Taking Payments Glossary · Payments

3-D Secure (3DS): the protocol by which an issuer authenticates a cardholder online (SCA & 3-D Secure).
3RI (3DS Requestor Initiated): a 3-D Secure authentication the merchant starts without the customer present, to refresh or extend an earlier one (SCA & 3-D Secure).
A2P 10DLC: carrier registration for business texting from ordinary 10-digit numbers (Phone Payments).
Account updater: a network service that refreshes stored card numbers and expiries when cards are reissued (Stored Cards & Recurring Billing).
ACS, Directory Server, 3DS Server: the issuer's authentication service, the network's routing service, and the merchant side's component in 3-D Secure (SCA & 3-D Secure; the ACS from the issuer's side in Issuer Processing).
AFA (additional factor of authentication): India's requirement, set by the Reserve Bank of India, for a second factor on digital payments (SCA & 3-D Secure).
APP fraud: authorized push payment fraud, where a payer is tricked into sending money themselves (Fraud & Risk).
Application: a request to become a merchant, with its own states and history, separate from the merchant account it creates (Merchant Onboarding); in receivables, a record of what a payment or credit paid for, allocating it to one or more invoices, with reversals as new negative applications (Checkout, Invoices & Payment Links).
Attempt: one try at a processor for a payment, with its own raw response; a payment can have several (How Card Payments Work).
Beneficial owner: an individual who owns 25% or more of a business, or the one person who controls it, identified under FinCEN's customer due diligence rule (Merchant Onboarding).
Business email compromise: fraud that redirects a payment by impersonating a vendor or executive (Vendor Payouts).
Card testing: scripted attempts to check stolen card numbers with small payments (Fraud & Risk).
CAVV: the authentication value from 3-D Secure, carried into the authorization as proof (SCA & 3-D Secure).
Chargeback (dispute): the issuer taking money back from the merchant on the cardholder's behalf (Disputes & Chargebacks).
CIP (Customer Identification Program): the US rule setting the minimum identity data a bank collects and verifies, by documents or non-documentary checks (Merchant Onboarding).
CIT, MIT: customer-initiated and merchant-initiated transactions; a saved card charged later is an MIT (Stored Cards & Recurring Billing).
Client secret: a value that lets one browser session confirm one payment, never stored or logged (Designing the Payments API).
Compelling Evidence 3.0, RDR, Order Insight, Ethoca: network services that prevent or resolve disputes before they count against the merchant (Disputes & Chargebacks).
Consortium data: fraud signals pooled across many merchants or institutions, such as a provider's view of one card across its whole network (Fraud & Risk).
Credit note: a numbered document that reduces a finalized invoice, by lowering its balance, refunding or crediting the customer, instead of editing it (Checkout, Invoices & Payment Links).
Cryptogram: a one-time value proving a token or chip card was used for this transaction (Card-Present Payments).
Delegated authentication: a merchant, wallet or provider authenticating the cardholder under an issuer's delegation instead of the issuer doing it (SCA & 3-D Secure).
DTMF masking: hiding the tones a caller keys on their phone so card digits never reach the agent or the recording (Phone Payments).
Dunning: the sequence of retries and customer messages after a recurring payment fails (Stored Cards & Recurring Billing).
ECM, HECM, EFM: Mastercard's Excessive Chargeback Merchant, High Excessive Chargeback Merchant and Excessive Fraud Merchant programs (Disputes & Chargebacks).
EDD, PEP: enhanced due diligence for higher-risk customers, and a politically exposed person, one of the triggers for it (Merchant Onboarding).
Exposure: the money a provider could lose if a merchant stopped paying: refunds, disputes and undelivered orders still able to come back (Merchant Onboarding).
Frictionless, challenge: a 3-D Secure authentication the cardholder never sees, and one where they're asked to prove who they are (SCA & 3-D Secure).
Friendly fraud: a cardholder disputing a charge they made (Disputes & Chargebacks).
High integrity risk MCC: a merchant code Visa monitors under its Integrity Risk Program, card-absent crypto sellers on 6051 and 6012 among them (Payments by Vertical).
