Electronic Payment Systems Exercise Solutions | KalviGavani

UPI (Unified Payments Interface) is a real-time instant payment system developed by NPCI that enables inter-bank fund transfers through a mobile platform. It uses a Virtual Payment Address (VPA) like username@bank instead of bank account numbers.

How it works: 1. User creates a VPA linked to their bank account through a UPI app (e.g., Google Pay, PhonePe) 2. To pay, the user enters the recipient's VPA and amount 3. UPI authenticates using MPIN (Mobile Personal Identification Number) 4. The funds are transferred instantly between bank accounts

A payment gateway is a service that securely processes online payment transactions by encrypting sensitive data and acting as an intermediary between the customer, merchant, and bank.

Functions:

• Encrypts payment data (card number, CVV) for secure transmission
• Authenticates the customer's payment details with the issuing bank
• Authorises or declines the transaction
• Transfers funds from the customer's bank to the merchant's account
• Provides transaction status (success/failure) to both parties

Net banking (Internet banking) allows customers to access banking services through the bank's website using a username and password.

Services offered: 1. Fund transfer (NEFT, RTGS, IMPS) 2. Bill payments (electricity, water, gas, phone) 3. Account balance inquiry and statement download 4. Online shopping payments 5. Fixed deposit and recurring deposit creation 6. Loan applications and EMI payments

Encryption is the process of converting plain text data into a coded (cipher) form using a cryptographic key, so that only authorised parties with the decryption key can read it.

Role in e-payments:

• Protects sensitive data (card numbers, passwords, PINs) from interception during transmission
• Ensures confidentiality — even if data is intercepted, it cannot be read without the key
• SSL/TLS encryption (used in HTTPS) creates a secure tunnel between browser and server
• Two types: Symmetric (same key for encryption and decryption) and Asymmetric (public key for encryption, private key for decryption)

• Issued by banks; allows borrowing up to a credit limit
• Payment is made later; interest is charged if the full amount is not paid by the due date
• Examples: Visa, Mastercard, RuPay credit cards
• Advantages: Interest-free period (usually 45-50 days), reward points, cashback, EMI options
• Disadvantages: High interest on unpaid balances, risk of overspending, annual fees

• Linked directly to the user's bank account; money is deducted immediately
• No borrowing involved; the user spends only what is in the account
• Examples: Visa Debit, RuPay Debit, Mastercard Debit
• Advantages: No debt risk, no interest, widely accepted
• Disadvantages: Limited to account balance, less fraud protection than credit cards

• Access banking services through the bank's website using credentials
• Supports fund transfers (NEFT, RTGS, IMPS), bill payments, and more
• Advantages: No physical visit needed, 24/7 access, multiple services in one place
• Disadvantages: Requires internet, phishing risk, server downtime

• Software-based; stores payment details for quick transactions
• Examples: Paytm, PhonePe, Google Pay, Amazon Pay
• Advantages: Quick payments, no need to enter card details each time, offers and cashback
• Disadvantages: Requires KYC, limited balance (without KYC), dependency on smartphone

• Real-time instant payment system by NPCI
• Uses Virtual Payment Address (VPA) like name@bank
• Supports P2P and P2M transactions
• Advantages: Instant transfer, no need to share bank details, works 24/7, no transaction charges (for small amounts)
• Disadvantages: Requires smartphone and internet, transaction limits

• Banking services through a mobile app provided by the bank
• Includes fund transfers, bill payments, balance checks, and more
• Advantages: Convenient, real-time notifications, additional security (biometric login)
• Disadvantages: App-specific, requires compatible device

1. Customer places order — The customer selects products on the merchant's website and proceeds to checkout. 2. Order details sent — The merchant's website sends order details (amount, items) to the payment gateway. 3. Encryption — The payment gateway encrypts the transaction data using SSL/TLS and presents a secure payment page to the customer. 4. Customer enters payment details — The customer enters card number, CVV, expiry date, or chooses UPI/net banking on the secure payment page. 5. Payment gateway forwards to acquiring bank — The payment gateway securely sends the encrypted payment data to the acquiring bank (merchant's bank). 6. Acquiring bank contacts issuing bank — The acquiring bank routes the request through the card network (Visa/Mastercard/RuPay) to the issuing bank (customer's bank). 7. Authentication — The issuing bank authenticates the customer (OTP, PIN, or biometric) and checks for sufficient funds. 8. Authorisation response — The issuing bank approves or declines the transaction and sends the response back through the card network to the acquiring bank and then to the payment gateway. 9. Payment gateway informs merchant — The payment gateway sends the authorisation response to the merchant's website. 10. Order confirmation — The merchant confirms the order to the customer if the transaction is approved. The funds are settled to the merchant's account within 1-3 business days.

A digital signature is an electronic signature that uses public key cryptography to verify the authenticity and integrity of a digital message or document.

How it works: 1. The sender creates a message and generates a hash (a fixed-length digital fingerprint) of the message using a hash function. 2. The sender encrypts the hash using their private key — this encrypted hash is the digital signature. 3. The message and digital signature are sent to the recipient. 4. The recipient decrypts the digital signature using the sender's public key to obtain the original hash. 5. The recipient also generates a hash of the received message and compares it with the decrypted hash. 6. If both hashes match, the message is authentic and unaltered.

Security features:

• Authentication — verifies the sender's identity (only the sender has the private key)
• Integrity — ensures the message has not been altered in transit (hash mismatch reveals tampering)
• Non-repudiation — the sender cannot deny sending the message (private key is unique to sender)

Role in e-payments:

• Digital signatures are used in online banking, tax filing (e.g., ITR filing in India), and secure document exchange
• They ensure that payment instructions and financial documents are genuine and unaltered
• In India, digital signatures are governed by the IT Act 2000 and issued by licensed Certifying Authorities (e.g., eMudhra, Sify)

• SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) encrypt data transmitted between browser and server
• Websites using SSL display HTTPS in the URL and a padlock icon
• Ensures that sensitive data (card numbers, passwords) cannot be intercepted in transit

• Requires two forms of identification: something you know (password/PIN) and something you have (OTP on mobile)
• Mandated by RBI for online transactions in India
• Example: Enter card details + OTP sent to registered mobile

• Verify the authenticity and integrity of electronic documents and transactions
• Use public key cryptography; provide authentication, integrity, and non-repudiation

• Encrypts payment data before transmission
• Tokenisation — replaces sensitive card data with a unique token
• PCI-DSS compliance — payment gateways must meet Payment Card Industry Data Security Standards

• A network security system that monitors and controls incoming and outgoing network traffic
• Prevents unauthorised access to banking servers

• A unique password valid for a single transaction or short period
• Sent to the registered mobile number/email
• Prevents unauthorised use even if card details are compromised

• A 3-digit number on the back of credit/debit cards
• Required for online transactions to verify the card is physically with the holder