We started off this module asking how, when you made a payment transaction,
the transaction was shown on your account or credit card
statement and the money left your account.
To find out how this works, we've met all the
participants in the payment process,
issuing banks and three‑party card schemes, such as AmEx and Discover
that give payment cards to individual cardholders,
acquiring banks and three‑party card schemes that
accept transactions from merchants.
And we met card schemes or card brands that join acquiring
banks to issuing banks in a four‑party model,
commonly Mastercard and Visa. And payment service providers or payment
facilitators that sit between merchants and acquiring banks.
We've discovered that there are a number of steps in the payment
process and that, in each of the steps, an the electronic message
will be sent between the participants.
It is the contents of these messages that make transactions happen.
Each of these messages contain data, and understanding the purpose of each
message and what data it will contain is the first step in knowing how to
protect this data from criminal theft or from manipulation.
The first step in the payment process is authorization,
which happens when the customer starts the transaction. The
merchant wants to make sure they'll get paid, and it is an
authorization message that goes from the merchant to the issuing
bank that will contain the most data.
In some cases,
the merchant also has to capture transaction by confirming
they've completed their part of the contract with the
customer. After authorization,
clearing messages are exchanged so that all parties know how much they owe
each other at the end of the day. And then settlement happens where the
money moves from the banks that issue cards to the merchants that have given
goods or services to the cardholders.
Finally,
we learned that transactions can be undone, either by a merchant issuing a
refund to a card holder or a cardholder stating that they didn't make a
transaction and so initiating a chargeback.
Finally, I'd like to remind you that the world is a very big place.
The payment system has been developed over about 60 years.
It started out with bits of paper containing the physical signatures of
cardholders being posted from merchants to acquirers,
then acquires to the schemes, and then posted from
the schemes to the issuing banks.
Over time, this has moved to electronic processing.
Some payment systems started out in their own countries, and they were
built to different standards to other countries systems.
It's really been only the last 20 years or so that the entire global
payment system has been properly electronically connected.
So this means that different countries acquirers and schemes
still work in their own individual ways,
but there's a common way of exchanging messages between them,
which is what the card schemes do.
So, although everything we've talked about here is generally what happens,
you will always find variations.
However, in almost all cases, for a merchant to get paid,
there will be messages sent from the merchant of the
acquirer, service provider, or card scheme,
which will eventually end up at the bank that issued the card.
Understanding what's in these messages, where they go, and how they
get there is the secret to securing payments.