Secure Payment Confirmation - Revision history

Tom: /* Apple/Google/Samsung Pay */

2024-05-28T16:57:18Z

‎Apple/Google/Samsung Pay

Tom: /* Apple/Google/Samsung Pay */

2024-05-28T16:53:44Z

‎Apple/Google/Samsung Pay

Tom: /* Apple/Google/Samsung Pay */

2024-05-28T16:53:26Z

‎Apple/Google/Samsung Pay

Tom: /* Apple/Google/Samsung Pay */

2024-05-28T16:52:00Z

‎Apple/Google/Samsung Pay

Tom: /* Apple/Google/Samsung Pay */

2024-05-28T16:50:57Z

‎Apple/Google/Samsung Pay

Tom at 16:48, 28 May 2024

2024-05-28T16:48:13Z

Tom: /* Context */

2024-05-28T16:45:12Z

‎Context

Tom: /* Device Binding */

2024-05-28T16:42:28Z

‎Device Binding

Tom: /* Solutions */

2024-05-28T00:58:16Z

‎Solutions

Tom: /* Solutions */

2024-05-28T00:46:40Z

‎Solutions

@@ Line 18: / Line 18: @@
 ===Apple/Google/Samsung Pay===
-Payment security is based on [https://www.advantio.com/blog/heres-how-google-pay-apple-pay-samsung-pay-protect-your-card-details Tokenization of the payment card number]. This technology never shares the actual data of the linked payment card is with the merchant when making payments. Nor is it stored in the user's device. This minimizes the risk of fraud and exposure of this information. This security feature is based on  "tokenization" of the card data. In the card payments industry, a token is a non-confidential value used to replace the Primary Account Number (PAN) data. A payment token differs from [[Identifier]] tokens in that its format follows the parameters described in the EMVco technical specification.
+Payment security is based on [https://www.advantio.com/blog/heres-how-google-pay-apple-pay-samsung-pay-protect-your-card-details Tokenization of the payment card number]. This technology never shares the actual data of the linked payment card is with the merchant when making payments. Nor is it stored in the user's device. This minimizes the risk of fraud and exposure of this information. This security feature is based on  "tokenization" of the card data. In the card payments industry, a token is a non-confidential value used to replace the Primary Account Number (PAN) data. A payment token differs from [[Identifier]] tokens in that its format follows the parameters described in the EMVco technical specification. The management of these type of tokens is under the responsibility of entities registered with EMVco as Token Service Provider (TSP). The TSPs handle:
 ==Device Binding==

@@ Line 18: / Line 18: @@
 ===Apple/Google/Samsung Pay===
-Payment security is based on [https://www.advantio.com/blog/heres-how-google-pay-apple-pay-samsung-pay-protect-your-card-details Tokenization of the payment card number]. This technology never shares the actual data of the linked payment card is with the merchant when making payments. Nor is it stored in the user's device. This minimizes the risk of fraud and exposure of this information. This security feature is based on  "tokenization" of the card data. In the card payments industry, a token is a non-confidential value used to replace the Primary Account Number (PAN) data. A payment token differs from the [[Identifier]] tokens in that its format follows the parameters described in the EMVco technical specification.
+Payment security is based on [https://www.advantio.com/blog/heres-how-google-pay-apple-pay-samsung-pay-protect-your-card-details Tokenization of the payment card number]. This technology never shares the actual data of the linked payment card is with the merchant when making payments. Nor is it stored in the user's device. This minimizes the risk of fraud and exposure of this information. This security feature is based on  "tokenization" of the card data. In the card payments industry, a token is a non-confidential value used to replace the Primary Account Number (PAN) data. A payment token differs from [[Identifier]] tokens in that its format follows the parameters described in the EMVco technical specification.
 ==Device Binding==

@@ Line 18: / Line 18: @@
 ===Apple/Google/Samsung Pay===
-Payment security is based on [https://www.advantio.com/blog/heres-how-google-pay-apple-pay-samsung-pay-protect-your-card-details Tokenization of the payment card number]. This technology never shares the actual data of the linked payment card is with the merchant when making payments. Nor is it stored in the user's device. This minimizes the risk of fraud and exposure of this information. This security feature is based on  "tokenization" of the card data. In the card payments industry, a token is a non-confidential value used to replace the Primary Account Number (PAN) data.
+Payment security is based on [https://www.advantio.com/blog/heres-how-google-pay-apple-pay-samsung-pay-protect-your-card-details Tokenization of the payment card number]. This technology never shares the actual data of the linked payment card is with the merchant when making payments. Nor is it stored in the user's device. This minimizes the risk of fraud and exposure of this information. This security feature is based on  "tokenization" of the card data. In the card payments industry, a token is a non-confidential value used to replace the Primary Account Number (PAN) data. A payment token differs from the [[Identifier]] tokens in that its format follows the parameters described in the EMVco technical specification.
 ==Device Binding==

