EMV & Card-Present Security
How PINs Stay Secret: PIN Blocks, PIN Pads, and End-to-End PIN Security
Your PIN is encrypted the instant you type it. How PIN pads, PIN blocks, and key hierarchies keep PINs secret from merchant…
Regulations & Standards
DORA and Payments: What EU Operational Resilience Rules Mean for Payment Firms
The EU's Digital Operational Resilience Act applies to payment institutions and their ICT providers. Its five pillars, and how it overlaps PCI…
E-commerce & Online Payments
Securing Payment APIs and Webhooks: Authentication, Idempotency, and Replay Defense
Practical security for payment APIs and webhooks — key handling, webhook signature verification, idempotency keys, replay protection, and rate limits.
Fraud Prevention
Measuring Fraud Prevention: The KPIs That Show Whether Your Program Works
Fraud rate alone hides more than it reveals. The KPIs — false positive rate, approval rate, chargeback rate — that show real…
Emerging Threats & Trends
When AI Agents Go Shopping: Payment Security for Agentic Commerce
AI agents are starting to browse, choose, and pay on users' behalf. The new authentication, authorization, and fraud questions agentic commerce raises.
Data Breaches & Incident Response
Inside a PFI Investigation: What Happens After a Suspected Card Data Breach
When card brands suspect a breach, a PCI Forensic Investigator may be mandated. What PFIs do, who pays, and how to prepare…
Tokenization & Encryption
Payment HSMs Explained: The Hardware Guarding Every PIN and Key
Payment HSMs generate, store, and use cryptographic keys inside tamper-resistant hardware. What they do, who needs one, and cloud alternatives.
PCI DSS Compliance
Network Segmentation Testing: Proving Your PCI Boundary Actually Holds
Segmentation only reduces PCI scope if you can prove it works. What segmentation penetration testing involves, who needs it, and how often.
Best Practices & How-To
Finding Hidden Card Data: A Practical Guide to Cardholder Data Discovery
Card numbers hide in logs, emails, call recordings, and spreadsheets. A practical data discovery process to find and eliminate them.
Mobile & Digital Wallets
SoftPOS Security: What Happens When a Phone Becomes the Payment Terminal
SoftPOS turns ordinary smartphones into contactless card readers. Here's how attestation, monitoring, and the PCI MPoC standard manage the risk.