Secure online payment in Morocco: how to reassure your customers at checkout

Secure online payment in Morocco, from your customer's point of view, is first of all a payment they understand: a hosted payment page that carries your name and logo, an amount in dirhams, a confirmation requested by their own bank through 3-D Secure, and a card that never passes through you. The rest is up to you: show who operates the payment, your contact details and your terms, never ask for card data by message, and confirm every payment promptly. This guide covers each of these points, with sentences to publish on your site and answers to the most common doubts.

A secure online payment, as your customer sees it

At the moment of paying, your customer asks two questions, even if they never say them out loud: where is my card going, and who is collecting my money? Until they have an answer, they hesitate, and sometimes they give up. A secure online payment answers both before they need to ask.

Where their card goes. To a payment page hosted by the platform, not to your site or your messages. They enter it themselves, and their bank asks them to confirm.

Who collects. You do, through your payment platform. When that platform is ChariPay, the exact answer is this: ChariPay is a Moroccan payment platform, a PSP operated by Chari Money, a payment institution licensed by Bank Al-Maghrib. Your customer should be able to find that exact sentence.

Do not promise a "100% secure" payment: security is shown by what the customer sees and experiences, not by a slogan. What the platform does on its side (strong authentication, audit log, compliance) is detailed on the security and compliance page; this guide is about what you show your customers.

A hosted payment page, in your name and your colors

The first trust signal is visual: the customer must recognize your store on the page where they pay. Two cases, depending on how you collect.

• A checkout session, on your site. The checkout session uses your colors and your logo: the session's config.frontend block carries a theme, a logo and your company name. The customer moves from your cart to a page that looks like you.
• A payment link, sent by message. A link's page shows your name and your logo; you set it in your account settings.

On both, the amount is shown in dirhams: everything is in Moroccan dirhams (MAD), with no conversion. A customer who reads the exact amount of their order, under your store's name, does not feel they are leaving your shop. The full presentation of the hosted page is on the hosted checkout page.

One integration rule never to work around: the payment page is never placed inside a hidden iframe. The customer must see where they are entering their card.

The simplest thing is to see your page the way your customer will. Start in test mode: three fields (name, work email, company), an activation link received by email to choose your password, then the portal, where you set up your page and, if you integrate through the API, create your test key after re-authenticating. Pay with the test card 4918 9141 0719 5005, CVV 123, any future expiry date, 3-D Secure code 555: only this card is accepted, and no real money moves. It is free, with no time limit and no approval to wait for.

Confirmation with their bank: the role of 3-D Secure

Card payments go through 3-D Secure authentication: the cardholder confirms with their bank, which protects the merchant against most unpaid charges and disputes.

For your customer, that means one more step, and it is good news: after entering their card, they see their bank ask them to confirm the payment, using whatever method the bank provides. It is their bank, not you or the platform, that checks it really is them. Explain it in one sentence on your order page: a buyer who sees their own bank step in feels reassured, as long as they expect it.

This step has its failures too: abandonment during authentication, a decline by the issuing bank, incorrect details, suspected fraud. Many Moroccan cards are closed to online payments by default. The merchant's reading of those failures, and what you can improve, is in 3-D Secure and success rates. What buyers can do themselves after a decline is explained in card declined online, a useful link to send a customer who is stuck.

Your customer's card never passes through you

This is the strongest argument, and it is true: your customer enters their card on the hosted checkout, within a PCI DSS Level 1 certified scope: you never see a card number, and your self-assessment questionnaire is reduced accordingly — to be confirmed with your advisor or your acquirer.

The platform is PCI DSS Level 1 certified, a certification renewed every year. PCI DSS is the card data security standard published by the PCI Security Standards Council, designed, as the Council describes it, to strengthen the security of payment card account data and to encourage the wide adoption of consistent data security measures worldwide. Level 1 is the most demanding. That certification belongs to the platform, not to your store: never write that your site is "PCI DSS certified". What you can write is that you neither see nor store any card number, and on the platform side, card numbers are never written to the database.

For what PCI DSS means on the merchant side, read PCI DSS for merchants.

Reassuring customers before they pay: what to display

Trust is built before the payment page, on your site, your product page or your profile. Check that each of these items is visible where the customer decides to buy.

• Who operates the payment. Two simple sentences, for example: "Payments in this store go through ChariPay. ChariPay is a Moroccan payment platform, a PSP operated by Chari Money, a payment institution licensed by Bank Al-Maghrib." The details are on the who operates ChariPay page, which you can link to.
• Your contact details. Company name, phone, email, and a way to reach you that actually gets an answer.
• Your terms of sale and refund policy. What happens if the product does not suit, and how the customer is refunded.
• The total amount, in dirhams. Including delivery if it is charged, before the customer reaches the payment page.
• The payment method. "Card payment with 3-D Secure, on a hosted payment page": the customer knows what to expect.

