A Review on Electronic Payments Security

Abstract

Modern technology is turning into an essential element in the financial trade. We focus the emphasis of this review on the research on the E-wallet and online payment, which is an element of an electric payment system, to get the pattern of using this service. This research presents a review of 131 research articles published on electronic payment between 2010 and 2020 that uses a qualitative method of answering the research questions (RQ): RQ1: “What are the major security issues regarding using electronic payments”? and RQ2: “What security properties need to comply for secure electronic payments?” With the systematic literature review approach, the results show that interest in E-wallet and online payment has grown significantly during this period, and it was found that for the increasing uses of electronic payments, researchers are more focused on security issues. The results show that, to conquer the key gaps, electronic payment must have some protection properties, namely, availability, authorization, integrity, non-repudiation, authentication, and confidentiality. Nowadays, security problems in electronic payment are usually more demanding than the present security problems on the web. These findings can enable electric transaction providers to strengthen their security methods by boosting their security gaps, as required for relevant services.

1. Introduction

The electronic payment system has continued to grow more and more over the last years because of the increasing spread of internet-based banking and shopping. Electronic transfers are money transactions that take place electronically between consumers and retailers. Millions of users around the world regularly make various payments via the Internet. These exchange materials are a kind of electronic monetary instrument. Electronic payment systems have gained tremendous interest over the last two decades because of the vital role they play in contemporary electronic commerce. According to the Statista Fintech report, in 2019, the total amount of transactions in the digital payment segment was estimated at 3,670,864 million euros, and by 2023, it is estimated to increase to 5,921,831 million euros [1]. An electronic payment system is a means of paying through an e-network [2], where an individual may pay for products and services online [2,3]. There are quite a few e-payment systems that have been established in the payment sector around the world, and in References [2,4,5], the authors classified electronic payment systems into various categories, namely e-cash, e-wallet, online payment, card-based, etc. In this study, we dedicate the focus of the research to the e-wallet and online payment system that is part of an electronic payment method in order to understand the trend of using this system. E-wallet is a tool that has actually additionally been acknowledged as a digital wallet [3]. E-wallet is a program for computer banking [6] that can collect your identity and digital credentials and offers an electronic or online service that allows an individual to purchase electronically [7,8]. Payment with an e-wallet is considered as one of the most famous transaction approaches at present because a digital purchase utilizing an e-wallet has the advantages of simplicity and adaptability, as well as protection [4,5].

On the other hand, the online transaction system is an internet-based technique of processing monetary transactions that are accepted day by day. Online payment is an electronic way of exchanging payment that enables a customer to pay an online dealer or service provider [6]. Security issues in electronic payments are more challenging today than the other current security issues on the Internet. In electronic payments, customers must deliver credit card and payment account details [9] and personal information [10], and this Internet transfer is a tool that can be used to steal money [11]. In recent years, several studies have contributed to the multiple protection issues in the area of electronic payments [7,8,9,10], where, because of electronic payment, customers need to feel protected regarding their personal privacy concerns [11,12]. The aim of this analysis is to research the literature on e-wallet and online payment systems. We investigate different studies providing different backgrounds for study and their relationships. The following research questions (RQ) are specified: RQ1: “What are the major issues regarding using electronic payments”? and RQ2: “What security properties need to comply for secure electronic payments?”

This paper provides a selection of fascinating queries regarding interlocking in between different threats of online and e-wallet transactions, looking at potential security measures. This paper is structured as follows. Section 2 outlines the study methodology, Section 3 presents the reviewed papers based on research results, and Section 4 presents a discussion of the findings and the conclusions.

2. Materials and Methods

This research relies on a systematic review technique, which is a dignified procedure to test and understand available research that is associated with a specific research question. There are three key phases of systematic review: preparation of the review, leading the review, and reporting the review. The core of the plan is to design research questions and improve a review protocol, with the most significant part of the systematic review being the review protocol.

