---
title: "Card security and SCA · Agent Wranglers"
url: https://agentwranglers.se/playbook/payments/card-security-and-sca
parts: 8
tokens_total: 8189
updated: 2026-10-27
build: a2a6bdfed830
tokens: 956
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Card security and SCA

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Payments and billing](https://agentwranglers.se/playbook/payments.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

> Let the provider hold card data, guard the scripts on payment pages, handle 3-D Secure and its exemptions, and test every outcome with test cards.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/payments/card-security-and-sca">Agent Wranglers payments and billing playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- PAY-1 [Choose a checkout that keeps you on SAQ A](https://agentwranglers.se/playbook/payments/card-security-and-sca/pci-saq-a-integration.md) · 1,087 tokens · updated 2026-10-27
  Never let card numbers reach your servers or your own scripts. Take card details only through the provider's hosted payment page or its iframe fields, so you qualify for the shortest PCI DSS self-assessment, SAQ A.
- PAY-76 [Guard every script on a payment page](https://agentwranglers.se/playbook/payments/card-security-and-sca/payment-page-scripts.md) · 1,306 tokens · updated 2026-10-27
  On every page that shows card fields or the provider's payment iframe, allow only scripts on a written inventory. Detect any change to those scripts or the page's security headers within 7 days, and alert.
- PAY-2 [Handle 3-D Secure in every card flow](https://agentwranglers.se/playbook/payments/card-security-and-sca/strong-customer-authentication.md) · 1,278 tokens · updated 2026-10-27
  Send every card payment the customer starts through the provider's 3-D Secure step, and handle the result that asks for customer action.
- PAY-5 [Keep test and live modes apart](https://agentwranglers.se/playbook/payments/card-security-and-sca/test-and-live-keys.md) · 926 tokens · updated 2026-10-27
  Use the provider's test mode in every environment except production, and make the app refuse to start with a live key anywhere else.
- PAY-8 [Confirm your PCI DSS compliance every year](https://agentwranglers.se/playbook/payments/card-security-and-sca/pci-annual-attestation.md) · 780 tokens · updated 2026-10-27
  File the PCI DSS self-assessment questionnaire that fits your checkout once every 12 months, and keep the provider's own attestation of compliance beside it.

## Recommended

- PAY-3 [Save cards with consent and charge renewals off-session](https://agentwranglers.se/playbook/payments/card-security-and-sca/off-session-payments.md) · 990 tokens · updated 2026-10-22
  To charge a card later, save it at the first payment with SCA and the customer's consent. Mark each later charge as merchant-initiated.
- PAY-6 [Test every payment outcome with test cards](https://agentwranglers.se/playbook/payments/card-security-and-sca/payment-test-scenarios.md) · 798 tokens · updated 2026-10-22
  Keep one automated test for each payment outcome, using the provider's test cards and test clocks, and run them before every release that touches payments.
- PAY-77 [Verify your domains for Apple Pay and Google Pay](https://agentwranglers.se/playbook/payments/card-security-and-sca/wallet-domain-verification.md) · 1,024 tokens · updated 2026-10-27
  Register every domain and subdomain that shows a wallet button with the provider. Serve Apple's domain association file there with status 200 and no redirect.

- Next: [Price display and consumer law](https://agentwranglers.se/playbook/payments/price-display-and-consumer-law.md)
- [All chapters](https://agentwranglers.se/playbook/payments.md)