E-Commerce Payment Systems
1. What is a Payment System?
The set of instruments, participants and processes that move value from buyer to seller electronically: buyer → merchant → payment gateway → card network / bank → settlement.
BUYER MERCHANT / PSP BANKS
+---------+ card/UPI/wallet +----------+ authorisation +-----------+
| payer | ----------------> | gateway | <--------------->| issuer / |
| account | credentials | (acquirer| request | acquirer |
+---------+ | route) | ---------------->| banks |
+----------+ response +-----------+
| settlement (batch / realtime, T+0..T+2)
v
merchant's bank account
2. Types of E-Payment Instruments
| Type | Description | Example |
|---|---|---|
| Credit / debit card | card number + CVV + OTP over a gateway; Chargeback mechanism | Visa/MasterCard/RuPay |
| Digital wallet | pre-funded account held by a PSP; one-tap pay | Paytm, PhonePe, Amazon Pay |
| UPI / real-time bank transfer | inter-bank instant transfer via VPA; PIN authorisation | UPI apps (GPay, PhonePe) |
| Net banking | direct login to bank portal, redirect flow | bank e-commerce page |
| E-cash / virtual currency | digitally signed stored value | early e-cash, gift vouchers |
| Smart cards | chip card with stored value / EMV chip | transit cards, meal cards |
| Mobile / NFC payments | contactless tokenised card on phone | Apple Pay, Google Pay tap |
| BNPL / EMI | credit at checkout, pay later | Zest, card EMI |
| Crypto | decentralised digital currency | Bitcoin (still limited acceptance) |
3. Card Payment Flow (authorisation and settlement)
- Checkout → card details (over TLS) sent to gateway.
- Gateway → acquirer → card network (Visa/MC) → issuer — authorisation request.
- Issuer checks funds/risk, holds the amount → returns auth code (or decline).
- Order shipped; at end of day merchant sends capture request → funds move in settlement (T+0 to T+2).
- Refunds/chargebacks follow the reverse path.
Key parties: cardholder, merchant, acquirer (merchant's bank), issuer (customer's bank), card network (Visa/MC/RuPay), payment gateway/PSP (Razorpay, PayU, Stripe).
4. UPI Flow (India's dominant system)
Payer VPA --> PSP app (GPay/PhonePe) --> UPI switch (NPCI)
| |
v v
Payer bank (debit, PIN/UPI auth) <-----> Payee bank (credit)
real-time, 24x7, inter-operable, no card needed
Collect vs intent flows, mandate (autopay), QR-code based payments — low-cost, cardless, instant settlement.
5. Security Controls in Payment Systems
| Control | Purpose |
|---|---|
| TLS/HTTPS | encrypt card data in transit |
| PCI-DSS | industry standard for storing/processing card data (never store CVV) |
| 3-D Secure / OTP | step-up authentication at issuer |
| Tokenisation | replace PAN with a token usable only at that merchant/device |
| EMV chip | dynamic cryptogram, anti-cloning |
| Fraud scoring / velocity checks | rule & ML based risk engine at gateway |
| CVV2/CVC | card-not-present proof of possession |
| Digital signature / HMAC on gateway callbacks | tamper-proof confirmation of payment status |
6. Comparison: Cards vs Wallet vs UPI
| Aspect | Card | Wallet | UPI |
|---|---|---|---|
| Setup | bank issued card | top-up / KYC | link bank account |
| Cost to merchant | MDR ~1-2% | low | near zero (P2M zero MDR) |
| Speed | seconds | one-tap | instant 24×7 |
| Dispute recourse | strong (chargeback) | weaker | via bank/NPCI ombudsman |
| Cross-border | excellent | limited | improving (UPI International) |
7. Risks
Fraud (stolen card, phishing, social engineering), chargeback abuse, data breach liability, settlement/liquidity risk for merchants, regulatory compliance (RBI data localisation, KYC norms for wallets/PPIs).
8. Exam Points
- Explain credit-card / UPI payment flow with a diagram (authorisation, capture, settlement) — 10 marks (very frequent).
- Explain various e-payment systems with advantages/limitations — 10 marks.
- Short notes: payment gateway, digital wallet, tokenisation, PCI-DSS — 3-5 marks each.
- Security measures for online payments — 5-7 marks.