What happens when you pay by card
You tap a card and a terminal beeps within a second. In that second a small computer in the card produced a cryptographic signature that can never be reused, a message crossed several companies and possibly an ocean, and a bank decided to lend the shop your money — which will not actually arrive for two days.
The 16 digits are not a random account number
The long number on a card is structured. Every part of it does a job, and one digit exists purely to catch typing mistakes before they cost anybody anything.
The full number is properly called the PAN — Primary Account Number. It is typically 16 digits, though 15 and 19 both exist, and it breaks into three parts.
| Part | Digits | What it does |
|---|---|---|
| IIN / BIN | First 6–8 | Identifies the issuing institution and the network |
| Account number | Middle | Identifies your account at that institution |
| Check digit | Last | Catches mistyped and transposed digits |
The first digit tells you the network
The leading digit identifies the industry the card belongs to, and in practice the network. A card beginning 4 is Visa; 51 to 55 and 2221 to 2720 are Mastercard; 34 and 37 are American Express. This is how a website shows the right logo the moment you have typed four digits, before it has contacted anything.
The check digit and the Luhn algorithm
The final digit is not part of your account. It is calculated from the others so that a mistyped number almost always fails an instant arithmetic test — the Luhn algorithm, devised at IBM in 1954.
- Starting from the right, double every second digit.
- If doubling gives a number above 9, subtract 9 from it.
- Add all the digits together.
- If the total is divisible by 10, the number is well-formed.
This catches every single-digit error and almost every transposition of adjacent digits — by far the two most common typing mistakes. It is why a checkout can tell you the number is wrong instantly, without asking the bank.
It is worth being clear about what it does not do. Passing the Luhn check means the number is plausible, not that it exists, not that it has money behind it, and not that it is yours. Generating numbers that pass is trivial; only the bank knows which ones are real.
CVV, expiry, and why they are separate
CVV / CVC
Three digits on the back, computed from the card number and expiry using a key only the bank holds. It is deliberately not stored in the magnetic stripe or chip, so stealing the card data does not yield it.
iCVV
A different value held in the chip, so chip data copied onto a magnetic stripe produces the wrong code and is rejected.
dCVV
Some cards now show a code on a tiny screen that changes every hour, making a stolen code worthless almost immediately.
The takeaway The number identifies a bank, then an account, and checks itself. The security codes exist separately precisely so that knowing the number is not enough.
Chip and PIN: the card proves itself
A magnetic stripe is a recording. Anything that can read it can copy it, and a copy is indistinguishable from the original. The chip replaced that with something a copy cannot reproduce: a small computer that performs a calculation no one else can perform.
The chip is a genuine microprocessor with its own storage and cryptographic hardware. Inside it is a secret key that was written during manufacture and, by design, cannot be read out again — not by the terminal, not by your bank, not by anyone with the card in their hand.
The cryptogram is the whole point
The terminal hands the chip the transaction details. The chip combines them with its secret key and an internal counter, and returns an application cryptogram — a short value that only a chip holding that key could have produced for those details. The bank, which holds the matching key, recomputes it and checks.
Because the counter increments on every use and is included in the calculation, each cryptogram is unique and strictly ordered. A replayed one is detected immediately. This is the mechanism that effectively ended card cloning as a mass crime, and the fraud statistics after EMV rollout in each country show it clearly.
What the PIN actually verifies
It is worth separating two distinct questions. The cryptogram proves the card is genuine. The PIN proves the person is entitled to use it. These are independent, and EMV calls the second one cardholder verification.
| Method | How it is checked | Where you see it |
|---|---|---|
| Offline PIN | Compared inside the chip itself | Chip and PIN, works offline |
| Online PIN | Encrypted and sent to the bank | ATMs, and some terminals |
| Signature | A human compares it, in theory | Largely retired |
| No verification | None below a floor limit | Contactless small purchases |
| On-device | Face or fingerprint on your phone | Apple Pay, Google Wallet |
Offline PIN is the interesting one: you type the PIN, the terminal passes it to the chip, and the chip says yes or no. The PIN never leaves the card, which is why chip and PIN works on a terminal with no network connection at all — on an aircraft, or in a market with no signal.
