Payment security: 3d secure, PCI and keeping card data out of your app

How do you make payments in your app secure?

To make payments in your app secure, apply three rules before anything else. First, never let the card number pass through your server; let the gateway collect it on its page or in hosted fields and give you a token instead. Second, turn on 3D Secure so the customer's bank confirms they own the card. Third, confirm every transaction server-side through a signed notification from the gateway, using an amount you calculated, not the browser.

These rules protect you from the most common risks: leaked card data, fraudulent purchases with stolen cards, price tampering from the browser, and orders confirmed without real payment. The good news is that they do not need a security team; they need the right choices when you integrate.

This matters even more if your app was built with AI, because code can look correct while hiding a flaw in the payment logic. See also is AI-generated code secure?.

The best way to protect card data is never to touch it.

What is 3d secure and how does it work?

3D Secure is an extra verification layer in which the customer's bank confirms that they own the card. You know it as a code sent by text message, or an approval request in the banking app during checkout. Its brand name varies by card network, but the idea is the same: the issuing bank takes part in the decision.

The modern version (3DS2) is smarter than the old one. The gateway sends the bank information about the transaction and the device, and the bank chooses one of two paths:

The benefit to you as a merchant is twofold: less fraud, and in many cases liability for fraud-related disputes shifts to the issuing bank when a transaction was successfully authenticated. The detailed rules are set by the card networks and your gateway, so ask your gateway about them.

What is PCI DSS and when does it apply to you?

PCI DSS is a global security standard set by the Payment Card Industry Security Standards Council, and it applies to anyone who accepts, processes or stores card data. The good news: how much of it you must carry depends largely on how you integrate with your gateway.

How do you keep card data out of your app?

1. 1
   Choose a hosted payment form

   Use the gateway's ready checkout page or its hosted fields. The look is usually customizable, and the numbers go straight to the gateway.

2. 2
   Save the token, not the card

   For one-click payments or subscriptions, ask the gateway to save the card and store only the token, the last four digits and the card brand.

3. 3
   Turn on 3D Secure

   Keep it on for all card transactions unless your gateway advises otherwise for a specific case.

4. 4
   Clean your logs

   Make sure tracking and analytics tools cannot read payment fields, and server logs hold no sensitive data.

5. 5
   Close the side doors

   No contact forms that accept card numbers, and no manual phone payments by reading out the number without a dedicated system.

In Fanann, payments connect through licensed gateways via the payments page, so the gateway collects card data and your app receives only the result. For hosting and controls, see the trust and security page.

Payment logic flaws that have nothing to do with cards

Even if you never touch a card, the payment logic itself can be exploited. These are mistakes we see often in quickly built apps:

• Price from the browser: if the browser sends the amount to the server, it can be edited. Always calculate the amount on the server from items, quantities and coupons.
• Confirmation from the success page: anyone who opens the success URL manually might get a confirmed order. Rely on the gateway webhook.
• Unverified webhooks: verify every notification's signature or query the transaction with the gateway, or anyone can send a fake notification.
• Duplicate processing: the gateway may send a notification more than once. Process each transaction only once by its id.
• Exposed keys: the gateway's secret key belongs in server settings, not in frontend code or a GitHub repository.
• Card testing: fraudsters try hundreds of stolen cards with small amounts. Limit attempts and add verification on suspicious activity.

For protecting keys, read API keys and secrets; for fraud and OTP abuse, read stop fake sign-ups and order fraud.

Protect what surrounds payments: accounts, servers and data

1. Two-factor authentication on your gateway account, app admin panel, hosting account and email.
2. Limited permissions: a support agent can view orders but cannot issue a large refund without approval.
3. HTTPS everywhere with a valid SSL certificate, not just on the checkout page.
4. An audit log for every refund, price change or payment setting change: who did what, and when.
5. Backups of your orders database, with tested restores.
6. Personal data: customer names, phone numbers and addresses fall under data-protection laws such as Saudi Arabia's PDPL and the UAE's PDPL.

Payment security checklist and a ready review prompt

• Card data is collected only on the gateway's page or hosted fields.
• No card number or CVV exists in your database or logs.
• 3D Secure is on and tested on mobile.
• The amount is calculated on the server, and orders are confirmed by a signed notification.
• Each notification is processed only once.
• Secret keys live in server settings, and two-factor authentication is on for every account.
• There is a limit on payment attempts per device or account.

After this review, go through the security checklist for AI-built apps to cover the rest of the app.

Frequently asked questions

Terms in this article