@@ Line 18: / Line 18: @@
 ===Apple/Google/Samsung Pay===
-Payment security is based on [https://www.advantio.com/blog/heres-how-google-pay-apple-pay-samsung-pay-protect-your-card-details Tokenization of the payment card number]. This technology never shares the actual data of the linked payment card is with the merchant when making payments. Nor is it stored in the user's device. This minimizes the risk of fraud and exposure of this information. This security feature is based on  "tokenization" of the card data.
+Payment security is based on [https://www.advantio.com/blog/heres-how-google-pay-apple-pay-samsung-pay-protect-your-card-details Tokenization of the payment card number]. This technology never shares the actual data of the linked payment card is with the merchant when making payments. Nor is it stored in the user's device. This minimizes the risk of fraud and exposure of this information. This security feature is based on  "tokenization" of the card data. In the card payments industry, a token is a non-confidential value used to replace the Primary Account Number (PAN) data.
 ==Device Binding==

@@ Line 18: / Line 18: @@
 ===Apple/Google/Samsung Pay===
-Payment security is based on [https://www.advantio.com/blog/heres-how-google-pay-apple-pay-samsung-pay-protect-your-card-details Tokenization of the payment card number].
+Payment security is based on [https://www.advantio.com/blog/heres-how-google-pay-apple-pay-samsung-pay-protect-your-card-details Tokenization of the payment card number]. This technology never shares the actual data of the linked payment card is with the merchant when making payments. Nor is it stored in the user's device. This minimizes the risk of fraud and exposure of this information. This security feature is based on  "tokenization" of the card data.
 ==Device Binding==

@@ Line 3: / Line 3: @@
 ==Context==
-* A digital wallet is an application that allows you to store and organize loyalty cards, identification documents, bank details, concert tickets, airline tickets, crypto coins and payment cards on a mobile phone, a computer, a smart watch or on a tablet. This data can then be transmitted to other devices using wireless technologies (NFC or Bluetooth) to make payments or perform specific validations. This frees the user from the use of physical cards and the mistakes that inevitable happen when long strings of numbers are keyed in by the holder.
+* A digital [[Wallet]] is an application that allows you to store and organize loyalty cards, identification documents, bank details, concert tickets, airline tickets, crypto coins and payment cards on a mobile phone, a computer, a smart watch or on a tablet. This data can then be used in an [[Electronic Payment]] transmitted to other devices using wireless technologies (QR, NFC or Bluetooth) to make payments or perform specific validations. This frees the user from the use of physical cards and the mistakes that inevitable happen when long strings of numbers are keyed in by the holder.
 * [https://www.w3.org/TR/2021/WD-secure-payment-confirmation-20210831/ Secure Payment Confirmation (SPC) is a Web API] to support streamlined authentication during a payment transaction. It is designed to scale authentication across merchants, to be used within a wide range of authentication protocols, and to produce cryptographic evidence that the user has confirmed transaction details.
 * [https://developer.mozilla.org/en-US/docs/Web/API/Payment_Request_API/Using_secure_payment_confirmation Using Secure Payment Confirmation] is a Mozilla page to protect against online payment fraud, where it is common to authenticate the account holder. Strong authentication lowers the risk of fraud, but increases the likelihood that friction during checkout will lead to shopping cart abandonment. Banks, merchants, payment services providers, and other entities in a payments ecosystem therefore consider a number of factors when deciding what type and strength of authentication to use for each transaction, including the amount, the items being purchased, the user's payment history, which party bears liability in the case of fraud, and regulatory requirements (such as [https://en.wikipedia.org/wiki/Payment_Services_Directive#Revised_Directive_on_Payment_Services_(PSD2) European Payment Services Directive 2] requirements for strong customer authentication and evidence of user consent).

← Older revision		Revision as of 16:42, 28 May 2024
Line 15:		Line 15:

	Because the browser passes the displayed data directly to the authenticator (with no JavaScript code able to alter the data), the Relying Party can have high confidence that the user consented to the displayed transaction data.		Because the browser passes the displayed data directly to the authenticator (with no JavaScript code able to alter the data), the Relying Party can have high confidence that the user consented to the displayed transaction data.
		+
		+	===Apple/Google/Samsung Pay===
		+	Payment security is based on [https://www.advantio.com/blog/heres-how-google-pay-apple-pay-samsung-pay-protect-your-card-details Tokenization of the payment card number].

	==Device Binding==		==Device Binding==

@@ Line 12: / Line 12: @@
 * [https://www.w3.org/blog/wpwg/2021/10/06/spc-design-choices-for-flexibility-and-scale/ SPC Design Choices for Flexibility and Scale]  2021-10-06 Ian Jacobs
 * [https://developer.mozilla.org/en-US/docs/Web/API/Payment_Request_API/Using_secure_payment_confirmation SPC is designed] to enable streamlined strong customer authentication (SCA) in a variety of payment systems, and to provide cryptographic evidence that the user has consented to the terms of a transaction. When the API is called, the browser displays elements of the transaction in a dialog box: the name of the merchant, payment instrument, and amount and currency of payment. Note the identity of the merchant is not user friendly and easy to spoof.
-[[File:Chrome-tx-dialog.png|500px]]
+[[File:Chrome-tx-dialog.png|580px]]
 Because the browser passes the displayed data directly to the authenticator (with no JavaScript code able to alter the data), the Relying Party can have high confidence that the user consented to the displayed transaction data.