Hosted payment page: a payment page served entirely by the provider and reached by redirect or link, keeping the merchant on SAQ A without the script criterion (Checkout, Invoices & Payment Links).
Idempotency key: a key the client sends with a write, so a retry replays the stored result instead of acting twice (Designing the Payments API).
Inquiry, pre-arbitration, arbitration: the issuer's request for transaction details before a dispute (a retrieval request), and the escalations after the merchant's evidence is rejected, ending with the network's own ruling (Disputes & Chargebacks).
IVR (interactive voice response): the automated phone menu that can take a payment without an agent (Phone Payments).
Liability shift: moving fraud loss from merchant to issuer, by chip in person or by 3-D Secure online (SCA & 3-D Secure, Card-Present Payments).
MATCH: Mastercard's list of merchants terminated for cause (Inside a Processor).
Merchant agreement: the contract a merchant signs to accept payments, part of it dictated by network rules, including the terms that become system behavior such as debiting the merchant's bank account (Merchant Onboarding).
MOTO: mail order and telephone order, a card-not-present payment taken by phone or mail (Phone Payments).
Net terms: an invoice due a set number of days after issue, such as net 30 (Checkout, Invoices & Payment Links).
Network risk score: a fraud score the network adds to an authorization for the issuer, such as Visa Advanced Authorization and Mastercard Decision Intelligence (Fraud & Risk).
Network token: a network-issued substitute for a PAN, scoped to a merchant or device and updated when the card changes (Stored Cards & Recurring Billing).
Network transaction ID: the identifier from a card's first stored-credential transaction, referenced by every later one (Stored Cards & Recurring Billing).
Payment intent: an object that lives across a whole payment and its steps, such as 3-D Secure; this volume's payments row (Designing the Payments API).
Payment link: a URL to a provider-hosted payment page, single-use or reusable, with a fixed, invoice-balance or payer-entered amount held on the server (Checkout, Invoices & Payment Links).
Publishable, restricted and secret keys: a key safe to put in a browser, a scoped server key, and an unrestricted server key (Designing the Payments API).
Quasi-cash transaction: the sale of something directly convertible to cash (money orders, foreign currency, gaming chips), processed as a purchase under its own MCC; crypto purchases share MCC 6051 (Payments by Vertical).
Representment: the merchant's evidence-backed response to a chargeback (Disputes & Chargebacks).
SCA (Strong Customer Authentication): the European requirement for two-factor authentication on most online payments (SCA & 3-D Secure).
TC40, SAFE: Visa's and Mastercard's issuer fraud reports, which count toward network ratios even without a dispute (Fraud & Risk).
Test clock: simulated time in a test environment, to run subscriptions and disputes forward (Designing the Payments API).
Thin event: an event that carries only the type and the object's ID, so the receiver fetches the current object (Designing the Payments API).
Transaction laundering: a merchant processing payments for a business it doesn't disclose (Fraud & Risk).
Trusted beneficiary: a merchant a cardholder has added to a list held by their issuer, so the issuer can exempt later payments to it from SCA (SCA & 3-D Secure).
UMR, creditor identifier: a SEPA mandate's unique mandate reference and the payee's scheme identifier, carried on every collection (Payments in the EU & UK).
Unblending: pricing each card brand and category separately rather than as one rate, which the IFR requires acquirers to offer (Payments in the EU & UK).
VAMP: Visa's acquirer monitoring program, combining fraud reports and disputes into one ratio (Disputes & Chargebacks).
Virtual terminal: a provider web form where staff key in card details one transaction at a time, validated under SAQ C-VT (Checkout, Invoices & Payment Links).
Visa decline categories, merchant advice codes: Visa's grouping of declines by whether a retry may succeed, and Mastercard's codes telling the merchant whether and when to retry (Stored Cards & Recurring Billing).
Webhook, event: a provider's record that something happened to an object, and its delivery by HTTP to the receiver's endpoint, at least once and sometimes out of order (Designing the Payments API).

