Learn by doing

Payment puzzles

Route a payment through the systems of a real card network. Some routes reach the bank and still fail, and each failure tells you what would go wrong in production and where to read about it.

Mission

A chip card is inserted at a coffee shop. Route the authorization request to the bank that issued the card.

Start at Chip card and click connected systems one hop at a time until you reach the goal. Some routes reach the goal and still fail. Par: 4 hops.

CustomerMerchantAcquirer / PSPCard schemeIssuerEMV chip: signs each transaction with an ARQC cryptogram.💳Chip cardSTARTHolds a device token (DPAN), never the real card number.📱Phone walletThe shopper at an online checkout.🌐BrowserReads the card or phone and builds the authorization request.🏪POS terminalThe merchant’s online payment page.🛒Web checkoutHardware security module: translates PIN blocks between keys.🔐Acquirer HSMThe merchant’s bank: routes requests to the right card network.🏦Acquirer hostConnects checkouts and terminals to the acquirer.⚙️Payment gatewayRuns 3-D Secure for the merchant or its PSP.🛡️3DS ServerToken vault: maps device tokens back to real card numbers.🪙Token serviceRoutes authorizations between acquirers and issuers by BIN.🔗Card network3-D Secure router: finds the issuer’s ACS for a card range.🧭Directory ServerVerifies PINs, ARQCs and CAVVs without exposing keys.🔑Issuer HSMThe cardholder’s bank: approves or declines.🏛️Issuer hostGOALAccess Control Server: the issuer’s 3-D Secure authenticator.✅ACS

Your route · 0 hops

  1. Chip card

The levels and what they teach

  1. Chip at the counterWarm-up

    Can you get a chip payment from the counter to the card’s bank?

    Play this levelRead: ISO 8583 Protocol

  2. Tap with a phoneMedium

    Can you get a phone tap approved by a bank that has never seen the phone’s card number?

    Play this levelRead: Payment Tokenization

  3. Online PINHard

    Can you get an encrypted PIN to the issuer without anyone reading it on the way?

    Play this levelRead: TR-31 & TR-34 Key Standards

  4. Checkout with 3-D SecureExpert

    Can you authenticate and authorize an online payment in the right order?

    Play this levelRead: 3D Secure (EMV 3DS)