Online Payment Systems: Gateways, Models, Security & Fraud

Core Concepts: What is an Online Payment System?

An online payment system enables secure, digital transactions between buyers and sellers over the internet. It includes:

• Payment gateways (technical interfaces like Khalti or PayPal).
• Processing networks (banks, card networks like Visa/Mastercard).
• Security protocols (encryption, fraud checks).

How It Works: Step-by-Step Flow

flowchart LR
    A["Buyer: Selects 'Pay Now'" --> B["Redirects to Payment Gateway (e.g., Khalti)"]
    B --> C["Gateway: Validates Card/Mobile Money"]
    C --> D["Gateway: Sends Authorization Request to Bank"]
    D --> E["Bank: Approves/Declines Transaction"]
    E --> F["Gateway: Confirms to Seller"]
    F --> G["Seller: Delivers Goods/Digital Product"]
    G --> H["Bank: Deducts Amount from Buyer"]
    H --> I["Seller Receives Funds (minus fees)"]

Key Players:

1. Merchant: Seller (e.g., Daraz, Nabil Bank’s online loan portal).
2. Customer: Buyer (e.g., you using Khalti on Pathao).
3. Payment Gateway: Middleman (e.g., IPS, PayPal, Khalti).
4. Acquiring Bank: Merchant’s bank (e.g., Nabil Bank for Daraz).
5. Issuing Bank: Customer’s bank (e.g., Global IME for your credit card).
6. Card Networks: Visa/Mastercard (for card transactions).

1. Types of Online Payment Systems

A. Classification by Model

B. Classification by Technology

• Card-Based: Visa/Mastercard (EMV chips, tokens).
• Bank Transfer: NEFT, RTGS (used for large loans).
• Mobile-Based: USSD (e.g., 123 for Ncell Purse).
• Cryptocurrency: Bitcoin, Ethereum (smart contracts).
• Prepaid Cards: Gift cards (e.g., Daraz vouchers).

Why it matters: EMV chips (used in Khalti-linked cards) encrypt data to prevent fraud.

2. How Payment Gateways Work

A payment gateway is the software that processes transactions securely. Example: When you pay on Daraz with Khalti:

1. You click "Pay with Khalti" → redirected to Khalti’s secure page.
2. Khalti encrypts your card details (if using a card) or debits your wallet.
3. Khalti sends an authorization request to Global IME (issuing bank) via Visa/Mastercard.
4. Global IME checks funds → approves/declines.
5. Daraz receives confirmation → ships your order.

Popular Gateways in Nepal

Why it matters: Shows how gateways standardize payment options for merchants.

3. Security in Online Payments

A. Key Security Measures

1. Encryption (SSL/TLS)

   • Converts data into unreadable code (e.g., HTTPS on Daraz’s checkout).
   • Example: When you enter your card number, TLS encrypts it before sending to the bank.

2. PCI-DSS Compliance

   • Payment Card Industry Data Security Standard: Rules for handling card data.
   • Example: Khalti stores only the last 4 digits of your card (tokenization).

3. Fraud Detection

   • Velocity Checks: Flag unusual transaction speeds (e.g., 10 orders in 5 minutes).
   • Device Fingerprinting: Blocks logins from new devices/locations.
   • 3D Secure (3DS): Extra authentication (e.g., OTP on your phone).

4. Tokenization

   • Replaces card details with a unique token (e.g., PayPal’s "--****-1234").

B. Common Fraud Types & Prevention

mindmap
  root((PCI-DSS Compliance))
    Requirement 1: Install and maintain firewall
    Requirement 2: Do not use vendor-supplied defaults
    Requirement 3: Protect stored cardholder data
    Requirement 4: Encrypt transmission of cardholder data
    Requirement 5: Use and regularly update antivirus
    Requirement 6: Develop and maintain secure systems
    Requirement 7: Restrict access to cardholder data
    Requirement 8: Assign unique IDs to users
    Requirement 9: Restrict physical access to data
    Requirement 10: Track and monitor access to data
    Requirement 11: Regularly test security systems
    Requirement 12: Maintain a policy for information security

4. Real-World Applications in Nepal

Case Study 1: Daraz’s Checkout Flow

Scenario: You buy a phone worth Rs. 20,000 on Daraz.

1. Step 1: Select "Pay with Khalti" at checkout.
2. Step 2: Khalti’s page loads (encrypted via TLS).
3. Step 3: You enter your Khalti PIN or card details.
4. Step 4: Khalti sends a request to Global IME (your bank) via Visa.
5. Step 5: Global IME approves → Daraz ships your phone.
6. Step 6: Rs. 20,000 + 3% (Rs. 600) fee is deducted from your Khalti balance.

Why It Matters:

• For Daraz: Low fraud risk (Khalti handles security).
• For You: No need to share card details directly with Daraz.

Case Study 2: Ncell Purse for Pathao Riders

Scenario: You pay Rs. 150 for a Pathao ride.

1. Step 1: Tap "Pay with Ncell Purse" in the Pathao app.
2. Step 2: Ncell’s USSD system (123) verifies your balance.
3. Step 3: Rs. 150 is deducted instantly (no bank involved).
4. Step 4: Pathao confirms payment → ride starts.

