An educational payment platform that behaves like a real gateway hosted checkout, issuer authentication, signed notifications, explainable fraud decisions without touching real banking networks or real cardholder data.
Online payments combine identity, money and cross-organisation trust in one workflow which makes them a high-value attack surface. A successful-looking return page is not proof a payment occurred. Values can be tampered with client-side, callbacks can be forged or replayed, and stolen credentials can be reused for carding or account takeover.
Most student payment demos hide the hard part behind a UI or a recorded video. This project makes the full trust chain observable: how the merchant calculates a trusted amount, how the gateway issues an expiring payment state, how the pseudo-bank authenticates the payer, how messages are signed and verified, and how fraud signals shape the outcome.
A modular monolith for the FYP window, with the pseudo-bank kept as a genuinely separate service to preserve a realistic trust boundary.
Every simulated decision traces back to a rule, a signature, a state transition, or an audit event. Nothing is an unexplained black box.
Explainable risk score from amount, velocity, device, IP, prior declines and card status. Not a black-box ML model.
Five members, 20 weeks. The Base / Additional / Stretch split protects a working demonstrable core.
Supervisor: Mr. Lim Min Han