Add no badge, seal or certification logo you have not earned yourself, and do not write that your store is "certified": an attentive customer will check, and a fake seal destroys the trust it was meant to build.

What you never ask a customer for

The most reassuring rule is also the simplest: you never ask for a card number, a security code (CVV) or a code received from their bank by message, phone or email. Never a photo of a card either, not even "to check". The only place your customer enters their card is the hosted payment page, whether it is your store's or that of a payment link you send them.

Spell it out on your site and in your automated messages:

We will never ask for your card number, your security code or a code received from your bank, whether by message, phone or email. To pay, use only our store's payment page or the payment link we send you.

That sentence protects your customers from anyone impersonating you, and it protects you too. Fraud aimed directly at merchants (fake payment screenshots, spoofed redirects, portal takeover) is covered in online payment fraud.

After the payment: confirmations and follow-up

The moment after payment matters as much as the one before: a customer who hears nothing gets worried, and writes to you.

1. 1In the portal. The link turns "paid", and a notification flags the payment in the portal. For a session, the status is read through the API.
2. 2On your server. Confirm the order when the webhook arrives, never on the redirect alone: the redirect says the buyer came back, not that the payment is secured.
3. 3For the customer. Send your own confirmation message as soon as the payment is confirmed: the amount, your order reference, what happens next (preparation, shipping, appointment).

An example:

Payment received for your order #1042 (MAD 349), thank you! We are preparing it and will write as soon as it ships. Any question? Just reply to this message.

Answering doubts and spotting where people drop off

Some questions keep coming back; prepare your answers once, on a help page or in your saved replies.

• "Why is my bank asking me for a code?" "That is 3-D Secure: your bank is checking that it really is you paying. Never share that code with anyone, not even us."
• "Who is collecting on this page?" "Our store, through ChariPay, a Moroccan payment platform, a PSP operated by Chari Money, a payment institution licensed by Bank Al-Maghrib."
• "Did my payment go through?" "You receive our confirmation as soon as the payment is confirmed. If you have not heard from us, write to us before paying a second time."

To find out where your customers hesitate, measure instead of guessing. The portal shows the funnel of a link or a session — how many opened the page, how many entered their card, how many completed — and the Customer journey API module exposes a resource's funnel summary and event detail. Many page opens and few cards entered: the page or the amount raises questions. Many cards entered and few completed payments: look at authentication and bank declines. The full method is in 3-D Secure and success rates.

Frequently asked questions

How can I tell if an online payment is secure?

Look at where you enter your card and who is collecting. A trustworthy payment happens on a payment page in the store's name, with a clear amount, and your bank asks you to confirm through 3-D Secure. Be wary of anyone asking for your card number or a bank code by message or by phone, whatever name they use.

Why does my customer's bank ask them for a code?

That is 3-D Secure authentication: the cardholder confirms the payment with their bank, which protects the merchant against most unpaid charges and disputes. The code comes from their bank, not from you or the platform. Warn your customers about this step on your order page: a buyer who expects it experiences it as a safeguard, not an obstacle.

Can I put my logo on the payment page?

Yes. The checkout session uses your colors and your logo: through the API, the config.frontend block carries a theme, a logo and your company name. A payment link's page shows your name and your logo, set in your account settings. You can check everything in test mode before sending your first real link to a customer, and see the page exactly as they will.

Do I see my customers' card numbers?

No. Your customer enters their card on the hosted page, within a PCI DSS Level 1 certified scope: you never see a card number, and your self-assessment questionnaire is reduced accordingly, to be confirmed with your advisor or your acquirer. On the platform side, card numbers are never written to the database. So you can say so on your site.

What should I display on my site to reassure customers before payment?

Who operates the payment, with the exact sentence about ChariPay and Chari Money; your full contact details; your terms of sale and refund policy; the total amount in dirhams before the payment page; and the payment method, by card with 3-D Secure on a hosted page. Add no badge or seal you have not earned yourself: an attentive customer will check.

Can a customer pay me by sending their card details in a message?

No, and you should never accept or ask for it: no card number, security code, bank code or card photo by message, phone or email. Send them a payment link instead: they enter their card themselves on the hosted page, confirm with their bank, and you are notified when the link turns "paid".

How do I find out where my customers abandon payment?

The portal shows the funnel of a link or a session: how many opened the page, how many entered their card, how many completed. The Customer journey API module exposes the same summary and the event detail. Compare the steps with each other: a gap between opening and entering a card is not fixed the same way as a gap between card entry and a completed payment: each has its own causes.

Next step

Customize your payment page with your name and logo, then make a test payment from a phone, 3-D Secure step included, to experience exactly what your customer will: Start in test mode. Then update the wording on your site (who operates the payment, what you never ask for), using the security and compliance page as your reference.

Sources

• PCI Security Standards Council — PCI DSS — read on October 2, 2026