Introduction

There is a lot of technology that enables credit cards to work as a global payment network. This post is a tour for those curious how credit cards work.

Case Study: Sue

To demonstrate the global nature of payments we’ll create a persona, Sue. Sue is a school teacher from the United States on a much needed vacation to Italy. Her local credit union issued her a Visa branded debit card. While in Italy she orders an espresso and pays for it with her credit card using the “contactless” method of tapping it against the card reader.

Let’s explore all the pieces of technology that make this happen. We’ll cover:

  • Understanding Credit Card Numbers - What goes into generating a complete credit card number?
  • Anatomy of a Physical Credit Card - Dips, swipes and taps. What’s inside a card to make these work?
  • The global payments network - In our example above how do banks from across the world actually talk to each other, and do it so quickly?

Understanding Credit Card Numbers

On the surface a Credit Card number seems like a purely set of random digits, indeed there is some randomness as they’d be easy to guess otherwise. However that random part is actually a lot smaller than you may be lead to believe. Each credit card is composed of five sections

  1. First Digit: Major Industry IdentifierThe Major Industry Identifier (or MII) is the first digit of the card. This represents the card network that the credit card uses. From the first digit of any credit card you can tell if it is a Visa, Amex, Mastercard, etc.Major Network MIIs:
    • 2 or 5 - Mastercard
    • 4 - Visa
    • 3 - Amex
  2. Digits 2-6 (sometime up to 8) are the BINThe BIN is a unique identifier that connects a bank to a card network (like Visa). This is how Visa knows what bank issued the card.
  3. Digits 7-15 (typically)These digits are the random numbers that make a card difficult to guess. If the BIN represents the specific bank on the network this number represents the account at that bank.
  4. Digit 16 (the last digit)This is a special digit used to verify that the terminal read the rest of the card correctly. This number is generated using something known as the Luhn Algorithm, it is a way to verify if a card number is “correct”.

Example

  1. 4 - This digit represents the card network to use (Visa)
  2. 000123 - BIN - This tells the card network (Visa) the specific bank to reach out to in its network.
  3. 45678901 - Account Id - With this number the bank can look up what account the card belongs to.
  4. 0 - This is a special digit used to make sure the network got all the other digits correctly.

Anatomy of a Physical Credit Card

Despite the slim profile there’s a lot of stuff in a credit card. There are no less than three separate systems embedded into modern credit cards.

1. Swipes - AKA the Magnetic Strip

Often referred to as mag-stripes, are made of tiny iron-based magnetic particles in a plastic-like film. Information is encoded on the strip using a process called flux reversal. The orientation of the particles represent binary (1s and 0s) the same stuff computer hard drives use just stored in the form of a magnetic film.

When you swipe a card the card reader emits a magnetic field that causes the magnetic particles in the stripe to emit a signal. The 1s will emit a small charge while the 0s will emit no charge. From that the card reader can read the binary encoding. Binary encoding will include your name, the card number and the expiration date. Importantly it will NOT include your CVV (the three digit number you have to add when doing online shopping).

Magnetic strip as fallen out of favor recently because they are not particularly secure (they are easily copied). Also if they are exposed to string magnetic fields they can be damaged.

2. EMV Chips

The EMV chip is actually a tiny computer the programming is directly in the hardware and can not be modified but it is still a computer. This helps to solve many of the shortcoming of magnetic strips because the chip is capable of processing data, offering enhanced security features.

When you insert a chip card into a card reader the card reader sends a small amount of electricity through the chip essentially turning the computer on. The chip generates a one-time code, unique to that particular transaction, which is nearly impossible to counterfeit. The terminal then transmits the transaction data (plus the one-time code) across the card network to the customers bank. The uses something known as public key cryptography to verify that the one time code was generated using a valid credit card.

3. Contactless

Also known as near field communication (NFC), contactless works by having a very tiny antenna embedded in the perimeter of the card (if you shine a flashlight against a card you can often see the antenna). This antenna connects to the card’s EMV chip and when it comes in close contact to a terminal powers up the chip and will transmit the one-time code generated by the EMV chip.

The Global Payments Network

A fun fact about credit/debit networks is that the are actually a five sided marketplace, there are actually FIVE participates involved with a single transaction.

  1. The merchant
  2. The merchant’s Bank (the fancy term for this is “acquiring bank”)
  3. The card network (e.g Visa)
  4. The customer
  5. The customer’s Bank (the fancy term for this is “issuing bank”).
Untitled

Putting It All Together

Let’s get back to Sue buying coffee. For this example let’s say she used contactless to pay. When her card comes close to the merchant’s terminal the terminal emits a small near field charge to power up the EMV chip.

The chip emits the card data as well as one tie could via an RFID antenna into the terminal. Then the fun begins. The terminal sends the data to the merchant’s bank who then reaches out the customers bank through the card network. The customer’s bank reviews the transaction, verifies the one time code then decides if they want to approve it.Their response (approve/decline) travels back through the network to the merchant’s bank and back to the merchants terminal.

And all of this All this in happens in milliseconds like magic…