Rebate Card ExchangeDiscuss your requirements
Card programmesPlatformPayment servicesSecurityHow it worksInsightsDiscuss your requirements

Payment security

Security belongs in the payment flow, not in a claim.

Map where payment data appears, who can access each system and how incidents and disputes are handled before selecting controls or equipment.

A technology professional working beside secure infrastructure

This page describes security practices to evaluate. It does not state that Rebate Card Exchange holds a particular security certification, that every provider supports every control or that any control eliminates fraud, data compromise or chargebacks.

Payment security

Make exposure, controls and response ownership visible.

A security model starts with the real payment path and ends with evidence that accountable teams can operate.

  1. 01 / Exposure

    Payment environment

    • Data and credentials
    • Devices and applications
    • People and exception paths
  2. 02 / Control plane

    Applicable safeguards

    • Access and configuration
    • Encryption and channel controls
    • Maintenance and validation evidence
  3. 03A / Channel

    In-person payments

    Device, EMV, contactless and fallback requirements must be verified for the selected route.

  4. 03B / Channel

    Online and remote payments

    Provider-supported controls are matched to the customer journey and transaction profile.

  5. 04 / Responsibility

    Merchant and providers

    Each party owns only the controls, validation and response duties agreed for the solution.

  6. 05 / Evidence

    Incidents and disputes

    Access, transaction, fulfilment and response records support review and corrective action.

Illustrative security responsibility map, not a certification or guarantee. Applicable controls and validation duties are established by the merchant, qualified advisers and approved providers.

Security model

Reduce ambiguity before trying to reduce exposure.

A defensible design identifies payment channels, sensitive data, system owners and response duties. The approved provider documents then establish which controls apply and who validates them.

What is exposed
Payment data, credentials, devices, applications and supporting business records
Who owns the control
The merchant and each relevant provider within a documented responsibility model
What proves operation
Configuration, access, training, maintenance and incident evidence appropriate to the solution

Control considerations

Design security around the actual acceptance path.

Control names are not substitutes for scope. The merchant should verify the precise solution, configuration, responsibilities and validation evidence in provider documentation.

01

Payment-data and PCI DSS scope

Map where account data is entered, transmitted, displayed, stored or accessed, then confirm the merchant and provider responsibilities that follow.

  • Document every in-person, online and remote acceptance channel, including exception paths.
  • Confirm applicable PCI DSS responsibilities and any validation method with qualified advisers and the relevant providers.
02

P2PE and encryption

Point-to-point encryption requirements can be considered where payment data should be protected from the point of interaction through an approved decryption environment.

  • Only provider and standards-body documentation can establish whether a specific solution is a validated P2PE solution.
  • Confirm device, key-management, deployment, replacement and exception responsibilities for the selected configuration.
03

EMV and in-person acceptance

EMV-capable equipment can support chip or contactless payment flows when the device, software and acquirer configuration are approved together.

  • Verify device certification, supported acceptance modes, fallback handling and receipt behaviour.
  • Do not treat EMV as protection against every fraud type, operational error or dispute.
04

Online and remote-payment controls

Card-not-present workflows need controls proportionate to the channel, customer journey and transaction profile.

  • Assess address or security-code checks, authentication, tokenisation and risk tools only where the approved provider supports them.
  • Define how authorised staff handle remote payments without copying sensitive data into email, chat or unapproved notes.
05

Access and terminal operations

Every administrative account, device and support path should have an owner and a review process.

  • Plan role-based access, credential management, device inventory, software maintenance and staff changes.
  • Document inspection, replacement, support and escalation steps for terminals and integrated systems.
06

Chargeback and dispute practices

Good dispute operations connect clear customer communication with reliable transaction and fulfilment evidence.

  • Align billing descriptors, receipts, cancellation and refund terms, fulfilment records and customer-support ownership.
  • Define who reviews notices, gathers evidence and responds within the deadlines stated by the relevant provider.

Security review path

Move from exposure map to owned controls.

The objective is a reviewable responsibility model, not a generic checklist copied across every merchant environment.

  1. 01

    Map channels and data

    Trace payment data and credentials through devices, applications, people, providers and exception paths.

    OutputExposure map
  2. 02

    Identify applicable controls

    Match the environment to provider-supported controls, merchant obligations and relevant validation requirements.

    OutputControl requirements
  3. 03

    Assign responsibility

    Document ownership for access, equipment, maintenance, evidence, incidents, refunds and disputes.

    OutputResponsibility record
  4. 04

    Test operating readiness

    Review configuration, staff procedures, support contacts and response paths before accepting live payments.

    OutputReadiness decision

Security outcomes

Controls people can understand and operate.

Security is stronger when technology, merchant procedures and provider responsibilities describe the same payment flow.

01

A scoped acceptance environment

Payment channels, sensitive-data touchpoints and important exception paths are visible.

02

Owned control responsibilities

The merchant and relevant providers know which party configures, validates, monitors and responds.

03

A practical evidence path

Access, device, transaction, fulfilment and dispute records are planned around operational needs.

Common questions

Before the next step.

Is Rebate Card Exchange PCI DSS certified?

This website makes no certification claim for Rebate Card Exchange. The PCI DSS status, scope and responsibilities of each party should be verified in current evidence and the applicable provider and merchant documentation.

Does a P2PE solution remove every merchant responsibility?

No. Scope and responsibilities depend on the specific validated solution, its approved use and the rest of the merchant environment. The relevant provider documentation and qualified guidance should be followed.

Does EMV prevent fraud and chargebacks?

No single acceptance technology prevents every fraud type or dispute. EMV requirements should be combined with sound access, customer, refund, fulfilment and response practices.

Who handles a security incident or chargeback?

The merchant agreement and operating procedures should identify the responsible provider contacts and merchant roles. Those paths should be documented and tested before live acceptance.

Security discovery

Map the payment flow before choosing the control.

Tell us which channels, devices and systems are in scope. Do not send card data, credentials, vulnerability details or incident evidence through the public enquiry form.

Discuss payment security