The liability shift, which is why it happened
EMV was not adopted out of enthusiasm. The networks set a date after which responsibility for fraud fell on whichever party had not upgraded. If the shop still used stripe-only terminals, the shop paid; if the bank had not issued chip cards, the bank paid. That commercial pressure, rather than the technology, is what moved an entire industry.
The takeaway The chip performs a calculation only it can perform, over details unique to this transaction. Copying it gives you a card that cannot produce tomorrow's answer.
Contactless: the same chip, at a distance
Contactless is not a different, weaker system. It is the same chip running the same cryptography, powered and spoken to over a short-range radio link instead of through metal contacts. The differences are in the limits placed around it.
The card contains an aerial — a loop of wire running round the inside of the plastic. The terminal generates a magnetic field at 13.56 MHz, and that field induces enough current in the loop to power the chip. The card has no battery and never has; it is inert until it is close to a reader.
The range is a physical limit, not a rule
The field falls away extremely quickly with distance — far faster than a normal radio signal, because this is inductive coupling rather than propagating waves. Beyond a few centimetres there is simply not enough energy to run the chip. That is why the working range is what it is, and why 'remote skimming from across a room' requires equipment considerably larger than a room.
Why it sometimes demands the PIN anyway
The random-seeming PIN request is not random. The card keeps its own counters, and so does the bank. After a set number of consecutive contactless taps, or once the untested total passes a threshold, the next transaction requires a PIN to reset the counters. European regulation formalised this as strong customer authentication.
Issuers also trigger it on pattern. A tap in a city you have never visited, or an unusual sequence of purchases, will prompt verification regardless of the amount.
Two cards in one wallet
If two contactless cards are in range at once, a well-built terminal detects the collision and refuses, asking you to present one card. This is deliberate — the alternative, silently charging whichever responded first, would be considerably worse. Terminals that occasionally charge the wrong card are failing to implement the collision check properly.
The takeaway Contactless runs the same cryptography as chip and PIN, powered by the terminal's own field. Its safety comes from physics limiting the range and from limits capping what a stolen card can do.
Apple Pay and Google Wallet: your number is never used
Paying by phone feels like using a picture of your card. It is not. The merchant never receives your card number, because the phone was never given it — what it holds is a substitute that only works from that device.
When you add a card to a phone wallet, the details go to the card network and the bank, which return a Device Account Number — a different 16-digit number, tied to that specific phone, useless anywhere else. This is tokenisation, and it is the core of the whole design.
Where the token lives
The token and its keys are kept in a secure element: a separate tamper-resistant chip, or a protected region of the main processor, isolated from the operating system. Apps cannot read it. A rooted or jailbroken phone cannot extract it. Even the wallet app itself only asks the secure element to produce a cryptogram; it never handles the keys.
The biometric is a local check
Your face or fingerprint is not sent anywhere. The sensor compares against a mathematical template stored in the same secure hardware, and the only thing that leaves is a yes — which authorises the secure element to sign one transaction. Neither Apple, Google, the bank nor the shop receives anything biometric.
To the payment network, this counts as cardholder verification, which is why phone payments are not subject to the £100 contactless limit. The bank has stronger evidence that you are present than a PIN provides.
| Plastic contactless | Phone wallet | |
|---|---|---|
| Number sent to shop | Your real card number | A device-specific token |
| Verification | None below the limit | Face or fingerprint, every time |
| Spending limit | £100 per transaction | No contactless limit |
| If the merchant is breached | Your card must be replaced | Cancel the token; card unaffected |
| If the device is lost | Card must be cancelled | Token disabled remotely |
| Works offline | Yes | Yes, for a limited number of taps |
A genuine improvement, and an underrated one
Tokenisation quietly removes the single biggest source of card fraud: merchants storing numbers that later leak. The shop cannot lose what it never received, and a compromised token can be revoked without reissuing the physical card or changing the number on your direct debits.
The takeaway The phone holds a substitute number that only works from that device, signed by hardware the operating system cannot reach. Your actual card number never reaches the shop.
