For the vast majority of payment systems accessible on the public Internet, baseline authentication (of the financial institution on the receiving end), data integrity, and confidentiality of the electronic information exchanged over the public network involves obtaining a certificate from an authorized certification authority (CA) who provides public-key infrastructure (PKI). Even with transport layer security (TLS) in place to safeguard the portion of the transaction conducted over public networks—especially with payment systems—the customer-facing website itself must be coded with great care, so as not to leak credentials and expose customers to subsequent identity theft.