2.1. Review Protocol

The review protocol sets out the techniques to be used in the review. This research developed a review protocol in the preparation phase. We specified the background and the research question in the Introduction Section. We have taken only full papers from journals and conferences released between 2010 and 2020 in English into consideration. Studies that are not connected to the e-wallet and online payment system were excluded. When many duplicated reports have been shown to be accessible in original formats, we only used the fullest edition of the report. The principal components of the review protocol include data sources, collection strategy, study selection strategy, data extraction method, and the synthesis of results.

2.1.1. Data Sources

Research papers that were associated with the subject were selected to help answer the research questions. We rejected irrelevant research papers that could not answer or even support the research questions. We made use of the following libraries as our primary resources, looking for research publications in:

• Science Direct (www.sciencedirect.com)
• Institute of Electrical and Electronics Engineers (IEEE) Xplore Digital Library (ieeexplore.ieee.org)
• Association for Computing Machinery (ACM) Digital Library (dl.acm.org)
• Springer Link (link.springer.com)
• Taylor and Francis (www.taylorandfrancisgroup.com)
• MDPI (www.mdpi.com)
• GrowingScience (www.GrowingScience.com/msl)
• Academia (https://www.academia.edu)
• Google schoolar (www.scholar.google.com)
• Atlantis Press (www. https://www.atlantis-press.com)

2.1.2. Search Process

According to the research method, to find any queries that are focused on e-wallet and online payment systems, we searched using a keyword pattern. Boolean operators were used to clarify the data on keywords and they were also a priority in searching the database for each research publication. We used symbols and Boolean operators such as “OR”, “AND” to check for the following keywords:

• (electronic payment OR (E-payment) OR (electronic AND transaction) OR (digital AND wallet)) AND (study OR Adoption) AND ((framework AND payment) OR (digital AND payment))
• ((online AND payments) OR (internet AND payment)) AND (security OR issue) AND (e-banking OR online banking) AND ((mobile payments AND transaction) OR (internet AND payment))
• ((e-commerce AND payments) OR (mobile-transaction AND m-banking)) AND (security OR concern)

2.2. Data Selection

Data selection is the most important thing for a systematic review of any existing research review, and a number of items were unrelated to our research questions. After getting the results of the keywords used, we completed three filter procedures to include the criteria for the search. The criteria are identified in the first phase of the filter. We categorized all research findings from these keywords into research publications. Then, the next step to be completed is a second filter that looks at the title and reads the abstract as it relates to the research question. The third or final filter is to read any material of a study paper taken from the candidate studies, and the last group of research papers to be used is named “Selected studies”. The data selection criteria were as follows:

• Was the research article published between the years 2010 and 2020?
• Is the research article reported in any of the referred data sources?
• Is the research article mentioning or discussing e-wallet or online payment systems?
• Is the research article discussing any security, study or adoption regarding e-wallet, mobile payment, and online payment system?

2.3. Data Extraction

We analyzed each preliminary study to identify the Electronic Payment System (EPS), e-wallet, and research related to online banking. We documented all identified studies in a spreadsheet based on their name, description, and reasoning. We performed the search process in April 2020, at which time we identified 316 publications. By following the selection and refusal criterion, relevant research articles were carefully extracted as per the search process shown in Figure 1. Finally, 131 studies were identified as preliminary studies.

Table 1. Papers extracted for the selected primary study.

Sources	Found	Candidate	Elected
IEEE Xplore	60	35	20
ACM Digital Library	20	14	2
Springer Link	19	12	10
Taylor & Francis	9	8	2
Academia	14	9	3
Google schoolar	96	70	55
Research Gate	47	24	22
Science Direct	9	7	6
Atlantis Press	5	3	1
MDPI	19	15	8
GrowingScience	8	4	1
Internet Sources	10	7	1
Total	316	208	131

below displays the data extraction and synthesis of the chosen study articles to find the answers to the research questions and the 131 studies’ classification. We rejected insignificant research articles which did not address our research questions or endorse them. The articles were rejected because the main topics did not concern E-wallet and online payment systems. Most of them disscued other electronic payment systems, such as credit/debit cards or smart cards, and were also unable to answer the research questions.

