Payment Security for Online Stores: PCI DSS, 3DS and Fraud

Ecommerce payment security comes down to a split of duties: your payment gateway protects the card data it handles, and you protect everything around it, from the checkout page to the admin login. The fastest way to cut risk is to keep raw card numbers away from your own servers, switch on 3D Secure, and run fraud checks before you ship.

Who is responsible for ecommerce payment security

Signing up with a gateway does not transfer all the risk. The gateway secures its own systems, but your acquiring bank still expects your side of the checkout to be secure. If a skimming script on your site captures card details before they reach the gateway, the gateway's certificates will not help you.

What the gateway usually handles

• Storing and transmitting card data inside its own certified environment.
• Hosting the payment page or the embedded payment fields, depending on the integration.
• Running the 3D Secure exchange with the card issuer.
• Issuing tokens so you can charge returning customers without holding their card numbers.

What the merchant still owns

• The security of the website that loads or redirects to the payment page.
• Every script, plugin and tag on the checkout pages.
• Admin accounts, passwords and multi factor authentication for the store and the gateway dashboard.
• Order review, refund rules and the decision to ship or hold a suspicious order.
• Annual PCI DSS validation, usually through a self assessment questionnaire your acquirer asks for.

In the UAE, payment service providers and card schemes are licensed under the Central Bank of the UAE's Retail Payment Services and Card Schemes Regulation. It governs providers, not your store, but explains why gateways here run website checks before going live. For help choosing a provider, see our guide to choosing a UAE payment gateway by business model.

PCI DSS compliance without the jargon

PCI DSS is the card industry's security standard for anyone who stores, processes or transmits card data; the current version is 4.0.1. Most online stores complete a Self Assessment Questionnaire (SAQ) that matches how their checkout is built.

The three SAQs most stores meet

The script rule that changed in 2025

Version 4.0 introduced two requirements aimed at payment page skimming: keeping an inventory and authorisation for every script on the payment page (requirement 6.4.3) and detecting unauthorised changes to it (requirement 11.6.1). For SAQ A merchants, the PCI Security Standards Council later replaced those two items with an eligibility condition: the merchant must confirm that its site is not susceptible to script attacks that could affect the payment. The Council explains how to meet this in an official FAQ. In practice, a store that embeds gateway fields still needs to control what scripts run on the checkout page.

3D Secure: what it does and what it costs you in conversion

3D Secure is the card scheme protocol that lets the issuing bank confirm the cardholder during an online purchase. The current version, EMV 3D Secure, sends richer data to the issuer, so many purchases are approved in the background: the frictionless flow. When the issuer sees higher risk, it triggers a challenge, such as a one time code or an approval in the banking app.

Why it matters to a merchant

• Fewer fraudulent payments. A stolen card number alone is not enough when the issuer asks for confirmation.
• Chargeback protection. Under card scheme rules, liability for certain fraud chargebacks can shift to the issuer on authenticated transactions. Confirm the exact rules for your scheme and transaction types with your gateway.

Keeping friction low

Pass the full set of data fields your gateway supports (billing address, email, phone, device information) so the issuer has enough to approve without a challenge. Test the challenge screen on mobile, because a challenge that breaks inside a small in app browser is a common reason for abandoned checkouts.

Tokenization and stored cards

Tokenization replaces the card number with a reference that is useless outside your gateway account. When a customer saves a card for next time, you hold the token, not the card. This keeps your systems out of the heaviest PCI DSS scope.

Two kinds of token are worth knowing. Gateway tokens are issued by your payment provider and work only with that provider. Network tokens are issued through the card schemes and can stay valid when the physical card is replaced, which helps subscription stores avoid failed renewals. Ask your gateway how tokens would move if you ever change provider.

Fraud prevention for ecommerce beyond the card check

Authentication confirms the cardholder; it does not confirm that the order makes sense. Fraud prevention in ecommerce is about the patterns around the payment.

Signals worth reviewing

• Billing and delivery addresses in different countries on a first order.
• Several cards tried on one account or device in a short time, a sign of card testing.
• Unusually large orders of resaleable items, such as electronics or gift cards.
• Requests to change the delivery address after payment.

Rules before machine learning

Start with clear rules in the gateway or store: velocity limits, blocked countries you do not ship to, and manual review above a set order value. Add the gateway's risk scoring once you have a few months of data to tune it.

Hypothetical example: a Dubai fashion store notices dozens of small failed payments overnight from one IP range. Adding a velocity rule (no more than three failed attempts per device per hour) and a CAPTCHA on checkout stops the card testing without touching normal shoppers.

PCI scope reduction checklist

Each item either keeps card data off your systems or protects the page that hands customers to the gateway.

1. Use a gateway hosted page or gateway iframe fields so card numbers never reach your server.
2. Never log, email or store full card numbers, including in support tickets or chat transcripts.
3. Keep a written list of every script on checkout pages and remove anything that is not needed there, such as chat widgets or heatmap tools.
4. Set a Content Security Policy so the browser loads scripts only from sources you approve.
5. Turn on multi factor authentication for the store admin, hosting panel and gateway dashboard.
6. Keep the platform, theme and plugins updated, and remove unused extensions.
7. Limit guest checkout data retention and delete old customer records you no longer need.
8. Use tokens for saved cards and recurring billing.
9. Enable 3D Secure and pass full data for frictionless approval.
10. Configure fraud rules and assign someone to review held orders daily.
11. Complete the SAQ your acquirer specifies and keep evidence for each answer.

Platform notes

Hosted platforms such as Shopify take on much of the server side work, but you still own apps, theme scripts and admin access. Self hosted platforms such as WooCommerce and Magento give you more control and more responsibility: hosting, updates, file integrity and backups sit with you or your developer. See our first online store planning guide and what the best UAE online stores do differently.

Customer data and UAE privacy rules

Card data is only part of the picture. Names, addresses and order history are personal data under the UAE Personal Data Protection Law (Federal Decree Law No. 45 of 2021), and stores operating from DIFC or ADGM follow their own data protection regimes instead. Collect what you need to fulfil orders, explain it in your privacy notice and restrict who can export customer lists. Confirm the details that apply to your business with legal counsel. The same applies to AI tools that read order data; see generative AI in online retail.

Get your checkout reviewed by the Codeeo team

Codeeo designs and builds ecommerce stores on Shopify, WooCommerce and headless stacks, and integrates UAE payment gateways with hosted or embedded checkout. With 200+ projects delivered across the UAE and the US and an office in Dubai, the team can review your current checkout setup, script inventory and gateway integration, then plan changes that reduce PCI scope. Start with our payment integration service, read about ecommerce website development in Dubai, or request a website audit. When you are ready to talk, contact Codeeo.