3-D Secure (3DS): the protocol by which an issuer authenticates a cardholder online (SCA & 3-D Secure).
3RI (3DS Requestor Initiated): a 3-D Secure authentication the merchant starts without the customer present, to refresh or extend an earlier one (SCA & 3-D Secure).
A2P 10DLC: carrier registration for business texting from ordinary 10-digit numbers (Phone Payments).
Account updater: a network service that refreshes stored card numbers and expiries when cards are reissued (Stored Cards & Recurring Billing).
ACS, Directory Server, 3DS Server: the issuer's authentication service, the network's routing service, and the merchant side's component in 3-D Secure (SCA & 3-D Secure; the ACS from the issuer's side in Issuer Processing).
AFA (additional factor of authentication): India's requirement, set by the Reserve Bank of India, for a second factor on digital payments (SCA & 3-D Secure).
APP fraud: authorized push payment fraud, where a payer is tricked into sending money themselves (Fraud & Risk).
Application: a request to become a merchant, with its own states and history, separate from the merchant account it creates (Merchant Onboarding); in receivables, a record of what a payment or credit paid for, allocating it to one or more invoices, with reversals as new negative applications (Checkout, Invoices & Payment Links).
Attempt: one try at a processor for a payment, with its own raw response; a payment can have several (How Card Payments Work).
Beneficial owner: an individual who owns 25% or more of a business, or the one person who controls it, identified under FinCEN's customer due diligence rule (Merchant Onboarding).
Business email compromise: fraud that redirects a payment by impersonating a vendor or executive (Vendor Payouts).
Card testing: scripted attempts to check stolen card numbers with small payments (Fraud & Risk).
CAVV: the authentication value from 3-D Secure, carried into the authorization as proof (SCA & 3-D Secure).
Chargeback (dispute): the issuer taking money back from the merchant on the cardholder's behalf (Disputes & Chargebacks).
CIP (Customer Identification Program): the US rule setting the minimum identity data a bank collects and verifies, by documents or non-documentary checks (Merchant Onboarding).
CIT, MIT: customer-initiated and merchant-initiated transactions; a saved card charged later is an MIT (Stored Cards & Recurring Billing).
Client secret: a value that lets one browser session confirm one payment, never stored or logged (Designing the Payments API).
Compelling Evidence 3.0, RDR, Order Insight, Ethoca: network services that prevent or resolve disputes before they count against the merchant (Disputes & Chargebacks).
Consortium data: fraud signals pooled across many merchants or institutions, such as a provider's view of one card across its whole network (Fraud & Risk).
Credit note: a numbered document that reduces a finalized invoice, by lowering its balance, refunding or crediting the customer, instead of editing it (Checkout, Invoices & Payment Links).
Cryptogram: a one-time value proving a token or chip card was used for this transaction (Card-Present Payments).
Delegated authentication: a merchant, wallet or provider authenticating the cardholder under an issuer's delegation instead of the issuer doing it (SCA & 3-D Secure).
DTMF masking: hiding the tones a caller keys on their phone so card digits never reach the agent or the recording (Phone Payments).
Dunning: the sequence of retries and customer messages after a recurring payment fails (Stored Cards & Recurring Billing).
ECM, HECM, EFM: Mastercard's Excessive Chargeback Merchant, High Excessive Chargeback Merchant and Excessive Fraud Merchant programs (Disputes & Chargebacks).
EDD, PEP: enhanced due diligence for higher-risk customers, and a politically exposed person, one of the triggers for it (Merchant Onboarding).
Exposure: the money a provider could lose if a merchant stopped paying: refunds, disputes and undelivered orders still able to come back (Merchant Onboarding).
Frictionless, challenge: a 3-D Secure authentication the cardholder never sees, and one where they're asked to prove who they are (SCA & 3-D Secure).
Friendly fraud: a cardholder disputing a charge they made (Disputes & Chargebacks).
High integrity risk MCC: a merchant code Visa monitors under its Integrity Risk Program, card-absent crypto sellers on 6051 and 6012 among them (Payments by Vertical).