3. Result and Discussion

3.1. List of Paper Publications

This study contains two publishing formats, namely J: journal and C: proceeding/conference. From the 131 research articles, 103 research articles were from a journal, and 27 research articles were from a proceeding/conference. The details of the publication, paper title, year, and journal name are shown in Appendix A.

3.2. Number of Papers Based on Country

From the 131 research articles, there are 39 countries contributing to electronic payment system research. We found that the country contributing the most papers among those we found for this area of study was India, with 33 papers. The second highest number of papers was from Malaysia, with 20 papers. China was third highest with 8 papers, and fourth was Nigeria, with 6 papers. The number of papers based on country is shown in Figure 2. India has seen an extraordinary rise of E-wallet users. The country is gradually moving towards becoming a cashless economy, and as is recognized, after demonetization, there is a remarkable rise in the number of e-payments. After analyzing the pros and cons of demonetization, and also focusing on awareness of the general public, numerous businesses have introduced E-wallets, with various terms and conditions to gain competitive advantages. In the year after demonetization, digital transactions evolved considerably. In particular, Malaysia and Nigeria have also taken the development of cashless societies seriously.

3.3. Number of Standard Institutions

The importance of information security is at the forefront of electronic payment systems. Unfortunately, there is no single source that can guarantee 100% data protection in information technology. In relation to electronic payment, security is the most important factor that can influence a consumer to use the system. This section discusses three standard institutions (European Telecommunications Standards Institute (ETSI), Payment Card Industry Data Security Standard (PCI-DSS), and European Network and Information Security Agency (Enisa)) who work for secure electronic transactions, and enables us to provide an answer to RQ2. Standards have become the crucial enabler of market-driven innovation. It plays an important part in minimizing the danger regarding payment transactions, and in the development of private and public businesses if it is able to offer protected electronic payment services. Since data protection plays a crucial part in supporting the economic organization operations, we want a standard, or benchmark, which governs the shelter of information security. It can be said that for security electronic payment, this is a multidisciplinary idea between standard and nonstandard institution.

3.4. The Top Research Publication Sources

From 131 publication research sources about electronic payment system, the most dynamic sources for using electronic payment research, specifically Google Scholar, collected 55 papers from 30 countries, including the journal and conference papers.

3.5. Year of Publication

From 131 publication research sources about electronic payment system, the most active years in security of electronic payment research were, 2017, from which we collected 24 papers, which was the top year, from 2018 we collected 20 papers, 2016 had a total of 16 papers, and 2019 was in the fourth position, with total of 16 papers. From 2014, 2015, and 2020, we collected 10, 11, and 11 papers, respectively. From 2013, we collected 8 papers, and from 2012, we collected 7. 2011 and 2010 were the lowest ranked for paper collections, with 5 papers collected from 2011, 2 from the web sources and 4 papers collected from 2010.

3.6. Discipline of Journals

The five maximum of the journal’s discipline proficiency come from MDPI with 8 papers, “International Journal of Advanced Research in Computer Science and Software Engineering” with 3 papers, “International Journal of Computer Applications” with 3 papers, “International Journal of Advanced Research in Computer Science” with 2 papers, and “Indian Journal of Science and Technology” with 2 papers.

3.7. Industrial Research

A cashless evolution is underway in Asia. This change was fostered by the way of a technologies’ revolution. Consumer payments in Asia are going through huge change as markets add electronic payments to minimize the dependency on cash to invest, while concurrently improving economic access. Because of the cashless revelation of Asia, there have likewise been increased risks for internet fraud. Based on a clear Commerce survey, the best twelve overseas bases for online fraud are Ukraine, Malaysia, Pakistan, Russia, Turkey, Bulgaria, Romania, Egypt, Lithuania, Yugoslavia, Indonesia, and Israel. Precisely, the same study has also shown that the twelve countries with probably the lowest fraud are Austria, France, the UK, Hong Kong, South Africa, Switzerland, Japan, Spain, Norway, Taiwan, New Zealand, and Australia [13]. From the papers that have been selected for study, 64 articles discuss online payments from the banking industry. Among those 64 studies, 12 discuss online banking secure authentication and the rest of the security issues. The countries with the most discussion about digital payment from the banking sector are India, Malaysia, Nigeria, Bangladesh, China, India, and Indonesia. On other hand, there are 24 articles about e-wallet security issues, 19 articles about design and requirements, and 23 articles regarding study and adoption of e-wallet, for which the countries are the same as those on the banking industry, namely India, Malaysia, Nigeria, Bangladesh, China, India, and Indonesia. We can conclude that, in the electronic payments system, “e-wallet and online banking” are still the most talked about banking and financial services industry. For information on the industrial studies, the countries are listed in

Table 2. Researched industries and countries.

