Ever Wondered? What’s Really Happening When You Tap Your Card at the Store?

Every time you tap your card or insert it into the terminal, you’re embarking on a fascinating journey through the digital realm. The seemingly mundane act unfolds a series of intricate processes, involving technology, security measures, and a dash of magic. Let’s take a vivid journey through what happens behind the scenes when your card meets the terminal.

In the intricate landscape of digital transactions, Visa and Mastercard stand as stalwart pillars, akin to industry leaders charting the course in the business of global payments. These entities, functioning as the primary conduits for financial transactions, orchestrate a seamless flow of information between acquiring banks, responsible for managing merchant accounts, and issuing banks, stewards of cardholder accounts. As transactions unfold, payment processors such as Adyen come into play, seamlessly integrating with acquiring banks to facilitate the nuanced exchange of data. This article delves into the sober dynamics of this financial ecosystem, shedding light on the roles of these entities and their collaborative efforts in transforming a seemingly routine transaction into a finely tuned operation of financial precision.

Roles and Collaborations: Visa and Mastercard, recognised as industry playmakers, function as strategic architects, delineating the protocols that govern the global payment network. Acquiring banks, serving as custodians of merchant accounts, ensure the smooth execution of transactions on behalf of businesses. Within this orchestrated play, payment processors like Adyen emerge as essential conduits, bridging the gap between merchants and a myriad of payment methods. While not traditional acquiring banks, these processors play a pivotal role in translating and facilitating secure communication between cards and terminals. The sober reality of this financial cooperation underscores the importance of each entity’s contribution to getting that payment across the line in split seconds.

Initiating the Magic – As you casually tap your card, you kickstart a cascade of events that begins with the contactless technology embedded in your card. A near-field communication (NFC) chip instantly communicates with the terminal, setting the stage for the enchanted journey ahead.

In a fraction of a second, secure dance data exchange commences. Your card shares encrypted information with the terminal, creating a digital handshake that verifies your identity and confirms the legitimacy of the transaction. It’s like a secret code, ensuring that only the rightful owner can release the funds stored within the card.

Once your card and the terminal have exchanged pleasantries, they enter the enchanted gateway of payment networks. Here, the information travels through a secure pathway, often powered by global payment networks like Visa, Mastercard, or others known as schemes. These networks act as the guardians of your transaction, ensuring it journeys safely to the next stage.

The journey takes a thrilling turn as your transaction enters the realm of authorisation. The payment network seeks approval from your issuing bank (where your funds are held), where a vigilant digital check assesses your account balance, credit limit, and other factors set by your bank. If the stars align, and your bank say yes, the authorisation is granted, and the magic proceeds.

A green light illuminates the transaction as “Approved”, and the magic is officially validated. Your card and the terminal rejoice in a harmonious symphony, signaling the successful transaction and you leave with your coffee or other item.

In the final act, the terminal choreographs the issue of receipts. Whether it’s a paper slip or a digital acknowledgment, a tangible memento is conjured to commemorate the transaction. Your card or your phone, having completed its quest, is ready for its next adventure.

The evolution of card payments over the last 30 years has been remarkable, transitioning from traditional methods to the present landscape, enriched by innovations like Apple Pay and Google Pay. Today, the simple act of tapping a card has become a seamless interaction facilitated by technology, reflecting the progression from conventional transactions to modern, digitised finance.

As we contemplate the journey of card payments over the last 30 years, it becomes crucial to acknowledge the expanding horizons of payment methods. The integration of wearable devices, such as watches, into the payment landscape symbolises a discernible shift towards more convenient and diversified payment options, thereby enhancing user experience and accessibility.

This transformation in payment methods is not just a technological evolution but also a race among the major players shaping the industry in what is known as “Big Data”. Observing the patterns of consumer behaviour and preferences has become a strategic focus for these players. The seamless transition from traditional transactions to modern, digitized finance has been guided by the pursuit of meeting consumer demands for efficiency and convenience.

Looking forward, the evolution of card payments is not just a technological advancement but a strategic response to the evolving landscape of consumer behaviour. The rise of blockchain technology presents new possibilities, prompting industry leaders to swiftly integrate its decentralised capabilities. Concurrently, open banking initiatives cater to the growing consumer demand for collaboration, enabling third-party providers to access financial data. In this race for innovation, legacy banks and traditional players must embrace these changes or risk becoming obsolete, underscoring the adapt-or-die imperative in the rapidly transforming world of consumer payments.

Looking ahead, the trajectory of card payments is poised for further transformation. The emergence of blockchain technology introduces both challenges and opportunities. Blockchain’s decentralised ledger system could reshape the industry’s landscape, potentially streamlining processes and enhancing security.

