Payment
6/6/2025
5 minutes
Best practices for securing your customers' payment data and your e-commerce site
In 2024, the cybersecurity landscape grew darker: personal data breaches reported to the CNIL surged by more than 20%.
This figure reveals the scale of current digital vulnerability. Cyberattacks make headlines every day. As recently as May 2025, a global data leak exposed over 2.3 million bank cards. It follows leaks involving millions of customers from French brands in the luxury, telecommunications, banking, e-commerce, and government sectors. Personal and banking information then ends up on the dark web, where it is used to trap individuals, steal their identities, and misappropriate their funds.
For e-retailers, this reality is all the more critical as they handle sensitive payment data on a daily basis. Samuel Delplace, our Head of Infrastructure & Security, identifies the primary attack vector: the vulnerability of accounts and passwords.
For the past two years, the majority of intrusions have stemmed from compromised accounts due to passwords that were too weak or reused across multiple sites, both in professional and personal environments. Email and password pairs are stolen and traded within hacker communities. A single leak is enough for these credentials to be tested en masse elsewhere, until they find a site or a major brand's subcontractor where they can be used to extract data in bulk.
Faced with this reality, how can e-retailers strengthen their security while preserving the user experience?
This article presents the levers you can implement, inspired by regulatory requirements and operational best practices.
1) Secure your customers' account access
The principle of defense: just like protecting a house, the harder you make access, the more an attacker will favor an easier target. If every web player strengthens their security requirements, we collectively create a deterrent effect.
Tip #1: deploy social login
This feature allows users to sign up and log in via their Facebook, Google, or Apple ID accounts, eliminating the need for a site-specific password while providing a relatively quick connection.
This approach has the advantage of delegating authentication to already secure platforms, reducing the risk of phishing, and sparing your customers from having to remember yet another password.
Tip #2: enforce a strict password policy
Whether for creating or renewing passwords, you can follow the recommendations from ANSSI :
- Minimum length of 12 characters.
- A combination of uppercase letters, lowercase letters, numbers, and special characters.
- Renew at least once a year and whenever a compromise is suspected.
It may seem obvious, but did you know that in France, the most commonly used passwords remain "123456", "123456789", and "azerty"?
Tip #3: Offer multi-factor authentication (MFA)
Two-factor authentication remains the most effective method today for countering attacks involving compromised accounts. Even if an attacker has the correct credentials, they will not be able to access the account without the second factor (usually the user's smartphone).
Recommended options:
- Push notifications on smartphones.
- Authenticator apps (Google Authenticator, Authy).
- Passkeys: the new generation of passwordless authentication.
Tip #4: Proactively monitor data breaches.
Take preventive action with your customers by detecting compromised passwords. Then, alert them as quickly as possible and recommend that they change their password.
You can use security technology solutions like ReachFive to ensure this protective monitoring is continuous.
2) Best practices in the payment industry: PCI-DSS certification
Understanding the PCI-DSS standard
The Payment Card Industry Data Security Standard is the international benchmark for all professionals involved in the entry, transfer, processing, and storage of card payment data. The goal of this standard is to ensure the highest level of security and to protect users' card data.
Your obligations as a merchant
A fundamental rule applies to e-commerce sites: never store payment data. Never. Ever.
It is your responsibility to ensure that data is entered, transferred, processed, and stored in a secure, certified environment. The most effective strategy is to entrust this to a PCI-DSS Level 1 certified payment service provider (PSP) or payment orchestrator. You could implement a certified environment yourself, but it would be exceptionally difficult and costly.
As a merchant, you must be able to demonstrate to your acquiring bank that you meet the necessary requirements (the level of compliance depends on your transaction volume).
As the CIO of an e-commerce site, you generally need to:
- Verify the PCI DSS certifications of your payment providers annually.
- Ensure that the payment page is managed by the PSP or orchestrator, either via a payment widget or a redirect page.
- Complete the Self-Assessment Questionnaire (SAQ) that corresponds to your profile.
