Card Payments and EMV Masterclass - Part 1

Explore the card payments ecosystem, from EMV authorization to clearing and settlement, and discover who approves payments, how money moves, and the systems that power it.

Meet the instructor who brings six-plus years in card payments, covering EMV, ISO 8583, card personalization, terminal configurations, TMS, HSM, key exchange, and scheme certifications with Visa and Mastercard.

Explore the course curriculum covering key card payment terms, card brands and models, transaction flows, EMV chip and contactless mechanisms, and a bonus look at EMV coin card payments.

Targeting freshers and professionals in banking and fintech, product owners, analysts, managers, developers, and testers, this course delivers practical, real-world card payments training with real payment systems.

Card payments involve multiple behind-the-scenes systems that move funds from your credit, debit, or prepaid card to the merchant after you tap at the POS.

Discover the core terms used in card payments. Learn how card holder, issuing bank, merchant, acquiring bank, card network, payment processor, BIN, and POS interconnect to enable transactions.

Explore the two main types of cards: consumer cards for personal use and corporate cards for business expenses, with corporate cards linked to company accounts and policies.

Explore consumer card types in the payments ecosystem, including debit, credit, secured credit, charge, prepaid, and deferred debit cards. Learn how each type serves customers, bankers, and payments professionals.

Identify the three key elements of card payments: authorization, clearing, and settlement, and explain how the issuer verifies funds, how the card network clears balances, and how settlement moves money.

Explain how card authorization works, detailing the roles of issuer and acquirer banks, the POS terminal, and the payment network, and how an approval holds funds in seconds.

Explore how authorization moves money through clearing and settlement, from batch submission to issuer and acquirer posting, through card schemes and nostro accounts.

Explore interchange fees in POS and ATM transactions, why acquirers pay issuers for POS and e-commerce, and what factors like card type and transaction details influence Visa and Mastercard rates.

Explain honours (on-us) flow and off-us transaction flow, showing how a Metro Bank card on a metro bank or other bank ATM triggers internal checks, card networks, and issuer authorization.

Compare the dual message system and the single message system in card payments, detailing how authorization, clearing, and settlement occur in two separate messages versus a single combined message.

Compare single-message ATM transactions with dual-message POS and e-commerce transactions, explaining real-time cash and fixed final amounts versus holds, and the separate authorization and clearing steps.

Card schemes create a single connection for the acquirer, while the network handles authorization, clearing, and settlement with banks globally, enabling Visa and Mastercard cardholder access.

Payment schemes route messages, connect with banks worldwide, and calculate net obligations for settlement. They enforce common rules, including ISO 8583 formats, dispute handling, fraud monitoring, tokenization, and security certifications.

Compare four party and three party card schemes; Visa and Mastercard use four party models with banks as intermediaries, American Express, Diners Club, and Discover act issuer, scheme, and acquirer.

Compare the four party model with the three party model in card payments, highlighting Visa and Mastercard networks, broad global acceptance, and the more complex, multi-party structure.

Demonstrate how authorization, clearing, and settlement occur in a real purchase, outlining the roles of cardholder, issuer, acquirer, merchant, and Mastercard network, and explain interchange and merchant discount rate.

The authorization flow shows a POS sending ISO 8583 or API to the acquirer, routing to Mastercard and issuer for PIN and balance checks, resulting in mti 0110 approval.

Examine the clearing flow from authorization to settlement, detailing batch and clearing files, data element matching, and the role of interchange and merchant discount rate.

Explore settlement in card payments as funds move between banks through Mastercard with Citibank settlement partner, using nostro and vostro accounts to debit Metro Bank and credit Global Trust Bank.

Review the exterior features of a payment card—pan, expiry date, and cardholder name—and explore the chip (icc) as a mini computer with cryptographic keys and mag stripe fallback.

Explore the EMV chip as a mini computer with an operating system (Multos or Java Card), a master file root, and applications stored as ADF and EFS with TLV records.

Explore how the terminal and card chip exchange APDU messages in a client-server model, detailing CAPDU and RAPDU structures, including CLA, instruction, P1–P2, LC, data, Le, and SW1/SW2.

Explore the command apdu and response apdu structures, including the select command (a4) and app id, with fci data and status words 90 00, in emv communication.

Explore the EMV transaction flow from inserting the card's chip and ATR to application data, CDA-based offline data authentication, CVM, online authorization, and completion.

Explain how a card is reset at the start of an EMV transaction, detailing cold and warm reset signals, ATR exchange, and terminal communication.