In this evolving landscape, major players in the payment industry face the dual challenge of adapting to emerging technologies like blockchain and navigating the impacts of open banking. The future holds a potential blend of efficiency gains and collaborative frameworks, creating a financial ecosystem that is both secure and adaptable to changing consumer preferences. As we move forward, the harmonisation of innovative technologies and regulatory frameworks will shape the next chapter in the evolution of card payments.

As the fintech sector anticipates a “tidal wave” of consolidation over the next 12 months, the landscape of the payment industry is poised for significant changes that cardholders and retailers alike should be attuned to. With a backdrop of a drying funding environment and market complexities, the fintech realm is witnessing larger players seeking to expand their reach through strategic mergers and acquisitions. For cardholders, this consolidation could mean a more streamlined and integrated payment experience, as established players acquire innovative startups to enhance their tech capabilities. Simultaneously, retailers may benefit from more robust payment solutions offered by well-capitalised fintechs, resulting in improved transaction efficiency and customer experiences. However, as the fintech industry undergoes this transformative phase, it remains to be seen which players will emerge as the leaders, navigating the challenges and opportunities presented by this dynamic era of consolidation.

london, willis building, reflection-3529954.jpg

This Article is brought to you by

Loopline Media

Catch up with the Author

Post-Brexit: data protection
Card processor sends sensitive data to wrong address
24 August 2022

Worldline SA subsidiary Payone GmbH has been accused of breaching data protection rules after it sent sensitive employee payroll information to the wrong address by accident. The Worldline Group holdS a 60% stake in the Frankfurt based company who have a small UK market presence.

In June 2021, one of Payone GmbH’s ex UK employees (the data subject) received a “potential data breach notification” from the firm advising him that his salary, National Insurance data, nationality (Special Category Data) was amongst various bits of information sent to an incorrect home address.

This included personal information such as the former employees name, age and address.  It also included details such as the date of birth and the amount of annual work bonus he received in his bank account amongst other identifiable data.

Payone GmbH confirmed that this document was sent out in error following an employee making a mistake when re-entering data processed by their third-party payroll provider.  The error arose when the employee was fulfilling an Article 15 GDPR request. The error was spotted by the data subject when he noticed in an email version of the document that the postal address was incorrect. An attempt to notify Payone GmbH of the error went in vain as the document was already irretrievably despatched.

The data subject was alarmed with the incident which exposed him to the possibility of fraudulent activity, amidst reasonable fears his data could end up on the dark web and used by criminals.  Habitually resident in the UK he complained to the Information Commissioner’s Office (ICO) in June 2021. He similarly raised the concern in Germany via The Hessian Commissioner for Data Protection and Freedom of Information (HBDI).

The ICO reprimanded Payone GmbH for the error in their final decision letter.
Similarly, the HBDI cited a violation of Article 5(f) of the General Data Protection Regulation (GDPR) relating to integrity and confidentiality.

The ICO stated in their July 2021 findings that Payone GmbH, “should take steps to ensure that all personal data records are accurate and up to date. Holding inaccurate information, such as addresses, does increase the risk of personal data breaches and poses risks to the security of information”.

The HBDI confirmed in their October 2021 findings that Payone GmbH had taken remedial action. They concluded that a monetary fine would not be imposed on Payone GmbH as they had taken technical and organisational steps in response to the data breach. Data subjects could now request their data in an autonomous portal.

The GDPR, which came into effect in 2018, gave the Information Commissioner’s Office greater powers to tackle data breaches. The new ‘UK GDPR’ charts its own course after Brexit whilst seeking to maintain EU GDPR adequacy.  In extreme scenarios, organisations face penalties of up to £20m or 4 per cent of their global worldwide turnover, whichever is more.

In the years prior to GDPR, the ICO fines were capped at £500,000.

The data subject said: “I am just glad I spotted it; they were going to resend the document again to another wrong address. Prior to Brexit the process would have been commenced via the ICO who in turn would liaise with the HBDI on the data subjects’ behalf; but I found myself communicating with both authorities separately which was an additional step but in the end was surprisingly
effective. Unfortunately, Payone GmbH again sent my incorrect address to the
Workers Pension Trust in January 2022, and documents yet again went to the wrong address. In my opinion they have not learned from the first time and my complaint is sitting with the ICO yet again”.

The former employee is pursuing a remedy under Article 82 UK GDPR via
the Court’s of England & Wales.

Extraordinary Experiences

Click edit button to change this text. Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Click edit button to change this text. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.

Our Core Values

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.

We use cookies to improve user experience and analyse website traffic. By clicking ‘Accept’, you agree to our website’s cookie use as described in our Privacy Policy.