Hosted payment page: a payment page served entirely by the provider and reached by redirect or link, keeping the merchant on SAQ A without the script criterion (Checkout, Invoices & Payment Links).
Idempotency key: a key the client sends with a write, so a retry replays the stored result instead of acting twice (Designing the Payments API).
Inquiry, pre-arbitration, arbitration: the issuer's request for transaction details before a dispute (a retrieval request), and the escalations after the merchant's evidence is rejected, ending with the network's own ruling (Disputes & Chargebacks).
IVR (interactive voice response): the automated phone menu that can take a payment without an agent (Phone Payments).
Liability shift: moving fraud loss from merchant to issuer, by chip in person or by 3-D Secure online (SCA & 3-D Secure, Card-Present Payments).
MATCH: Mastercard's list of merchants terminated for cause (Inside a Processor).
Merchant agreement: the contract a merchant signs to accept payments, part of it dictated by network rules, including the terms that become system behavior such as debiting the merchant's bank account (Merchant Onboarding).
MOTO: mail order and telephone order, a card-not-present payment taken by phone or mail (Phone Payments).
Net terms: an invoice due a set number of days after issue, such as net 30 (Checkout, Invoices & Payment Links).
Network risk score: a fraud score the network adds to an authorization for the issuer, such as Visa Advanced Authorization and Mastercard Decision Intelligence (Fraud & Risk).
Network token: a network-issued substitute for a PAN, scoped to a merchant or device and updated when the card changes (Stored Cards & Recurring Billing).
Network transaction ID: the identifier from a card's first stored-credential transaction, referenced by every later one (Stored Cards & Recurring Billing).
Payment intent: an object that lives across a whole payment and its steps, such as 3-D Secure; this volume's payments row (Designing the Payments API).
Payment link: a URL to a provider-hosted payment page, single-use or reusable, with a fixed, invoice-balance or payer-entered amount held on the server (Checkout, Invoices & Payment Links).
Publishable, restricted and secret keys: a key safe to put in a browser, a scoped server key, and an unrestricted server key (Designing the Payments API).
Quasi-cash transaction: the sale of something directly convertible to cash (money orders, foreign currency, gaming chips), processed as a purchase under its own MCC; crypto purchases share MCC 6051 (Payments by Vertical).
Representment: the merchant's evidence-backed response to a chargeback (Disputes & Chargebacks).
SCA (Strong Customer Authentication): the European requirement for two-factor authentication on most online payments (SCA & 3-D Secure).
TC40, SAFE: Visa's and Mastercard's issuer fraud reports, which count toward network ratios even without a dispute (Fraud & Risk).
Test clock: simulated time in a test environment, to run subscriptions and disputes forward (Designing the Payments API).
Thin event: an event that carries only the type and the object's ID, so the receiver fetches the current object (Designing the Payments API).
Transaction laundering: a merchant processing payments for a business it doesn't disclose (Fraud & Risk).
Trusted beneficiary: a merchant a cardholder has added to a list held by their issuer, so the issuer can exempt later payments to it from SCA (SCA & 3-D Secure).
UMR, creditor identifier: a SEPA mandate's unique mandate reference and the payee's scheme identifier, carried on every collection (Payments in the EU & UK).
Unblending: pricing each card brand and category separately rather than as one rate, which the IFR requires acquirers to offer (Payments in the EU & UK).
VAMP: Visa's acquirer monitoring program, combining fraud reports and disputes into one ratio (Disputes & Chargebacks).
Virtual terminal: a provider web form where staff key in card details one transaction at a time, validated under SAQ C-VT (Checkout, Invoices & Payment Links).
Visa decline categories, merchant advice codes: Visa's grouping of declines by whether a retry may succeed, and Mastercard's codes telling the merchant whether and when to retry (Stored Cards & Recurring Billing).
Webhook, event: a provider's record that something happened to an object, and its delivery by HTTP to the receiver's endpoint, at least once and sometimes out of order (Designing the Payments API).