Payments + architecture
What actually happens when a customer pays?A narrated payment journey with normal, alternate, failure, refund, and administrative paths.
W/ CAMPUS · WACK-CAMPUS-0001
LEARN TO FOLLOW
THE PAYMENT STORY.
Students learn how payments, architecture, responsibility, evidence, testing, and professional judgment fit together—then leave with safe, explainable portfolio work instead of memorized compliance vocabulary.
W/?
Authority statePractitioner reviewed / 2026-09-15
PAYMENT SECURITY LABFictional systems. Real reasoning.
- W/?MODULE 01Follow the transaction
- W/→MODULE 02Map influence
- W/↔MODULE 03Separate responsibility
- W/!MODULE 04Challenge the claim
- W/✓MODULE 05Build the portfolio
NO CHD · NO CREDENTIALS · NO UNAUTHORIZED TESTING
Learn boldly. Practice safely.
W/ Campus is independent practitioner education. It is not an accredited course, official PCI SSC training, a PCI SSC qualification, a PCI DSS assessment, permission to test a real system, or a hiring guarantee. Exercises use fictional or explicitly sanitized environments and must never collect account data, credentials, sensitive architecture, or client evidence.
The W/ Campus method
Five moves from curiosity to defensible work.
Each move creates an artifact that can be questioned, revised, and reused.
- W/?01
Follow the transaction
Trace one fictional payment from customer action through authorization, settlement, refund, failure, and support paths.
- W/→02
Map influence
Identify systems, identities, providers, networks, software, and people that handle payment data or can affect its security.
- W/↔03
Separate responsibility
Distinguish provider, customer, shared, assessor, and compliance-accepting authority without turning outsourcing into invisibility.
- W/!04
Challenge the claim
Ask what is asserted, what evidence exists, what was tested, who made the decision, and what would reopen it.
- W/✓05
Build the portfolio
Produce a sanitized, source-linked artifact that another person can review, reproduce, and challenge safely.
Five focused streams
The field is wider than “the PCI job.”
Scope + responsibility
Who and what can affect payment security?A relationship map separating facts, provider reliance, customer duties, and open applicability questions.
Evidence + testing
What makes a security claim believable?A claim-evidence-test matrix that distinguishes scans, penetration tests, control evidence, and assessment judgment.
Cloud + software
What remains when infrastructure is ephemeral or outsourced?An ownership and change model for SaaS, cloud, serverless, APIs, identities, and providers.
Career + ethics
How does a learner become useful without pretending to be qualified?A role map, learning plan, ethical boundary, and sanitized portfolio brief.
Five fictional environments
Practice the reasoning. Protect real systems.
The cases are rich enough to reveal architecture and responsibility without asking a learner to expose an employer, client, campus, or merchant.
LAB 01
The Campus Bookstore Checkout
A university bookstore combines physical terminals, an ecommerce storefront, returns, gift cards, and student employees.
ChallengeTell the complete payment story without assuming one processor means one environment.
LAB 02
The Student Event Reader
A student organization borrows mobile readers for a weekend event and uses personal phones, temporary accounts, and venue Wi-Fi.
ChallengeSeparate convenience, ownership, authorization, evidence, and post-event access removal.
LAB 03
The Alumni Donation Page
A hosted donation form is embedded in a university-managed site with analytics, scripts, DNS, developers, and provider callbacks.
ChallengeMap security influence beyond the system that receives the card data.
LAB 04
Dining, Vending, and the Mystery Network
Dining terminals, kiosks, vending devices, guest Wi-Fi, facilities vendors, and central identity share an incomplete diagram.
ChallengeReconcile inventory, data flow, administrative access, segmentation claims, and provider responsibilities.
LAB 05
The Serverless Startup Capstone
A fictional startup uses hosted checkout, APIs, functions, containers, cloud identity, webhooks, and several SaaS providers.
ChallengeFind durable ownership and evidence in an architecture whose compute is intentionally short-lived.
Ten-part student series
Read less like a tourist. Ask better questions.
Every guide is a substantial, practitioner-reviewed field manual with a companion tool. Each visible disposition is bound to the exact canonical digest being presented.
