How the embedded checkout works

The payment form appears inside your checkout page rather than sending the customer to the bank’s website. This article explains what is actually happening, because it matters for both security and troubleshooting.

The sequence

1. The customer reaches your checkout and chooses the card payment method.
2. The plugin sends the order amount, currency and reference to Scotiabank using your Store ID and Shared Secret.
3. Scotiabank returns a secure payment field, which the plugin embeds in your checkout page.
4. The customer types their card details into that field. The details go directly from their browser to Scotiabank.
5. Scotiabank runs 3D Secure authentication if required, then approves or declines.
6. The result comes back to the plugin, which updates the WooCommerce order.

Why this matters for security

Your website never sees the card number. It is not in your database, not in your logs, and not in your backups. A compromise of your WordPress site does not expose your customers’ cards, because the cards were never there.

It also means the plugin cannot read the card field, which is occasionally a surprise when troubleshooting. If a customer reports a problem entering their card, you cannot inspect what they typed.

Why this matters for conversion

Customers stay on your domain throughout. There is no jarring jump to an unfamiliar bank page, which is a well-documented point of checkout abandonment, particularly on mobile.

Styling

The payment field can be styled to fit your checkout. Because it is served by the bank, the styling options are those the bank exposes rather than arbitrary CSS.