Hello, and welcome to Payment Card Security, Processing, and the PCI Standards.
My name is John Elliott,
and I'll be helping you to discover how card payments work.
Have you ever wondered how when you make a transaction using your payment cards,
such as buying a cup of coffee,
it appears on your bank statement or card statement just a few days later?
Let's see how that works.
Imagine,
Ann Cardholder goes into her favorite Wired Brain
Coffee shop and asks for a latte.
The assistant, Wanda, asks Ann for $5.10.
Ann decides that she wants to pay by card.
She either swipes the magnetic stripe, dips the chip,
or taps for a contactless transaction.
And then, she receives a delicious latte from Wanda.
So what are all the participants in the transaction
really thinking when Ann uses her card?
Wanda is concerned that if she lets Ann walk out the store with the
latte whether Wired Brain Coffee will get paid for it.
Ann is just hoping that the transaction works okay
because she really wants that latte, and she didn't bring any cash with her.
Ann's bank is wondering if it really is Ann making the transaction or if it's
someone else pretending to be Ann and also whether Ann has enough money in her
account or enough credit to afford the $5.10.
The first step in payment processing, authorization,
answers both Wanda's and the bank's question.
Now,
the proper term for an organization that accepts payment cards is a merchant.
So basically Wanda, the merchant, sends an electronic message to the bank.
This message contains the data from Ann's payment card and it asks the
bank if Wanda let's Ann walk out with a latte now,
will the bank give Wired Brain Coffee the $5.10 later? Based
on the information that the merchant sends,
the bank works out two things, firstly, whether it believes it
really is Ann making the transaction or if it is someone pretending
to be Ann. So the bank will check to see if the card being used has
been reported lost or stolen.
And it will probably make some other checks such as if it thinks Ann is in
the same country as the merchant or if she's bought coffee there before.
The bank will also check to make sure that Ann actually has $5.10 in her
account or within her credit limit.
And if the bank is happy that it really is Ann and that she has enough money,
it will send a message back to the merchant saying that it is okay to let Ann
have that latte and that the bank will pay the merchant later.
This first step in the payment process is called authorization.
The message from the merchant to the bank is known as the authorization request.
And the message sent back from the bank to the merchant
is called the authorization response. Authorization
responses are usually authorized.
But if the bank isn't happy because it thinks well the transaction is
fraudulent or the cardholder doesn't have sufficient funds,
it could also be declined. And in that case, Ann wouldn't have got her
latte. So, authorization is the first step in any payment card
transaction. Ann has a latte, and Wired Brain Coffee has a promise from
the bank that it will receive $5.10 in the future.
We're going to look in more detail at authorization and
the other steps in the payment process,
clearing and settlement, which are how Wired Brain Coffee will
actually receive the $5.10, and also the two ways of undoing a
transaction, chargebacks and refunds.
And the reason why we're doing this is because in each of these steps,
some data moves around the system in the merchant's
network and in the bank's network.
And the key to payment security is knowing where to find that data,
knowing what's in the data and, therefore, how it needs to be protected.