Why It Matters:

• No Internet Needed: Works via SMS (critical in rural Nepal).
• Speed: Faster than card processing.

Case Study 3: Nabil Bank’s Online Loan Repayment

Scenario: You repay a Rs. 50,000 loan via Nabil Bank’s website.

1. Step 1: Log in to Nabil’s portal → select "Repay Loan."
2. Step 2: Choose NEFT (bank transfer) or Khalti.
3. Step 3: If using NEFT:
   • Enter your account number.
   • Bank deducts Rs. 50,000 + Rs. 50 (NEFT fee) next business day.
4. Step 4: Confirmation email sent.

Why It Matters:

• Direct Debit: No third-party fees (unlike Khalti).
• Audit Trail: NEFT provides transaction records for tax purposes.

5. Challenges & Future Trends

Challenges in Nepal

1. Low Internet Penetration: Rural areas rely on USSD (e.g., Ncell Purse).
2. Fraud: Phishing scams target Khalti/Esewa users (e.g., fake "Rs. 1,000 bonus" emails).
3. Regulatory Gaps: Cryptocurrency is unregulated (Nepal Rastra Bank bans it).
4. High Fees: Third-party gateways charge 2–5% (e.g., Rs. 1,000 fee on a Rs. 20,000 Daraz order).

Future Trends

In the Real World

1. Daraz’s Checkout

   • Idea Used: Third-party payment gateway (Khalti/IPS).
   • How: When you buy a product, Daraz doesn’t store your card details—Khalti handles the transaction, reducing Daraz’s fraud risk. The 3% fee covers Khalti’s security and processing costs.

2. Pathao’s Ride Payments

   • Idea Used: Mobile money integration (Ncell Purse/Khalti).
   • How: Pathao partners with Khalti to let you pay without a card. If you’re low on cash, you can request a "Pay Later" option (postpaid via Khalti).

3. Nabil Bank’s Online Loan Portal

   • Idea Used: Direct bank transfer (NEFT/RTGS) + third-party (Khalti).
   • How: Borrowers can choose between instant Khalti payments (for small EMIs) or NEFT for bulk repayments. The bank earns from NEFT fees (Rs. 50–100 per transaction).

4. Nepal’s NFT Marketplaces (e.g., ArtNepal)

   • Idea Used: Cryptocurrency (Ethereum, Solana).
   • How: Artists sell digital art using MetaMask wallets. Buyers pay in crypto, and the platform converts to NPR via exchanges like Binance. Risk: No buyer protection if the platform shuts down.

5. Esewa’s "Esewa QR" for Small Shops

   • Idea Used: QR code payments + mobile money.
   • How: Local kirana shops display an Esewa QR. Customers scan it with their Khalti/Ncell Purse app to pay. Why it works: No need for a POS machine or internet—just a phone.

Exam Tip

How This Unit is Tested

1. Definitions & Classifications (20%)

   • Expect questions like:
     • "Differentiate between a payment gateway and a payment processor."
     • "Classify Khalti under the types of online payment systems."
   • Tip: Memorize the table above and the 4 models (direct, third-party, mobile, crypto).

2. Process Tracing (30%)

   • "Trace the flow of a Rs. 5,000 transaction from a buyer using Khalti to a seller on Daraz."
   • Tip: Draw the Mermaid flowchart from Step 1 above. Highlight security steps (TLS, 3DS).

3. Security & Fraud (25%)

   • "Explain how PCI-DSS prevents fraud in online payments."
   • "Suggest three measures to stop phishing attacks on Khalti users."
   • Tip: Link security to real examples:
     • "PCI-DSS Requirement 4 (encryption) is why Daraz’s checkout shows HTTPS."
     • "Ncell Purse uses USSD, which is harder to phish than mobile apps."

4. Case Studies (15%)

   • "How does Nabil Bank’s online loan repayment system reduce fraud?"
   • "Analyze why Pathao prefers Khalti over bank transfers for ride payments."
   • Tip: Use the Case Study 1 & 2 templates. Mention fees, speed, and security in your answer.

5. Short Answer (10%)

   • "List two advantages of mobile money over card payments in Nepal."
   • Tip: Use bullet points:
     • "No need for a bank account (e.g., Ncell Purse)."
     • "Lower fees than Khalti for small transactions."

Common Mistakes to Avoid

• Ignoring Fees: Always mention transaction fees (e.g., "Khalti charges 3% + Rs. 5").
• Overlooking Security: Exams love PCI-DSS, encryption, and fraud types—don’t skip them!
• Vague Examples: Instead of "banks use online payments," say "Nabil Bank’s loan portal uses NEFT for bulk repayments."
• Forgetting Nepal Context: Gateways like Khalti/Esewa are unique to Nepal—highlight them.

Quick Revision Checklist

Before the exam, verify you can: ✅ Draw the payment flow diagram (buyer → gateway → bank → merchant). ✅ List 4 types of payment systems with Nepali examples. ✅ Explain PCI-DSS and tokenization with a real-world link (e.g., Khalti). ✅ Describe one fraud type and its prevention (e.g., phishing → verify URLs). ✅ Compare NEFT vs. Khalti for a loan repayment scenario.