Learn by doing

Payment puzzles

Route payments through a real card network, put a chip transaction in order, set the flags a terminal raises and diagnose declines from the logs. Every mistake tells you what would go wrong in production and where to read about it.

Mission

A chip card is inserted at a coffee shop. Route the authorization request to the bank that issued the card.

Start at Chip card and click connected systems one hop at a time until you reach the goal. Some routes reach the goal and still fail. Par: 4 hops.

CustomerMerchantAcquirer / PSPCard schemeIssuerEMV chip: signs each transaction with an ARQC cryptogram.💳Chip cardSTARTHolds a device token (DPAN), never the real card number.📱Phone walletThe shopper at an online checkout.🌐BrowserReads the card or phone and builds the authorization request.🏪POS terminalThe merchant’s online payment page.🛒Web checkoutHardware security module: translates PIN blocks between keys.🔐Acquirer HSMThe merchant’s bank: routes requests to the right card network.🏦Acquirer hostConnects checkouts and terminals to the acquirer.⚙️Payment gatewayRuns 3-D Secure for the merchant or its PSP.🛡️3DS ServerToken vault: maps device tokens back to real card numbers.🪙Token serviceRoutes authorizations between acquirers and issuers by BIN.🔗Card network3-D Secure router: finds the issuer’s ACS for a card range.🧭Directory ServerVerifies PINs, ARQCs and CAVVs without exposing keys.🔑Issuer HSMThe cardholder’s bank: approves or declines.🏛️Issuer hostGOALAccess Control Server: the issuer’s 3-D Secure authenticator.✅ACS

Your route · 0 hops

  1. Chip card

The puzzles and what they teach

  1. Route the payment

    Chip at the counterWarm-up

    Can you get a chip payment from the counter to the card’s bank?

    PlayRead: ISO 8583 Protocol

  2. Route the payment

    Timeout, then reversalMedium

    Can you clean up after an authorization that timed out, without charging the cardholder twice?

    PlayRead: ISO 8583 Protocol

  3. Route the payment

    Send a refundWarm-up

    Can you get a refund to the shopper’s bank without asking them to authenticate?

    PlayRead: Settlement & Clearing

  4. Route the payment

    Verify the chipMedium

    Can you deliver a chip’s cryptogram to the only system able to check it?

    PlayRead: NFC in Payments

  5. Route the payment

    Tap with a phoneMedium

    Can you get a phone tap approved by a bank that has never seen the phone’s card number?

    PlayRead: Payment Tokenization

  6. Route the payment

    Subscription on a stored tokenHard

    Can you bill a sleeping subscriber with a stored token, without asking them to authenticate?

    PlayRead: Payment Tokenization

  7. Route the payment

    Online PINHard

    Can you get an encrypted PIN to the issuer without anyone reading it on the way?

    PlayRead: TR-31 & TR-34 Key Standards

  8. Route the payment

    Checkout with 3-D SecureExpert

    Can you authenticate and authorize an online payment in the right order?

    PlayRead: 3D Secure (EMV 3DS)

  9. Put it in order

    Chip transaction, step by stepMedium

    Can you put the steps of a chip payment in the order the card and terminal run them?

    PlayRead: EMV Contactless Kernels 2–8

  10. Set the bits

    Read the TVRMedium

    Can you set the TVR bits that record what the terminal found?

    PlayRead: EMV Contactless Kernels 2–8

  11. Diagnose

    Diagnose the declineHard

    Can you find the root cause of three real-world payment failures from the logs?

    PlayRead: ISO 8583 Protocol