Payment Flow Of Card System

Introduction

In the world of digital payments, secure handling of sensitive payment data is paramount. When a customer makes a payment using a debit card or any PIN-based card at a Point of Sale (POS) terminal, the flow of data involves multiple entities, cryptographic protections, and decision-making steps. This article walks you through the entire lifecycle of a PIN-oriented card payment transaction to give you a clear understanding of how it works.

Key Terminologies

1. Merchant — A business or store that accepts card payments for goods or services from customers using a POS terminal or online payment gateway.
2. acquirer — The financial institution or payment processor that contracts with the merchant to process payments and forwards transactions to the appropriate payment networks or issuers.
3. Issuer — The cardholder’s bank or financial institution that issued the card, holds the cardholder’s account, and approves or denies payment requests based on account balances or credit limits.
4. Payment Service — A payment network (e.g., Visa, Mastercard, Amex) that facilitates the communication and routing of transaction requests between acquirers and issuers.
5. Pos — A device or system where a cardholder initiates a payment either by swiping, dipping, tapping, or manually entering their card details.
6. ZPK — A symmetric encryption key used to encrypt cardholder PINs at the POS terminal and during transmission to the acquirer. It ensures PIN confidentiality.
7. IWK — A key used by the issuer to decrypt PIN block data or transaction details received from acquirers or payment networks during transaction processing.
8. BIN — The first 6–8 digits of the card number (PAN), which identifies the card’s issuer bank, card type (credit, debit), and payment network (e.g., Visa, Mastercard).
9. TLS — A cryptographic protocol that secures communication over the internet (or other networks) by providing encryption, authentication, and data integrity during payment transactions.

Payment Flow

1. The cardholder presents their PIN-oriented card (e.g., debit or PIN-protected credit card) at a POS terminal and enters the PIN
2. The PIN is encrypted at the POS using ZPK (Zone PIN Key):

The PIN block is generated using standard formats (e.g., ISO 9564).

The PIN is immediately encrypted by the ZPK, ensuring it is never transmitted in plaintext.

In systems using DUKPT (Derived Unique Key Per Transaction), the PIN is encrypted with transaction-specific keys derived from the Base Derivation Key (BDK) instead of ZPK.

3. Data Sent to Acquirer including transaction details , PIN(encrypted) , card Data.

4. The Acquirer decrypts the PIN using the shared ZPK, valiadates transaction and forwards to the relevant Payment Network based on BIN (Bank Identification Number).

5. The Acquirer sends data and the communication between the Acquirer and the Payment Network is secured using TLS, or in some cases, a Key Encryption Key (KEK) to safeguard sensitive data.

6. The Payment Network identifies the Issuer Bank based on the card’s BIN (Bank Identification Number). It re-encrypts data and sends it to Issuer.

There is no mismatch in encryption because the Payment Network uses cryptographic keys pre-shared with the Issuer.

7. The Issuer Validates all transaction details and PIN , If the transaction passes all checks, the Issuer generates an Authorization Response (approved or declined) and forwards it back to the Payment Network.

8. The Payment Network securely sends the Issuer’s response to the Acquirer. which further forwards the response to the POS terminal, where the merchant and cardholder are notified.

9. Fund Settlement — Although the transaction is authorized in real-time, the users get the notifications of credit and debit respectfully and the actual fund transfer occurs later in a batch process.

Conclusion

When a cardholder enters their PIN at a POS, the encrypted data travels securely through acquirers, payment networks, and issuers, ensuring real-time validation and transaction integrity. This process, powered by advanced encryption standards and seamless collaboration, forms the backbone of secure digital payments, enabling trust and convenience worldwide.

References

https://www.youtube.com/watch?v=gzTYbl2Kwuk

https://www.pdcflow.com/resources/guides/credit-card-payment-processing/