Payment puzzle · Expert

Can you authenticate and authorize an online payment in the right order?

Route it through a real card network, one hop at a time. Free, no sign-up.

Mission

A shopper in the EU pays on a website, and their bank requires Strong Customer Authentication. Get the payment authenticated by the card’s bank first, then authorized — and deliver the proof to where it is checked.

Start at Browser and click connected systems one hop at a time until you reach the goal. Some routes reach the goal and still fail. Par: 12 hops.

CustomerMerchantAcquirer / PSPCard schemeIssuerEMV chip: signs each transaction with an ARQC cryptogram.💳Chip cardHolds a device token (DPAN), never the real card number.📱Phone walletThe shopper at an online checkout.🌐BrowserSTARTReads the card or phone and builds the authorization request.🏪POS terminalThe merchant’s online payment page.🛒Web checkoutHardware security module: translates PIN blocks between keys.🔐Acquirer HSMThe merchant’s bank: routes requests to the right card network.🏦Acquirer hostConnects checkouts and terminals to the acquirer.⚙️Payment gatewayRuns 3-D Secure for the merchant or its PSP.🛡️3DS ServerToken vault: maps device tokens back to real card numbers.🪙Token serviceRoutes authorizations between acquirers and issuers by BIN.🔗Card network3-D Secure router: finds the issuer’s ACS for a card range.🧭Directory ServerVerifies PINs, ARQCs and CAVVs without exposing keys.🔑Issuer HSMGOALThe cardholder’s bank: approves or declines.🏛️Issuer hostAccess Control Server: the issuer’s 3-D Secure authenticator.✅ACS

Your route · 0 hops

  1. Browser

All levels and what they teach

  1. Chip at the counterWarm-up

    Can you get a chip payment from the counter to the card’s bank?

    Play this levelRead: ISO 8583 Protocol

  2. Tap with a phoneMedium

    Can you get a phone tap approved by a bank that has never seen the phone’s card number?

    Play this levelRead: Payment Tokenization

  3. Online PINHard

    Can you get an encrypted PIN to the issuer without anyone reading it on the way?

    Play this levelRead: TR-31 & TR-34 Key Standards

  4. Checkout with 3-D SecureExpert

    Can you authenticate and authorize an online payment in the right order?

    Play this levelRead: 3D Secure (EMV 3DS)