Articles on Security
PCI, tokenisation, encryption, and signed webhooks: what you must never store and how to protect every charge.
8 articles
AI risk models, mobile card personalization, and digital money according to the ECB
Plaid unveils AI tools to mitigate fraud and payment risk, Wells Fargo introduces debit card customization in its app, and the European Central Bank addresses tokenization.
Payment gateway API keys: least privilege, rotation, and leak response
Managing payment credentials requires separating environments, restricting privileges, and maintaining an immediate revocation and audit protocol for accidental leaks.
Card Tokenization: What Merchants Store and What They Don't
Learn what card tokens are, gateway vs network tokens, PCI DSS SAQ A requirements, and how Cifrago charges subscriptions without touching card numbers.
The hidden cost of failed payments: return fees, retries, and lost customers
When a recurring transaction fails or a customer disputes a charge, the problem goes far beyond unpaid invoices. Direct processing fees, operational overhead, and involuntary churn multiply the true financial impact.
Payment links: when they replace an online store and how to collect via direct channels
Payment links allow businesses to collect quotes and direct sales through WhatsApp or email without a web store, keeping full SCA and security standards.
Idempotency in payments: how to avoid double charges from retries and duplicate webhooks
Network hiccups or duplicate webhooks can trigger duplicate charges if systems lack idempotency protections. We review the mechanics and database patterns to prevent repeated billing.
Preauthorisations and deferred captures: how to hold an amount and charge it later without surprises
Separating card authorisation from final settlement is a standard practice in e-commerce. We analyse how preauthorisation works, validity windows, and how to avoid operational friction.
Payment security: what you must never store, and why webhooks are signed
Most online payment incidents don't come from a sophisticated attack, but from two design decisions: storing card data you never needed, and trusting whatever the customer's browser says.