Industry	Country	Number of Articles
E-wallet Design and requirement	India, Malaysia, Nigeria, South Korea, China, India, and Indonesia	19
Study/adoption/impact	India, Malaysia, United States Nigeria, Bangladesh, China, India, Indonesia, and Korea	23
E-wallet security	India, Malaysia, Iran, Nigeria, Bangladesh, China, India, Indonesia, and Israel	25
Online banking security	India, Malaysia, Denmark, Nigeria, Bangladesh, China, India, Indonesia, Saudi Arabia, Jordan, Kenya, Romania, Saudi Arabia, Sudan, Canada, Thailand, Turkey, and Oman	64

.

3.8. Answering the Research Questions

In this section, we will discuss the proposed research questions. To answer the research questions, this section will be divided into two subsections, which are described below.

3.8.1. Major Issues Regarding Electronic Payments

Digital payment is a good way of making payments online. A tremendous alteration of web-based transactions has occurred with an equal rise in security strikes against electronic payments [7]. Protection in changing the business environment is not readily acknowledged. Electronic payment on the web is a simple target for stealing personal information and money. There are many reasons security vulnerabilities show up in electronic payments. Clients offer charge cards and payment account details along with other private information online. These data are sometimes transmitted insecurely [9]. Electronic payments demand the improvement of information technologies. The disappointment of the electronic payment depends upon why it ignores the market and the user. In this section, we examine what the chief problems in electronic payments are, which also answers research question 1, and look at what areas researchers are concentrating on and just how well the information disclosed at the time of the transaction is protected. To answer RQ1,

Table 3. Classification of included studies.

Factors	Frequency	Percent (%)	Valid Percent (%)	Cumulative Percent (%)
Security	73	55.038	55.038	55.038
Study/adoption/impact	23	17.829	17.829	72.868
Authentication	16	12.40	12.40	85.271
Design requirement	19	14.728	14.728	100.0
Total	131	100.0	100.0

summarizes the distribution of studies and the number of studies from a specific source type.

Table 3 shows the frequency of studies about electronic payment. Among the 131 selected research articles, about 73 (55.038%) of them are focused on electronic payment system security. The next group of studies, which related to enhance authentications (16, 12.40%), were also related to electronic payment security. On the other hand, we found 23 (17.829%) study/adoption/impact-related studies. Finally, we found 19 (14.728%) design and requirement-related research papers. Figure 3 shows the study frequency.

After examining this analysis, we discovered that today, researchers are much more centered on guarding electronic payments. Namely, the e-wallet and online payments element were the biggest services, which supports this study, and electronic payments studies showed that 73 papers were deal with in security-related study, while 16 papers also discussed secure authentication.

3.8.2. Security Properties of Electronic Payments

Protection may be the major issue with electronic payment methods because without safe industrial information exchange and secure electronic monetary transactions through networks, no one will believe it is safe to use. Users require confidentiality, authentication, data integrity, as well as non-repudiation as essential needs for making safe and secure settlements over the internet [14,15,16]. The electronic payment systems need to have all the above protection attributes, as users will certainly not rely on an e-payment system, which is not secured. As well as this, trust is exceptionally essential to guarantee approval from the clients. This area will provide the greatest security qualities to prevent electric payments fraud along with a survey on electric payment transactions and security engaged at the same time. The security properties of electronic payments adapted from Reference are shown in Figure 4 [3].

