So remember that the aim of an authorization is to read the data from
the customer's card and send it to an issuing bank.
How the data is read from the card depends on where you are in the
world because of how the data is actually stored on the card and
actually what data is available and, also, the technical capabilities
of the merchant to read the card.
There are three ways a merchant may accept a transaction.
If it's a magnetic stripe transaction,
the merchant could swipe it through the point‑of‑sale system, through a
dedicated card reader, or through a payment device.
In an EMV, or chip market,
the merchant will insert the card into an EMV reader.
And in a contactless transaction,
the cardholder would just tap their card onto the contactless card reader.
In all three types of transactions,
information is being read from the card into the merchant's systems.
That information will then be used by the merchant
to make an authorization request.
Let's start with looking at a magnetic stripe transaction. We'll look
at EMV or chip transactions in a later module. Equipment at the
merchant reads the entire track 1 data from the card and sends it,
along with information about the merchant,
the amount of the transaction, and possibly an encrypted value
based on the cardholder's pin to the issuing bank.
This is called the authorization request.
The cardholder's issuing bank checks the data, determines if it's a real or
a fraudulent transaction, and also whether there are sufficient funds or
credit to allow the transaction to take place.
And then the issuing bank sends an authorization response to the merchant,
which typically consists of a response such as accept or
decline and a reference number or code to identify that the
merchant received a response.
Now, for this process to happen, the merchant,
in our example Wired Brain Coffee, would have to have relationships with
every bank in the world that issue payment cards just in case one of that
bank's customers came into their coffee shop, and that's just too many
relationships for a single merchant to have.
So what happens in practice is that every merchant that accepts payment cards
has a relationship with an acquiring bank, sometimes called a merchant bank as
well. I'm going to call it an acquiring bank.
So that's a bank that acquires a merchant's payment card
transactions, and it's this acquiring bank that builds
relationships with every card‑issuing bank in the world.
Of course, even this will be massively complicated.
There are hundreds of thousands of acquiring banks. And if
each one had to build relationship and agree separate
contracts with every single issuing bank,
they'd drown in paperwork and lawyers.
So there has to be something in the middle that connects all the
acquiring banks with all the issuing banks. And that something is the
card schemes or, as PCI calls them, card brands,
Visa, Mastercard, JCB, and UnionPay.
They connect all the acquiring banks with all the card‑issuing banks.
So what really happens in our example authorization is that the authorization
request goes from Wired Brain Coffee to Wired Brain's acquiring bank and then
to a card scheme, such as Visa or Mastercard.
The card scheme then works out who issued the card, and they send the
authorization request to Ann's issuing bank and waits for the
authorization response from the bank that issued the card to Ann so then
it can send the response to Wired Brain's acquirer.
Now, here's probably one of the most important things to know about
the payment industry. Although it is full of standards and rules
because it covers the whole world, there are lots of differences in
the way the system works.
Those differences can be because of the country you're in, because of
local laws, or historical ways that payments have worked in a certain
region. There are all sorts of regions.
So although the general principles of this course will be valid,
you will always find some differences in the places where you work.
There is no universal way for every single payment to
happen everywhere in the world.
But that's actually what makes this industry really interesting to work in.
And our first irregularity is that actually not all card payments work in the
way that we've just shown in what's called a four‑party model where there is a
merchant, an acquiring bank, sometimes also called an acquirer, and issuing
bank, also called an issuer, and a cardholder.
Another way that payments very often work is what's called a three‑party
model where there's no acquiring bank or issuing bank.
The card scheme gives cards directly to cardholders and develops
relationships directly with merchants to acquire their transactions.
An example of card schemes that are basically third‑party schemes are
American Express and Discover. And in some parts of the world, you'll also
hear Discover being called Diners. And also, JCB works in this three‑party
model, as well as in a four‑party model.
Now,
whether it's a three‑party scheme or a four‑party
scheme, at the end of authorization,
the merchant has a promise to pay from the cardholder's
bank or, in a three‑party scheme,
the card issuer. And the cardholder has their coffee.
The next step is to discover how the merchant actually gets their money.