Who talks to whom in that one second
The approval that arrives in under a second has travelled through at least four separate companies. Knowing which is which explains why a payment can fail in several completely different ways.
The merchant
The shop, and the terminal or website taking the payment.
The acquirer
The merchant's bank or payment processor. It collects the transaction and puts it onto the network.
The network
Visa, Mastercard, Amex. It routes the message to the right issuer and sets the rules everyone follows.
The issuer
Your bank. The only party that decides whether to approve, because it is the only one that knows your balance.
Approval is not payment
This is the part that surprises people most. An approval does not move any money. It places a hold on your available balance — the issuer has promised to pay, and has reduced what you can spend accordingly. The money itself moves later, in a batch.
| Stage | When | What happens |
|---|---|---|
| Authorisation | Instantly | Funds held; nothing has moved |
| Batching | End of the merchant's day | The day's approvals are submitted together |
| Clearing | Next day or so | The network works out who owes whom |
| Settlement | 1–3 working days | Money actually moves between banks |
| Posting | When settled | The pending entry becomes a real one on your statement |
This explains several familiar oddities. A pending transaction disappearing after a few days is an authorisation that was never captured. A hotel or fuel pump holding an amount larger than you spent is an estimated authorisation, corrected at settlement. A refund taking days while the payment was instant is because the refund has to go all the way through settlement, with no authorisation shortcut.
Where the money goes
The shop does not receive the full amount. A percentage is deducted and divided among the parties. The largest share, interchange, goes to your bank — which is what funds cashback and rewards on premium cards, and why some merchants historically surcharged for them. In the EU and UK, interchange on consumer cards is capped by law at 0.2 to 0.3 percent.
The takeaway Four companies and a round trip in under a second, and at the end of it no money has moved — only a promise, which settles days later.
Why an ATM behaves differently
An ATM runs the same card, the same chip and much of the same network — and is noticeably stricter at every step. The reason is simple: it dispenses irreversible physical cash, and there is no chargeback for banknotes.
The PIN always goes to the bank
A shop terminal often uses offline PIN, checked inside the card. An ATM never does. It encrypts your PIN inside a tamper-resistant hardware security module the moment you type it, and sends it to your bank to be verified. The PIN is never in plain form anywhere in the machine, even momentarily in memory.
The keypad itself is a sealed cryptographic device. Attempts to open it destroy the keys inside, rendering the module useless. This is why ATM keypads feel so solid and why they are replaced as whole units.
Nothing happens offline
A shop terminal that loses its connection can approve small purchases offline using the chip's own risk rules, and submit them later. An ATM cannot and does not. If it cannot reach your bank it will not dispense, because the entire safeguard is the bank confirming the balance in real time.
| Shop terminal | ATM | |
|---|---|---|
| PIN checked | Often inside the card | Always by the bank |
| Works offline | Yes, below floor limits | Never |
| Contactless | Standard | Sometimes, PIN still required |
| If disputed | Chargeback available | Very difficult — cash is gone |
| Physical security | Modest | Sealed crypto keypad, vault, cameras |
| Fee to you | None | Possible, and must be disclosed first |
Skimming, and why it persists here
Skimmers survive at ATMs because of one weakness that has nothing to do with the chip: the magnetic stripe is still on the card, for compatibility with countries that have not fully migrated. A skimmer copies the stripe while a pinhole camera or an overlay keypad records the PIN, and the clone is used somewhere that still accepts stripe transactions.
The defences are practical rather than clever: cover the keypad with your other hand, which defeats the camera entirely; pull firmly on the card slot and the keypad surround, since overlays are attached with adhesive; and prefer machines inside bank branches. Newer cards omit the stripe altogether, which ends the attack outright.
The machine itself is a small fortress
Behind the panel, the cash sits in a separate certified safe with its own lock, dispensed through a mechanism that counts notes and can detect a double-feed. The computer driving the interface has no physical means of opening the safe — it can only ask the dispenser for a specific number of notes. That separation is why malware on an ATM's computer is a serious problem but not an automatic jackpot.
The takeaway Six steps, a chip that signs, a token that is not your number and a promise that settles days later — and the cash machine is stricter than all of it, because banknotes cannot be un-dispensed.