Authorization

Electronic payment should be available only for authorized customers, and additionally, the details exchanged for the payment have to only cover the authorized topics. The system must verify that it allows the user to make the requested transaction. The assets involved must be able to verify that everyone involved in the transaction may make the transaction. If authorization on information is not suitably offered to payment system, hackers can conveniently intercept the payment information of customers without mutual verification and additionally, they can control the information [17].

Confidentiality

Confidentiality is extremely essential in the e-commerce world due to the possibility that hackers might get people’s sensitive details. In electronic payment, a client ought to be allowed to use the electronic banking account after effective verification. The information entered by the customer is not easily accessible to other customers using electronic banking. Confidentiality is an assurance that information is shared solely among authorized individuals or companies. Only an authorized receiver should be able to acquire the encrypted message so that others cannot view its contents [18]. It must protect confidential information from any unauthorized person, process, or device.

Integrity

To prevent malfunction or physical harm, an electronic payment network needs accurate details. Integrity is connected to the believability of information resources. It is utilized to make sure that the information is precise enough for its needs. The information must be complete and authentic, making sure that information will not be replaced or maybe harmed during the transaction time or perhaps transmission time [19]. Data integrity will keep all the specifics confidential during the electric transaction. The information and devices have not been changed and corrupted by external parties. Valid user credentials will usually be acknowledged.

Authentication and Non-Repudiation

Authentication is the procedure of confirming the identity of a procedure or maybe device, usually as a precondition for enabling use of materials on a product. The primary problem, which must be looked after for an electric payment device, is authentication that identifies the customer and ensures that the individual is who he/she promises to be. A selection of authentication techniques was created to ensure the defense of electronic purchases. The process of authentication is important for enabling individuals to go into their credentials, and if they match with the existing one, then the individual is a validated user and is permitted to login to the system, otherwise, they are not. In general, there are three main approaches utilized to verify entities, as follows: One method is something you have on you, for example, a device, token, or card. The second method is to use points you know, such as passwords, pins, etc. The third approach is to make use of something that is biometric [20]. Authentication methods, like individual IDs and passwords that identify individuals, can help to reach the objective of confidentiality [21].

However, it was identified that authentication with just one aspect is not reputable to supply enough safety and security due to an option of safety risks [18]. Because of the increase in online transactions, single authentication is not enough for doing expensive transactions online. For that reason, there is a need for an even more strong and secure system according to the Multi Factor Authentication (MFA) to look at the validity of individuals. MFA involves various points such as, for instance, biometrics, the sensible mobile device, token device, together with the smart card. This authentication program improves the safety degree as well as additionally making use of identification, confirmation, and verification for guaranteeing customer authority. On the other hand, non-repudiation is a mechanism to ensure that the user can be sure that they are connecting with the authentic server, such that neither of the communicating parties can later on incorrectly refute that the purchase happened. Pertaining to electronic security of monetary transactions, the application of non-repudiation supposes a solution that provides evidence of the stability as well as origin of information, and a verification tool that with high guarantee can be insisted to be genuine. It maintains logs of purchases as well as being frequently upgraded by banks, and records a variety of information comprising the nature, time, and date of transactions that have been participated in by consumers. These records make it possible for the verification of many completed transactions as well as provide the proof required for any concern, which may arise.

Robustness and Efficiency

As the electronic payments are transforming, there is a need to change and develop. In competing situations, time-to-market robustness is crucial for measuring the success of a system. Security measures for electronic payment solutions must be tested under the supervision of the danger monitoring function to ensure their robustness and effectiveness. The rise in Fintech has grown rapidly in the banking sector worldwide. To stay affordable, banks are introducing internet banking with the motive to achieve greater productivity as well as efficiency [22]. Efficiency is one of the favorable characteristics of the electronic payment system [9]. Electronic payment is gaining appeal among significant retailers because of the safety, efficiency, and added energy it offers to the end-user, which enhances their satisfaction of their overall purchase. By giving high efficiency in making transactions, consumers are extra likely to adopt E-wallet, making deals in their daily life [23]. Effectiveness can be substantially improved by decreasing transaction expenses, enabling trade on items, and services with much reduced values. The performance of the online payment can be even more improved based on the following referrals: Effort needs to be made to verify the input information to ensure the integrity of the system.

