How payment cards work 

This is the first text in the series explaining how payment cards and wallets interact. The purpose of this text is to define terminology and to explain basics about card processing. 

Although most people use payment cards every day, there are many people even in card issuing business who don’t understand the process fully. This text is intended to give a bird-eye view on the entire process and to help identify actors included in it, as well as relations between these actors.

The following diagram shows typical transaction execution flow: 

Transaction source might be merchant, ATM or AFD, or online shop. Transaction source is the place where the act of using payment card is happening. This place is sometimes called the point of interaction (POI for short). Physical merchant place is called the point of sale (POS), bank’s automated teller machine is called ATM, and automated fuel dispenser is called AFD. When paying on all these physical places cardholder and card have to be present during transaction initiation, for that reason transactions initiated in this way are also called card-present (CP) transactions. Online payments can be e-commerce (ECOMM), or mail/email or telephone order (MO/TO) transactions. Since cardholder and card don’t have to be physically present when initiating these transactions, they are also called cardholder-no-present (CNP) transactions.

Next step in transaction process we are going to call payment gateway. We will later delve into the details of this actor. For now, it suffices to define payment gateway as the entity that upon request from POI creates payment transaction message in the format that can be understood by the actors down the chain. Essentially the payment gateway receives request for payment from POI, usually in some proprietary format and/or protocol, and it sends request for payment to interchange (card) network. Payment gateways are institutions that have to adhere to certain security requirements to be allowed to connect to the interchange network and to send or receive messages over it.

Next step in transaction processing is interchange or card network. This is high performance network connecting payment card issuers and payment card acceptors. This network routes each card transaction to the issuer of its card, and it routes back card issuer’s reply to the originating payment gateway. The interchange network is also in charge of collecting money from card issuers and sending it to merchants. For the beginning it is enough to think of interchange network as of some device which reliably routes communication and money between two points across a vast network of nodes.

At next step, after being forwarded by interchange network, transaction reaches designated payment processor. A payment processor is an institution which must adhere to strict security requirements (even stricter than payment gateway) to be entrusted to process payment cards. The payment processor is in charge of checking security parameters of the card in transaction data. It is the payment processor that checks if CVV and expiry date are correct for CNP (cardholder not present) transactions, or if PIN related encrypted data are correct for CP transactions.

If the payment processor successfully validated security-related parameters of it, the transaction is forwarded to the issuer system, which has the wallet which is to check if cardholder actually has enough funds on the account to execute transaction. The wallet checks the account balance, and if there are sufficient funds available it approves the transaction. A wallet’s main role is to keep accounts balances and to prevent cardholders from spending more money than allowed. 

Reply to the transaction can happen from any of the nodes in the chain if there is some error in transaction itself. For example, if the payment gateway made an error constructing message (it put invalid currency for example), interchange network would reject transaction without passing it further. If the security parameters of the transaction are incorrect then the payment processor would reject the transaction without passing it for wallet to decide. But if all intermediaries are happy with data, it is wallet which has the final word about transaction. Once the wallet makes its decision, its response is forwarded all the way back using the same route until it reaches the merchant. This entire process usually takes a couple of seconds with merchants and issuers all over the world.

The entire process described happens in real-time, and the merchant immediately knows if the transaction request has been approved or declined. This process is called the authorization process (because merchant is trying to obtain authorization from issuer/wallet to take money from cardholder).

What about the money?

As we saw this entire process doesn’t involve money, rather just exchanging some messages between merchant and issuer systems. To receive money merchant needs to send request for it to the issuer. This is called clearing or settlement process (although there are some differences between the two, they are of no interest for us now, so we are going to use them interchangeably). Merchant, or payment gateway acting on its behalf, sends request for transaction to be settled, again using the same route as for the authorization. Next business day money is transferred from card issuer to merchant, with interchange network acting as intermediary again, but this time for the money.

What keeps entire scheme running?

Like everything else in this world, it is money that keeps it running. For each transaction that flows through the interchange network, the network charges a small fraction of transaction value (interchange fee) from one of the two principal actors, either issuer or merchant. Who is to be charged is decided based on perceived value for transaction: 

• If transaction allows merchant to sell something (ie, to earn money), merchant is charged fee for the transaction, and this fee is split among other actors in the chain, 
• If the transaction allows the cardholder to receive cash (ie, to benefit from having the card), the issuer is charged for the transaction, and the fee is split among other actors. 

Depending on point of view, these two types of interchange fees are called positive and negative interchange. Obviously, there are participants that make money with each transaction: the interchange network receives something out of every transaction that flows through it, payment processors and payment gateways usually charge based on number of transactions processed no matter of direction they took. 

This last property results in one important fact: it is in the interest of every participant for the transaction to happen. Although simple, this statement has one profound effect, which many wallet constructors find confusing: since everybody wants transaction to happen, nobody is too strict in checking transaction data – in the end it is cardholder who is paying for the transaction, so it is left to the cardholder to complain if transaction is not correct in some sense, while systems in between are there just to allow him to have his money on disposal whenever and wherever he needs it.

What if charged in error?

Cardholders have the ability to complain about any card transaction they believe was made in error. That is done by filling charge-back request after which issuer has to refund cardholder immediately. However, to prevent cardholders from filing meaningless charge-back requests for every transaction, card issuers charge fee for filling charge-back request, and further, once they refund charge-back they usually don’t allow cardholder to use this returned money immediately, but they keep it in locked state until time for merchant to submit additional documentation and to challenge cardholder’s charge-back request expires.

Coming soon…

Detailed discussions about each of participants in card payment process. What is the role of each one, and how they fulfil their roles.