Card Networks — The Rails Your Code Runs On

What Is a Card Network?

A card network is the routing infrastructure that connects banks. When you use your Visa card at any store in the world, Visa’s network routes that transaction from the store’s bank to your bank. Think of it as the “internet” for money.

In one picture — the four-party model, with the network sitting in the middle as the switchboard:

flowchart LR
    CH["Cardholder<br/>has the card"] -->|pays| M["Merchant<br/>sells goods"]
    M -->|sends request| ACQ["Acquirer<br/>merchant bank"]
    ACQ <-->|routes| NET["Card network<br/>Visa or MC or RuPay"]
    NET <-->|routes| ISS["Issuer<br/>cardholder bank"]
    ISS -->|issued the card| CH

The four parties are cardholder, issuer, acquirer, and merchant. The network is the fifth piece in the middle that lets any acquirer reach any issuer without them needing a direct connection.

The Major Networks

How Card Numbers Work (BIN/IIN)

The first 6-8 digits of a card number are the BIN (Bank Identification Number):

4111 1111 1111 1111
│││└─────────────── Check digit (Luhn algorithm)
││└──────────────── Account number
│└───────────────── Issuer identifier
└────────────────── Network: 4 = Visa, 5 = Mastercard, 6 = RuPay/Discover

As a fintech engineer, you’ll use BIN tables to identify the card network, issuing bank, card type (credit/debit), and country — all from just the first 6-8 digits.

EMV — The Chip on Your Card

EMV (Europay, Mastercard, Visa) is the global standard for chip cards. This is what you worked with at a fintech job.

Why Chips Replaced Magnetic Stripes

APDU Communication (You Already Know This)

The terminal talks to the chip using APDU (Application Protocol Data Unit) commands:

Terminal → Card: SELECT AID (A0000000031010 = Visa)
Card → Terminal: OK, selected Visa application

Terminal → Card: GET PROCESSING OPTIONS
Card → Terminal: Here's what data I need from you

Terminal → Card: READ RECORD
Card → Terminal: Here's my card data

Terminal → Card: GENERATE AC (Application Cryptogram)
Card → Terminal: Here's the cryptogram for this transaction

AID (Application Identifier): Every card application has a unique AID.

Contactless (NFC) vs Contact (Chip Insert)

Card Transaction Types

As an engineer, you’ll handle each type differently. Pre-auth and capture are two separate API calls. Refunds need to match an original transaction. Chargebacks trigger a multi-step dispute process.

Tokenization — The Modern Standard

Card networks now support tokenization — replacing the actual card number with a token for security:

Real card:  4111 1111 1111 1111
Token:      4111 0012 3456 7890 (looks like a card number, but isn't)

• Token is specific to a device + merchant
• If stolen, useless elsewhere
• Google Pay, Apple Pay, Samsung Pay all use tokenization
• RBI mandated tokenization for online transactions in India (2022)

Interview question: “How does Google Pay work without storing your card number?” Answer: “It stores a device-specific token issued by the card network. Each transaction generates a unique cryptogram using this token, so even if intercepted, it can’t be replayed.”

What to Study Deeper (For Fintech Interviews)

1. ISO 8583 — The message format used between banks for card transactions
2. PCI-DSS — Security standard for anyone handling card data (next page)
3. 3D Secure (3DS) — The “OTP” you get for online card payments
4. Interchange fees — How networks make money (merchant discount rate)

Module done? Add it to today’s tracker