Downloaded 42 times
Uploaded byDmitry Buzdin
How Payment Cards Really Work?
The document provides an overview of how payment cards work, detailing components such as card numbers, expiration dates, and payment networks, as well as the complex processes involved in processing transactions. It discusses authorization, transaction messages, and security standards like PCI-DSS, emphasizing the importance of protecting cardholder data. The document also highlights various technical details about transaction formats and encryption methods in the payments industry.
More Related Content
Similar to How Payment Cards Really Work?
How Payment Cards Really Work?
- 1. Version 1.1 How PaymentCards Really Work? Dmitry Buzdin 20.12.2018
- 2. Agenda • Whats inyour card and what can you do with it? • Why payments are a complex IT domain? • What happens when you buy stuff?
- 3.
- 4.
- 5. How many payment cardsyou have on you?
- 6.
- 7. Primary Account Number Individualaccount number Issuer identification number Checksum Major industry identifier 4 = VISA 5 = Mastercard 4000 1234 5678 9010
- 8. BIN Checker https://www.bincodes.com/bin-checker/ Issuers areassigned BIN ranges : from–to
- 9.
- 10.
- 11.
- 12. How it allworks together?
- 13.
- 14.
- 15. Authorization https://en.wikipedia.org/wiki/Authorization_hold Holds/freezes the moneyuntil payment confirmation comes through
- 16.
- 17.
- 18. Lots of messagesgoing back and forth, what are those?
- 19. ISO 8583 https://en.wikipedia.org/wiki/ISO_8583 "standard for financialtransaction card originated interchange messaging”
- 20.
- 22. EBCDIC Encoding • Originatedfrom IBM mainframes • Blocked file format – 2 byte delimiter after every 4096 bytes https://en.wikipedia.org/wiki/EBCDIC
- 23. ASCII Representation 1240¸‘√å·‚ 16534520700001811300000000000000600000000000600000000000600061000000 610000001403170000001810D10101C9100500120014005311230518605329600000 00000230699969806999698123456789012R1002300CHPPIN000000000CHPPIN69Th e BigStore 1234 Main StreetCamanducaia 90210 BRA3690002003MCS0003003MCS0023003NA 01460360029018400000000000429860000000000960148008986284020158030MCC 20300017513102301 NNNNNN0159067 1 F13102301131023010165001M01700328005556666 8005556666 0177002N 018904118005551212 019100121000051Original DE032 = 009667 And Modified DE032 = 999698986986986076_* ÜÇXïöúüÄü%⁄¡üvü&≠’‘'ıèÈü'Äü6ü72ó9Ä016 MCG0110840313 00000002060148810699969806014881@ö Single financial transaction
- 24. 1240¸‘√å·‚ 16534520700001811300000000000000600 0061000000610000001403170000001810D 11230518605329600000000002306999698 02300CHPPIN000000000CHPPIN69The Big Main StreetCamanducaia90210 BRA3690002003MCS0003003MCS0023003NA 01460360029018400000000000429860000 Message Type Identifier
- 25. MTI Meaning Usage 0100Authorization Request Request from a point-of-sale terminal for authorization for a cardholder purchase 0110 Authorization Response Request response to a point-of-sale terminal for authorization for a cardholder purchase 1240 First Presentment The merchant processes the original transaction. 0210 Issuer Response to Financial Request Issuer response to request for funds 0230 Issuer Response to Financial Advice Confirmation of receipt of financial advice 0400 Acquirer Reversal Request Reverses a transaction
- 26. 1240¸‘√å·‚ 16534520700001811300000000000000600 0061000000610000001403170000001810D 11230518605329600000000002306999698 02300CHPPIN000000000CHPPIN69The Big Main StreetCamanducaia90210 BRA3690002003MCS0003003MCS0023003NA 01460360029018400000000000429860000 Message Type Identifier Data Element Bitmap
- 27. Data Element Bitmap 62 10 00 11 02 C0 48 04 0x22 = 0110 0010 DE2,DE3 and DE7 are present 128 Standard Data Elements
- 28.