Supporting Transaction

Support cash transaction is the one of basic attributes of customer satisfaction with electronic payment [20]. The application for payment should support a mechanism allowing money to be exchanged over the Internet [24], and the merchant or provider is liable for the payment-method application (app) to disable it [25]. The app does not conflict with other mobile systems or non-payment functions. In electronic payments, the principal problem is to be more secure for payment systems and disputation between online merchants and customers. Electronic payment systems are not successful without the acceptance of users [13]. Problems are not readily recognized due to a lack of protection in the growing market ecosystem. A 2G/3G/4G/5G wireless network or Wi-Fi network is needed to support the communication between user devices and mobile payment systems [26]. The need to have a reliable network to help e-banking is crucial, because badly performed Internet banking programs will harm the credibility of a bank or otherwise alienate clients and the public. Payments issuers need to collect and analyze more information from customer behavior, or from the transaction [27]. There are many applications from the payment service providers that were developed for supporting mobile payments including: issuer, card network, and mobile company. One-time password (OTP) and biometric features like fingerprint, voice, or facial recognition must be used if the mobile banking app supports them to authenticate the identity [28]. In order to help capture illegal acts, the user can see where the sale takes place along with the name and number of the dealer [29,30,31,32,33]

Availability

In electronic payment, the service must have the availability, which pleases both security needs of subjects taking part in purchases and customer comfort. It requires having the accessibility, in which it can complete the purchase whenever the user demands [34,35]. Availability defines the access of information sources, ensuring a started transaction can be timely and completely executed. In order for an electronic payment service to be securely provided, it must have confidentiality, authentication, authorization, integrity, non-repudiation, robustness, efficiency, supporting transaction, and availability, as mentioned above.

Table 4. Security properties of electronic payments.

Security Techniques	References	Total Studies
Confidentiality	[15,21,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45].	18 papers
Integrity	[17,24,30,31,33,36,40,42,43,44,46,47,48,49,50,51,52,53,54,55,56].	22 papers
Non-repudiation	[14,24,33,42,55,56,57,58,59,60,61,62].	14 papers
Authorization	[34,42,58,63,64,65,66,67,68,69,70].	12 papers
Authentication	[14,21,24,26,33,35,40,42,44,56,68,70,71,72,73,74,75,76,77].	19 papers
Availability	[14,17,21,37,53,61,78,79].	8 papers
Robustness and Efficiency	[7,20,22,31,45,65,80,81,82,83,84,85,86].	13 papers
Supporting transaction	[9,13,14,17,20,25,26,31,38,52,65,87,88].	13 papers

shows that most researchers have suggested that, in an electronic transaction, the system must have the listed security properties. E-commerce has altered the method individuals utilize to do business. The online transfer is not just limited to ecommerce, it also offers the opportunity to gain movie or plane tickets, download music, buy a publication, or look at the global markets for desired products at any time in any location. Security factors to consider are a fundamental part of electronic transactions. To allow large-scale transfer approaches all around the world, payment approach necessitates following an effective safety procedure that can absolutely ensure safety and security for internet transactions.

In this modern world, the digital payment solutions provided in this paper would have ideal mechanisms to satisfy the safety and security properties detailed in RQ2. However, providing security is a task that needs exhaustive evaluation and even more initiative than just using cryptographic mechanisms. After completing the security analysis, we found that to overcome security challenges, the system must implement the security properties outlined as below:

• Confidentiality
• Integrity
• Authentication
• non repudation
• Robustness
• efficiency
• Availability

4. Conclusions

This study reviewed 131 papers published from 2010 to 2020 on an electronic payment system, namely e-wallet and an online payment system. After examining these papers, we classified the studies into two groups: e-wallet and online payment studies. While e-wallet studies examined that e-wallets are gaining more attention in electronic payment, the focus of online payment system research was more focused on online payment security. The analysis of the selected studies shows several challenges and topics for future research, including those specifically related to using electronic payment systems to improve security and interoperability of e-wallets and online payment systems.