Payment Systems: Magstripe, Tokenization, NFC and EMV

The fundamentals: how a transaction is verified and processed against the terminal, why the APDU protocol is not encrypted, and what protects the transaction instead.

The laboratory: how it is organised, how to navigate it, and which tool suits each payment technology.

Track encoding and the security thinking of the era — the ideas every later technology is a reaction against.

The APDU protocol end to end: packet generation, commands, responses, and the structure at the core of every transaction.

Contact transactions and the advanced APDU mechanisms behind them, including emulating EMV data with dedicated hardware.

NFC transactions in detail: APDU exchanges, cryptogram analysis, and cardholder verification methods.

The opposite of static magstripe data: seeding and encryption for token generation, and how digital wallets implement it.

DPAN versus FPAN, the Token Service Provider role, wallet provisioning and identification & verification, the token cryptogram, and Click to Pay.

Pix, UPI, FedNow, SEPA Instant and EMVCo QR — static versus dynamic codes, and the fraud that followed the money out of the card rails.

Scoping, segmentation and what an assessor actually looks for — framed for someone attacking the environment rather than documenting it.

Reversing transactions to understand attacks seen in the wild, and building proofs of concept for each.

Relaying APDU data locally, over the internet and by MQTT, and analysing the time-bounding countermeasures meant to stop it.

Commercial phones as contactless terminals: the PCI CPoC and MPoC standards, attestation, and what breaks when the terminal is an app on untrusted hardware.

Mastercard's Relay Resistance Protocol, Visa's timing constraints, and where formal verification found bypasses anyway. The sequel to module 9.

ISO 8583, switches and acquirer hosts, HSMs, DUKPT key derivation, ISO 9564 PIN block formats and key ceremonies — the other half of the rail.