01WACK-CONTENT-0154
PCI DSS Is Not Just a Checklist. Learn to Tell the Payment Story.
A student can memorize twelve requirement families and still be unable to explain how a payment moves, who can affect it, or what evidence supports a claim.
02WACK-CONTENT-0155
What Actually Happens When Someone Taps a Card?
A tap lasts seconds. The system story around it can include a reader, terminal, application, network, acquirer, processor, issuer, keys, identities, logs, settlement, refund, and support paths.
03WACK-CONTENT-0156
Scope Is a Relationship Problem, Not a Circle on a Diagram
A neat boundary can conceal the very connections, administrative paths, and security influence that determine whether the boundary is defensible.
04WACK-CONTENT-0157
Evidence Is a Claim With Receipts
A screenshot is not self-explanatory. Without subject, time, source, population, method, and custody, it can be visually persuasive and evidentially weak.
05WACK-CONTENT-0158
The Provider Is Compliant. Your Architecture Still Needs an Explanation.
A service-provider assertion can support a responsibility claim. It cannot draw the customer's architecture, configure the service, or prove every customer duty occurred.
06WACK-CONTENT-0159
A Vulnerability Scan, a Penetration Test, and an Assessment Are Different Jobs
All three may inspect a system. They ask different questions, use different methods, cover different populations, and produce different kinds of conclusions.
07WACK-CONTENT-0160
Cloud, Serverless, and SaaS Still Have Owners
Ephemeral compute disappears. The identity, code revision, configuration, secret, route, provider service, evidence, and decision that created it do not.
08WACK-CONTENT-0161
How to Read a PCI DSS Requirement Without Memorizing It
Memorized requirement numbers fade. A disciplined reading method survives version changes, unfamiliar systems, and difficult evidence.
09WACK-CONTENT-0162
Build a Payment-Security Portfolio Without Touching Real Card Data
A strong early-career portfolio shows reasoning, source discipline, communication, and safe boundaries—not unauthorized access to a real payment environment.
10WACK-CONTENT-0163
How Careers in Payment Security Actually Branch
Payment security is not one job called PCI. It is a meeting point for architecture, engineering, operations, assessment, product, fraud, finance, legal, risk, and provider management.
Eight portable lab sheets
Build a portfolio with receipts.
01CAMPUS-KIT-01
Fictional Payment Journey Canvas
Narrate one payment beyond the happy path.
Download worksheet02CAMPUS-KIT-02
Transaction Actor and Handoff Map
Make people, systems, providers, and handoffs visible.
Download worksheet03CAMPUS-KIT-03
Scope Relationship Sketch
Practice relationship-based scoping without declaring a compliance result.
Download worksheet04CAMPUS-KIT-04
Claim Evidence Matrix
Turn an assertion into a reviewable claim.
Download worksheet05CAMPUS-KIT-05
Provider Responsibility Interview
Practice describing provider reliance without saying the vendor handles everything.
Download worksheet06CAMPUS-KIT-06
Assurance Activity Comparison
Separate scanning, penetration testing, evidence review, and assessment.
Download worksheet07CAMPUS-KIT-07
Safe Portfolio Project Brief
Design demonstrable work without exposing real systems or sensitive data.
Download worksheet08CAMPUS-KIT-08
Career Role and Learning Plan
Connect interests to real work rather than chasing titles alone.
Download worksheetReady-to-run faculty or student-organization session
From Tap to Assessment Claim
One fictional payment narrative, one scope-and-responsibility sketch, one claim-evidence record, and one safe portfolio next step.
Download the 60-minute guide Run a cold read- Ten minutes: follow a fictional tap through authorization, settlement, refund, support, and failure.
- Ten minutes: identify systems, providers, identities, people, and security influence.
- Ten minutes: separate customer, provider, shared, assessor, and accepting-authority roles.
- Ten minutes: challenge one claim using subject, period, evidence, test, and decision authority.
- Ten minutes: compare a vulnerability scan, penetration test, control test, and assessment conclusion.
- Ten minutes: convert the work into a sanitized portfolio artifact and role-based learning plan.
Primary learning routes