, not for card-processing costs.

A non-cash adjustment that lets merchants add a fee to an electronic payment. Part of Datacap's Payment Fee Suite, which covers surcharge with lookup, dual/multi-pricing, split fee funding and convenience fees. The fee and description appear on the receipt.

Showing different prices for the same item depending on payment method, such as a lower cash price (cash discounting). Works best in-person where a device can display each price.

A fee a merchant adds to a card transaction to offset processing costs. Regulated by card networks and many states.

Payment acceptance that unifies online, mobile and in-store channels so customers and merchants get one consistent experience and view of payment data.

Replacing sensitive payment data, such as the PAN, with a surrogate token that has no exploitable value outside the issuing payment system. [6]

Encryption that protects card data from the point of capture to the secure decryption environment, leaving it unreadable in between. PCI SSC lists validated P2PE solutions that reduce merchant PCI scope. [17]

A short-range wireless technology (a few centimeters) behind tap-to-pay, used in contactless cards and mobile wallets such as Apple Pay and Google Pay. [18]

Collecting transactions over a period, often a day, and submitting them together for settlement rather than one at a time.

Technology that relays transaction data between merchants and processors or card networks for authorization and settlement.

A third party that partners with acquirers or processors to sell and support merchant accounts and payment services.

A payment page hosted by a gateway or processor where customers enter card data, keeping the data off the merchant's own site and reducing PCI scope.

A device that securely captures the cardholder's PIN and typically also reads chip and contactless cards. See also: payment device

A financial institution that processes card transactions for a merchant, maintains its merchant account and settles funds from issuers.