Payment puzzle · Medium

Can you get a phone tap approved by a bank that has never seen the phone’s card number?

Route it through a real card network, one hop at a time. Free, no sign-up.

Mission

A phone wallet taps the same terminal. The phone holds a device token, not the real card number. Get the request to the issuer in a form it can approve.

Start at Phone wallet and click connected systems one hop at a time until you reach the goal. Some routes reach the goal and still fail. Par: 6 hops.

CustomerMerchantAcquirer / PSPCard schemeIssuerEMV chip: signs each transaction with an ARQC cryptogram.💳Chip cardHolds a device token (DPAN), never the real card number.📱Phone walletSTARTThe shopper at an online checkout.🌐BrowserReads the card or phone and builds the authorization request.🏪POS terminalThe merchant’s online payment page.🛒Web checkoutHardware security module: translates PIN blocks between keys.🔐Acquirer HSMThe merchant’s bank: routes requests to the right card network.🏦Acquirer hostConnects checkouts and terminals to the acquirer.⚙️Payment gatewayRuns 3-D Secure for the merchant or its PSP.🛡️3DS ServerToken vault: maps device tokens back to real card numbers.🪙Token serviceRoutes authorizations between acquirers and issuers by BIN.🔗Card network3-D Secure router: finds the issuer’s ACS for a card range.🧭Directory ServerVerifies PINs, ARQCs and CAVVs without exposing keys.🔑Issuer HSMThe cardholder’s bank: approves or declines.🏛️Issuer hostGOALAccess Control Server: the issuer’s 3-D Secure authenticator.✅ACS

Your route · 0 hops

  1. Phone wallet

All levels and what they teach

  1. Chip at the counterWarm-up

    Can you get a chip payment from the counter to the card’s bank?

    Play this levelRead: ISO 8583 Protocol

  2. Tap with a phoneMedium

    Can you get a phone tap approved by a bank that has never seen the phone’s card number?

    Play this levelRead: Payment Tokenization

  3. Online PINHard

    Can you get an encrypted PIN to the issuer without anyone reading it on the way?

    Play this levelRead: TR-31 & TR-34 Key Standards

  4. Checkout with 3-D SecureExpert

    Can you authenticate and authorize an online payment in the right order?

    Play this levelRead: 3D Secure (EMV 3DS)