salmg/academy
Sign in
Payment Systems: Magstripe, Tokenization, NFC and EMV
Level 1 · Foundations60 min

Payment systems and security

The fundamentals: how a transaction is verified and processed against the terminal, why the APDU protocol is not encrypted, and what protects the transaction instead.

Free preview

Paying with a card takes about two seconds and involves at least four organisations, two cryptographic protocols and a decision that has to be made whether or not the network is reachable. Most of what looks strange about payment security stops looking strange once you know which of those constraints produced it.

Four parties, and why it matters

PartyRole
CardholderHolds the card. Usually the only party who notices when something goes wrong.
MerchantOwns the terminal. Wants the sale to complete; carries the loss when a transaction is charged back.
AcquirerThe merchant's bank. Routes the transaction into the scheme network.
IssuerThe cardholder's bank. Holds the keys, and is the only party that can verify a cryptogram.
Cardholderholds the cardMerchantowns the terminalAcquirermerchant's bankIssuerholds the keystapsauthorisation requestvia the scheme network
Only the issuer can verify a cryptogram. Every offline approval is therefore a bet the terminal makes on the issuer's behalf, and much of EMV exists to bound how bad that bet can be.

Four technologies, still all in use

A single card often carries several of these at once, and the security of the whole card is closer to the weakest of them than to the strongest. That is not a design flaw so much as the cost of a hundred-year deployment that cannot be upgraded at once.

TechnologyWhat it sends
Magnetic stripeStatic data, identical every time. Whoever reads it once can reproduce it forever. Module 3.
EMV contactA conversation with a chip that computes a fresh cryptogram per transaction. Modules 4 and 5.
NFC contactlessThe same conversation over radio, with a shorter script and a time budget. Module 6.
TokenizationA substitute number that is useless outside its context. Modules 7 and 10.

What the protocol does and does not defend

The exchange between terminal and card is not encrypted. Anyone with a reader can record it in full — which is exactly what the captures on this platform are. That surprises almost everyone, and it is deliberate.

EMV assumes the channel is observable and defends a different property: that an observer cannot produce a transaction the issuer will approve. Confidentiality was never the goal. Unforgeability is.

How fraud actually gets monetised

Reading a card is the least interesting step. The chain that turns a read into money has several links, and most defensive work targets the ones that are not technical at all: obtaining data, encoding or emulating it, finding a terminal that will accept it, converting goods to cash, and moving that cash.

How to work through this course

Every module from here on refers to a real captured transaction, and you can open any of them at any time. Reading about an APDU is worth an hour; watching one in the workbench and recognising the field being described is worth considerably more.

PracticeOpen a short contactless transaction now, before you know how to read it. Seven exchanges. Come back to it after module 4 and see how much has become legible.Open in the workbench