Ecommerce payment security: card data, PCI DSS, 3D Secure, and licensed payment institutions

The foundation of ecommerce payment security is ensuring card information never reaches the store’s own server and that payment is completed through a licensed provider’s infrastructure with 3D Secure authentication. Once this structure is established, the store chooses never to handle card data rather than protecting it; the most valuable information an attacker could steal is not present on the website. What remains is protecting the website itself, the administration panel, and customers’ personal data.

This article covers integration models that vary according to who hosts the payment form, what PCI DSS means for small stores, how 3D Secure works, how to check a payment institution’s license, and the data security obligations imposed by KVKK (Turkey’s Personal Data Protection Law). The information is based on the PCI Security Standards Council, EMVCo, the Central Bank of the Republic of Turkey, and the text of Law No. 6698.

What layers make up ecommerce payment security?

A secure payment process consists of complementary layers rather than a single product. A gap in any one weakens the protection provided by the others:

• Connection: the entire website opening over HTTPS
• Payment form: whether the area where card information is entered is hosted by the store or the payment institution
• Institution: the party receiving payment being a bank or a payment institution authorized by TCMB (the Central Bank of the Republic of Turkey)
• Standard: parties handling card data complying with PCI DSS requirements
• Authentication: the cardholder confirming their identity through 3D Secure
• Website and dashboard: protecting ecommerce software, plugins, and administrator accounts
• Personal data: processing names, addresses, phone numbers, and order history in compliance with KVKK

The connection layer is only the beginning of this list. HTTPS encrypts data carried between the browser and server; it does not prevent malicious code being added to the payment page, a weak administrator password, or an outdated plugin. An encrypted connection in the address bar is therefore a necessary but insufficient condition on its own; the main weight of payment security lies in the subsequent layers.

Card data should not be stored on the website: who hosts the payment form?

Card numbers, expiration dates, and security codes must never be written to the store’s database, order notes, emails, or logs under any circumstances. When card data is not stored, there is no card data to leak. Payment integrations are divided into three main models according to where card information is entered:

For small and medium-sized stores, the first two models are the simplest way to leave the security burden to a specialized institution. If card information is needed for recurring payments, it is stored in the payment institution’s card storage (tokenization) service rather than in the store; the store knows only a meaningless reference code corresponding to the card.

Identifying which model is used is not difficult. If the domain in the address bar changes to the payment institution during payment, the redirect model is in use. If the form appears on the store page, check which domain loads the card fields through the browser’s developer tools; if the fields come from the store’s own address, card data passes through the server, and this must be discussed with the provider.

What is PCI DSS, and does it cover a small store too?

PCI DSS is a set of technical and operational requirements established to protect payment card data and applies regardless of the store’s size. The standard is published by the PCI Security Standards Council, founded by Visa, Mastercard, American Express, Discover, and JCB; the current version family is 4.x. According to PCI SSC’s PCI DSS page , the standard applies to all parties storing, processing, or transmitting card data and those positioned to affect the security of that data.

The final phrase matters: even a website that leaves the payment form entirely to the provider can affect the process because it controls the link to the payment page or the code surrounding the embedded form. Outsourcing the payment service reduces the website’s burden without eliminating responsibility. PCI SSC also states that encryption alone does not take card data out of scope.

How compliance is validated varies according to the environment’s structure. Small businesses generally complete a self-assessment questionnaire (SAQ); according to the council, the merchant’s acquiring bank or payment institution informs it which questionnaire applies and whether validation is required. Getting this answer in writing when applying for a virtual POS prevents uncertainty later.