Card security and SCA

Required

• Choose a checkout that keeps you on SAQ A

  PAY-1

  Never let card numbers reach your servers or your own scripts. Take card details only through the provider's hosted payment page or its iframe fields, so you qualify for the shortest PCI DSS self-assessment, SAQ A.

• Guard every script on a payment page

  PAY-76

  On every page that shows card fields or the provider's payment iframe, allow only scripts on a written inventory. Detect any change to those scripts or the page's security headers within 7 days, and alert.

• Handle 3-D Secure in every card flow

  PAY-2 EU, UK law

  Send every card payment the customer starts through the provider's 3-D Secure step, and handle the result that asks for customer action.

• Keep test and live modes apart

  PAY-5

  Use the provider's test mode in every environment except production, and make the app refuse to start with a live key anywhere else.

• Confirm your PCI DSS compliance every year

  PAY-8

  File the PCI DSS self-assessment questionnaire that fits your checkout once every 12 months, and keep the provider's own attestation of compliance beside it.

Recommended

• Save cards with consent and charge renewals off-session

  PAY-3

  To charge a card later, save it at the first payment with SCA and the customer's consent. Mark each later charge as merchant-initiated.

• Test every payment outcome with test cards

  PAY-6

  Keep one automated test for each payment outcome, using the provider's test cards and test clocks, and run them before every release that touches payments.

• Verify your domains for Apple Pay and Google Pay

  PAY-77

  Register every domain and subdomain that shows a wallet button with the provider. Serve Apple's domain association file there with status 200 and no redirect.