Learn how the card chip replies to the terminal's reset with the ATR. Compare inverse and direct bit orders, and T=0 character-based versus T=1 block-based communication.

Explore how a card chip stores data and logic for transactions, with multiple applications such as debit and transit, defined by Visa and Mastercard, and how terminals select correct application.

Compare PSC and ID methods: PSC browses the card directory to pick a match; ID tests AIDs to form a candidate list, reflecting modern EMV versus legacy PSC.

Explain how the payment systems environment method allows the terminal to browse the card directory and select the best application, contrasting legacy emv with direct id selection in newer terminals.

Explain the aid structure by showing how the application id signals the terminal; rid (registered application provider) and pigs (proprietary extension) indicate visa or mastercard and debit or credit.

Explains the aid method for application selection, showing how the terminal and card build a candidate list and select via implicit priority or explicit user choice with the FCI.

The terminal builds a candidate list by querying card applications one by one, confirming two common apps (ending in 10 and 12) via select commands and FCI responses.

terminal builds a candidate list from two applications, mastercard debit and mastercard credit, and selects by implicit priority or explicit cardholder choice on the pos screen, verifying aid with fci.

A data object list (dols) is a joined, non-tlv field telling the terminal the exact data to send in the card’s required order, including ac1, ac2, and tc creation.

Learn how the terminal initiates application processing by issuing get processing options command, receiving the card's application interchange profile (AP) and AFL to identify capabilities and locate files to read.

Initiate application processing by sending the get processing options command with the transaction amount to the card chip, detailing AP and AFL (tag 82 and 94).

Decode the AIP, or application interchange profile, through the AP tag 82 to reveal the card's capabilities, including DDA, SD, cardholder verification, CDA, and AFL's file read instructions.

Discover how the application file locator (AFL) is constructed in EMV, using TLV 94, to tell the terminal which records from which short file identifiers to read for processing options.

Learn how the terminal reads application data in EMV transactions by issuing select and read record commands to AFL-specified files (SFI five and six) and parsing APDU responses.

Explain TVR, the five-byte results in EMV processing that records offline data authentication, CVM methods, risk management, and compares with TSC and ISC to decide online or offline cryptogram requests.

Explore offline data authentication, including sda, dda, and cda, to confirm card authenticity and data integrity; dda and cda are most common, with cda the strongest.

Learn how TVR bite two enforces processing restrictions by checking the application version, expiry and effective dates, and the application usage control (AUC) for the current transaction.

explains TVR byte three, CVM, including offline PIN, online PIN, signature, combined KVM, and no KVM, and how each method is verified by the issuer and the terminal.

Explore terminal risk management in TVR byte 4, including floor limit logic, random online checks, and velocity checks with ATC and last online ATC counters.

Analyze the terminal action by comparing TVR bytes with issuer and terminal action codes to decide whether to reject offline, go online, or approve offline via generate AC.

Card action analysis enables the card chip to perform risk checks after terminal's TVR, TAC, and IAC assessment, deciding to go online, approve offline, or decline offline with issuer-specific logic.

Learn online processing with ARQC: terminal requests first AC, card may decline offline or go online, issuer validates funds and PIN, then authorization passes through acquirer, network, to issuer.

The issuer validates the authorization, then sends an ISO 8583 MTI 0110 response containing the ARPC. The terminal sends an external authenticate apdu, and the card verifies the ARPC.

Issuer script processing remotely sends apdu commands to the card chip for maintenance or security actions, using apdu tags 71 before final generate AC and 72 after final generate AC.

During the EMV transaction completion, the terminal may select a cryptogram (TC or AC) after issuer approval. The card chip still validates rules and can offline-decline despite approval.

Trace the EMV transaction flow from APDU communication and resets to application selection, GPO, TVR, and TSC/ISC checks, then online authorization with ARPC, external authenticate, and issuer script processing.

Understand the contactless EMV flow, with preliminary checks, fast cryptography, dynamic paths, and compressed commands that skip second generate AC after a tap.

Explore how contactless EMV transactions use TCU and CBTC to decide online, offline, or KVM paths, with CBTC configured by the issuer and TCU by the acquirer.

Explore EMVCo, the global standards body owned by Visa, Mastercard, American Express, Discover, JCB and UnionPay, which defines chip card specs, 3D secure, tokenization, QR payments, and biometrics.

Dive into ISO 8583 message structures and EMV transaction types with a hands-on simulator. Explore HSM key management, security in payments, 3DS end-to-end flows, and tokenization through console-based commands.