- 30. 1240¸‘√å·‚ 16534520700001811300000000000000600 0061000000610000001403170000001810D 11230518605329600000000002306999698 02300CHPPIN000000000CHPPIN69The Big Main StreetCamanducaia90210 BRA3690002003MCS0003003MCS0023003NA 01460360029018400000000000429860000 Message Type Identifier Data Element Bitmap DE2
- 31.
- 32. Key Data Elements •DE-2 PAN • DE-4 Amount • DE-37 Retrieval Reference Number - UID set by Acquirer • DE-42 Card acceptor Merchant Identifier (MID) • DE-43 Card acceptor name/location • DE-49 Currency code • DE-18 Merchant Category Classification (MCC) • DE-39 Response code
- 33. Consuming ISO 8583 •Generic parsers exist • DE list should be configured for each MTI • Payment schema specific • Software vendor specific • Use-case specific • Version specific
- 34. Even More DE canhave subfields … with subfields Hundreds of optional fields (PDS) Some DE have their own binary format
- 35. Weird Fields • PDS0620—Oil Company Brand Name • PDS 0585—Mini-Bar Charges • PDS 0725—Overtime Hours Worked
- 36.
- 37. ISO 8583 Overall •Monstrous format • Bandwidth efficient • Contains layers of legacy • Vendor specific elements and workflows • Few open source offerings (JPOS, j8583)
- 38. ECommerce API Merchant ECommerce Provider PaymentNetwork Payment Gateway REST + JSON SOAP ISO8583
- 39. Is it safeto transfer PAN in plain text?
- 40.
- 41. Payment Card Industry DataSecurity Standard https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard
- 42.
- 43. In Plain English •Protected network • All cardholder data encrypted in transfer and on disk • Regular security checks • Audited access to systems and data • Documented procedures • Physical security
- 44. PCI-DSS primary goalis protecting card sensitive data
- 45.
- 46. One-way hash 4000 12345678 9010 2a2e033b311bf13f8 Irreversible
- 47. PAN Masking 4000 12345678 9010 4000 12** **** 9010 Individual account number Issuer identification number Hash and masked PAN can not be stored in the same place
- 48. Tokenization 4000 1234 56789010 Abc45sdd124ssksk One-use or multiple use tokens B33fas%$liiii
- 49. Strong Cryptography “Strong cryptographywith associated key-management processes and procedures”
- 50.
- 51. HSM Functions • DESand Triple DES (key lengths 112 bit, 168 bit) • AES (key lengths 128 bit, 192 bit, 256 bit) • RSA (key lengths up to 4096 bit) • Hashing: MD1, SHA-1, SHA-2 • Payment specific algorithms • Key management
- 52. Key Management • Keystrength • Accountability and audit • Key rotation https://www.owasp.org/index.php/Key_Management_Cheat_Sheet
- 53. Key Ceremony Generation ofroot private and public key pair
- 54. Security as aService https://www.vaultproject.io TOTP PKI RSA Key-Value Dynamic Secrets
- 55.
- 56. All major cloudproviders are PCI-DSS compliant (so are major data centres) https://cloud.google.com/security/compliance/pci-dss/ https://docs.microsoft.com/en-us/azure/security/blueprints/pcidss-paaswa-overview https://aws.amazon.com/compliance/pci-dss-level-1-faqs/
- 57.
- 58.
- 59. Avoid PCI-DSS bynot knowing sensitive data
- 60. External Web Form Redirect FromMerchant Redirect Back To Merchant Payment service provider hosted page
- 61. Mobile Apps 1. PAN 4.UID 3. UID 2. UID
- 62.
- 63.
- 64.
- 65. Payments Overall • Legacydata formats • Lots of integrations • Security-security-security • Legal restrictions • New APIs and standards are coming • Lots of changes right now!
- 66. http://a-heads.eu Dmitry Buzdin You want paymentz?– let us know! dmitry@a-heads.eu