Paying with a card takes about two seconds and involves at least four organisations, two cryptographic protocols and a decision that has to be made whether or not the network is reachable. Most of what looks strange about payment security stops looking strange once you know which of those constraints produced it.
Four parties, and why it matters
| Party | Role |
|---|---|
| Cardholder | Holds the card. Usually the only party who notices when something goes wrong. |
| Merchant | Owns the terminal. Wants the sale to complete; carries the loss when a transaction is charged back. |
| Acquirer | The merchant's bank. Routes the transaction into the scheme network. |
| Issuer | The cardholder's bank. Holds the keys, and is the only party that can verify a cryptogram. |
Four technologies, still all in use
A single card often carries several of these at once, and the security of the whole card is closer to the weakest of them than to the strongest. That is not a design flaw so much as the cost of a hundred-year deployment that cannot be upgraded at once.
| Technology | What it sends |
|---|---|
| Magnetic stripe | Static data, identical every time. Whoever reads it once can reproduce it forever. Module 3. |
| EMV contact | A conversation with a chip that computes a fresh cryptogram per transaction. Modules 4 and 5. |
| NFC contactless | The same conversation over radio, with a shorter script and a time budget. Module 6. |
| Tokenization | A substitute number that is useless outside its context. Modules 7 and 10. |
What the protocol does and does not defend
The exchange between terminal and card is not encrypted. Anyone with a reader can record it in full — which is exactly what the captures on this platform are. That surprises almost everyone, and it is deliberate.
EMV assumes the channel is observable and defends a different property: that an observer cannot produce a transaction the issuer will approve. Confidentiality was never the goal. Unforgeability is.
How fraud actually gets monetised
Reading a card is the least interesting step. The chain that turns a read into money has several links, and most defensive work targets the ones that are not technical at all: obtaining data, encoding or emulating it, finding a terminal that will accept it, converting goods to cash, and moving that cash.
How to work through this course
Every module from here on refers to a real captured transaction, and you can open any of them at any time. Reading about an APDU is worth an hour; watching one in the workbench and recognising the field being described is worth considerably more.
PracticeOpen a short contactless transaction now, before you know how to read it. Seven exchanges. Come back to it after module 4 and see how much has become legible.Open in the workbench →