- Perform quarterly ASV vulnerability scans.
Risks of non-compliance
Failure to comply with PCI-DSS requirements exposes your company to:
- Fines imposed by Visa and Mastercard.
- Liability issues in the event of an incident, which could lead to a ban on processing Visa and Mastercard payments.
- A loss of customer trust.
To learn more about the standard and the security requirements for your profile, you can visit the official website.
Choosing a trusted technology partner like Purse ensures you check all the boxes.
3) Secure your internal environment
Your teams, subcontractors, and systems are prime targets for hackers.
Internal teams are often the weak link exploited by cybercriminals. For them, it is a gateway into a system rich in user data.
Unlike with customers, the stakes here go beyond user experience: it is about protecting your system, your revenue, and your reputation.
Tip #1: Strong authentication for all employees.
Implementing a strong authentication system for employees is, in our view, essential and a best practice that we highly recommend. It should be applied across all your internal tools as well as for accessing your subcontractors' systems.
Users in your organization who log in to the Purse merchant admin portal are required to authenticate using an MFA system to ensure secure access to your data.
Tip #2: Reduce the attack surface
The advice may seem obvious, but in practice, it is not implemented as often as it should be. The fewer entry points you leave for cyber hackers, the harder you make it for them to gain access, and ultimately, the lower the risk.
Regularly auditing your system to identify anything potentially exposed will allow you to implement a policy tailored to each network flow:
- Encrypt all traffic via HTTPS.
- Adopt a least-privilege access policy.
- Close unnecessary ports and services.
Tip #3: Detect vulnerabilities
Establish a structured process:
- Systematic identification of vulnerabilities.
- Classification by criticality level (low/medium/high/critical).
- Prioritized remediation of critical and high-level vulnerabilities.
- Regular monitoring and reporting.
Tip #4: Regularly test your security.
We recommend having your cybersecurity tested regularly by specialized providers:
- Monthly external vulnerability scans (e.g., Qualys-type solutions).
- Perform penetration tests at least once a year or after every major change.
Tip #5: Develop secure applications
Integrate security into your development process from the design phase:
- Ongoing training for technical teams on secure development.
- Use vulnerability detection tools for source code, open-source libraries, and your containers.
- Automate these security tests within your deployment process using your CI/CD pipeline, such as GitHub or GitLab.
Tip #6: Back up your data and test your backups regularly
- Implement a data backup policy.
- Perform a data restoration test at least once a year.
"Securing customer data, especially payment data, can no longer be viewed as just a regulatory obligation. It is a promise of trust made to users. At ReachFive, we have made this promise a technological pillar: passwordless login, strong authentication, granular consent management... These are all levers that significantly reduce attack surfaces and enhance the user experience."
— Jérémy Dallois, Founder and CEO of ReachFive
Conclusion: Delegate to better protect
Securing payment data relies primarily on choosing a certified provider to whom you delegate this critical responsibility. Your role is to create a secure environment around this delegation.
As a payment orchestrator and security specialist, Purse is committed every day to ensuring the highest level of security for its clients and their users. We can support you in implementing these best practices and advise you on the tools best suited to your needs.
Feel free to reach out to us to effectively secure your e-commerce business while optimizing your customers' experience.
Checklist: Assess your security level
🔐 Customer security
- Social login offered (Google, Facebook, Apple) /1
- Strict password policy enforced /1
- MFA available for customer accounts /1
- Compromised password monitoring active /1
🏆 PCI DSS Compliance
- PCI DSS Level 1 certified PSP selected /1
- No payment data stored on your servers /1
- Payment page fully managed by the PSP /1
- SAQ completed and certificate of compliance up to date /1
🛡️ Internal Security
- MFA mandatory for all administrator access /1
- Principle of least privilege applied /1
- Monthly vulnerability scans scheduled /1
- Annual penetration tests scheduled /1
- Backups tested regularly /1
Security score: ___/13
Less than 8/13? It is time to strengthen your security. Purse can support you in this process.
Sources
