Articles about Cards — exploring patterns, best practices, and real-world implementations in production systems.
13 posts tagged with cards. ← All posts
Protect PINs with DUKPT key-per-transaction derivation and point-to-point encryption all the way to the HSM.
Protect PINs with DUKPT key-per-transaction derivation and point-to-point encryption to the HSM.
From BIN and program configuration through card production, HSM-backed PIN generation, and the real-time authorization controls engine.
Build the issuer side: BIN/program config, card production, PIN generation via HSM, and real-time authorization controls.
How a foreign cardholder is offered payment in their home currency, who earns the FX margin, and how the choice threads through authorization and clearing.
How DCC offers a cardholder their home currency at point of sale, the FX markup and disclosure rules, and settlement implications.
How Visa Account Updater and Mastercard Automatic Billing Updater keep stored credentials alive when cards get reissued, expire, or change numbers.
How VAU/ABU keep stored credentials current, credential-on-file mandates, and reducing involuntary churn from expired/reissued cards.
Why "authorize then capture" is a lie, and how to model a hold that grows, shrinks, expires, and reconciles against a moving available balance.
Pre-auth vs estimated vs incremental authorization (hotels, fuel, delivery), partial approvals, and reconciling holds against final capture.
How a network authorizes on the issuer's behalf when the issuer host is unreachable — and how the books get squared afterward.
How the network authorizes on the issuer's behalf during downtime using stand-in rules and limits, then reconciles advices when the issuer returns.
How a chip card proves it is genuine on every single transaction — and why a cloned magstripe never could.
How the chip generates an ARQC, the issuer validates it and returns an ARPC, plus offline data authentication (SDA/DDA/CDA) and terminal risk management.
How Visa and Mastercard are reshaping tokenization so an AI agent can pay on your behalf — with scoped credentials, agent-aware identity, and the network doing what it has always done: authenticate, authorize, tokenize.
How the card networks are adapting tokenization for agents.
Turn card transaction attributes into interchange, scheme, and markup lines that reconcile to the cent.
Teaches how to build a deterministic fee engine that classifies each transaction into an interchange category (regulated debit, rewards, CPS qualification) and computes interchange + scheme + acquirer markup for merchant statements.
Modeling the full card dispute lifecycle with reason codes, evidence deadlines, representment, arbitration, and provisional-credit ledger entries at every transition.
Teaches how to model the full card dispute lifecycle as a state machine with reason codes, evidence deadlines, representment, pre-arbitration and arbitration, and provisional-credit ledger entries at each transition.
How to model the card payment as a two-phase auth-then-capture flow plus a clearing tail — handling incremental auths, partial captures, reversals, expiry, and the auth-vs-settled reconciliation that trips up every ledger.
Teaches how to model the card transaction as a two-phase (auth then capture) plus clearing/settlement state machine, handling partial captures, incremental auths, auth expiry/reversal, and the auth-vs-settled amount reconciliation.
Wiring the 3DS Server, Directory Server, and issuer ACS into a handshake that produces a cryptogram your authorization message can carry.
Teaches how to integrate 3-D Secure 2: the 3DS Server, Directory Server and issuer ACS handshake, frictionless vs challenge decisioning, device data collection, and liability-shift outcomes feeding the authorization.
How a token vault and scheme-issued network tokens push the raw PAN out of your application systems, so most of your services fall out of PCI-DSS scope entirely.
Teaches how a token vault and network tokens (TR-31/EMV payment tokens) remove PAN from application systems, cutting PCI-DSS scope, and how token provisioning, cryptograms, and detokenization boundaries are architected.
All posts on this site are written by Pratik Dhanave, an Agentic AI Architect with 7+ years building production distributed systems, multi-agent AI platforms, and cloud-native infrastructure. About the author → Each article includes working code, architecture diagrams, and references to the specific frameworks and standards discussed. Browse all posts or explore related topics using the tag cloud above.