The terminal already knows the amount, the merchant, and — from the chip in your card — who is paying. Now it packs one standardized question: 0100, an authorization request. Not magic: a formatted message, built to a spec older than the web.
01Two seconds, and no money moved
One coffee, €4.50, a café counter at 19:42. You hold your card near the reader, it beeps, the barista glances at the green light. In about two seconds, five companies exchanged several messages, a chip produced a cryptographic signature, and your bank made a legal promise to a bank it will never talk to directly. The coffee is paid for.
Here is the part almost nobody pictures: at that moment, no money has moved. Your account shows a pending hold. The café's account shows nothing at all. The funds themselves will not budge for another one to three business days, when millions of small promises like this one are batched together, reconciled, and moved as a handful of net transfers between banks.
That gap between approved and paid is not an imperfection. It is the design. The two seconds buy certainty — a guarantee the coffee is covered — and the days buy efficiency: settling every €4.50 promise one by one would drown the banking system in its own transfers. This page follows one payment through both timelines.
02The cast of five
A card payment is not a conversation between you and the shop. It is a relay between five parties. On your side: you, and the bank that issued your card — the issuer, which holds your account and decides whether to answer yes. On the shop's side: the merchant, and its bank for card payments — the acquirer, which collects the shop's card receipts and pays them out.
Between the two banks sits the card network — Visa, Mastercard. Its job surprises people: it routes standardized messages and enforces a rulebook. It is not a bank. It holds no consumer deposits, lends nothing, and at no point in our story does the money pass through it.
The network is a messenger with a rulebook — not a place where money lives.
YOUcardholder
TAP · €4.50
SHOPmerchant
YOUR ACCOUNT
ITS BANK
ISSUERyour bank
NETWORKVisa · Mastercard
ACQUIRERmerchant's bank
MESSAGES · 0100 OUT, 0110 BACK
Act 03 — Two seconds, five stops: the authorization round trip
The question leaves over the internet to the merchant's bank side — the processor and acquirer — which relays it onward. Your bank has not seen it yet; the message is still climbing toward it.
The network reads the card number's prefix and routes the message to your bank, wherever it is. This is the network's real job: a router with a rulebook, connecting two banks that have no direct relationship.
Now your bank decides. Three checks, in milliseconds: is the card valid? Are funds available? Does the fraud score look right? If any answer is no, the payment dies here with a decline code.
Approved. Your bank answers 0110 with response code 00 — and places a hold on €4.50: a reservation, not a transfer. The promise is made.
The answer retraces the whole path — network, acquirer, terminal — and the reader beeps at roughly T+2,000 ms. Two promises now exist, and zero money has moved. The moving part comes days later.
04The question has a format
The message that races around that loop is not proprietary. It is ISO 8583, an international standard for card-transaction messages, first published in 1987. Every hop — terminal, acquirer, network, issuer — parses the same envelope: a message type, a bitmap saying which fields are present, and numbered data elements.
The request 0100 and its answer 0110 carry the amount, the merchant, the card number, the timestamp — and the chip's cryptogram, which we get to next. Forty years on, this 1987 envelope still carries trillions of euros a year.
FIELD NUMBERS ARE REAL ISO 8583 POSITIONS (F2 CARD NUMBER, F4 AMOUNT, F41 TERMINAL, F55 CHIP DATA). VALUES ON THIS STUB ARE ILLUSTRATIVE.
AUTH REQUEST · MTI 0100ISO 8583 · BORN 1987
F2 · CARD5413 •••• •••• 0031
F3 · PROCESSING000000 · PURCHASE
F4 · AMOUNTEUR 4.50
F7 · DATE / TIME0822 194207
F41 · TERMINALCAFE-0017
F43 · MERCHANTCAFE NOVA · BARCELONA
F55 · CHIP DATAARQC · 8 BYTES
✂ ✂ ✂
RESPONSE · MTI 0110FROM YOUR BANK
F39 · RESPONSE CODE00 · APPROVED
ACTIONHOLD €4.50
05The chip signs once
Anyone who reads your card number can type it somewhere. What they cannot do is produce the next ARQC — the Authorization Request Cryptogram your chip generates for exactly one transaction. Inside the chip sits a secret key that never leaves it. For each payment, the chip mixes that key with a transaction counter and signs the amount, the merchant, and the date, producing an 8-byte value. Your bank verifies it in the same milliseconds that check your funds.
Tap the same card twice and the two signatures share nothing — the counter moved. That is the whole reason a cloned chip card is worthless: a copy of yesterday's signature is refused today, and only your chip can mint tomorrow's.
TAP ONE · COUNTER 0847
INPUT€4.50 · CAFE NOVA · 19:42
ALGORITHMKEYED MAC · 8 BYTES
—
TAP TWO · COUNTER 0848
INPUT€4.50 · CAFE NOVA · 19:42
ALGORITHMKEYED MAC · 8 BYTES
—
SAME CARD, SAME AMOUNT, SAME SHOP. SIGNATURES SHARE NOTHING.
THIS FIGURE COMPUTES A SIMPLIFIED ILLUSTRATIVE MAC (A KEYED HASH OF AMOUNT · MERCHANT · TIME · COUNTER) SO YOU CAN WATCH IT CHANGE. A REAL ARQC USES THE CHIP'S SESSION KEY; THE PROPERTY SHOWN — ONE-TIME, VERIFIABLE — IS THE SAME.
Online there is no chip to tap, so European rules lean on your bank instead. Since September 2019, PSD2's Strong Customer Authentication requires two independent factors — something you know, something you have, something you are — before an online payment is sent. In practice that is 3-D Secure 2: the checkout hands you to your bank's app, you approve with a fingerprint, and only then does the familiar 0100 go out with proof attached. Small payments under €30 can skip it, up to a limit.
Act 06 — The money moves later: capture, clearing, settlement, payout
22:14, closing time. The café's systems submit the day's completed sales — capture. The two-second promise is now a formal claim: this payment really happened; pay it.
Clearing. Through the network, the two banks exchange the day's captured transactions and compute who owes whom, item by item — and the fees come due on each one.
Settlement. Across thousands of merchants and millions of payments, the banks owe each other nearly offsetting amounts — so only net positions move, often through central-bank accounts. This is the moment money actually moves.
Day two: the acquirer credits the café €4.41 — the claim minus the tolls, typically one to three business days after the beep. On your side, the hold quietly became a posted debit.
The finished state: your bank debited you once, the café's bank credited it once, and the 9-cent difference went to three tolls. Nothing about this was instant except the promises.
07The day-by-day ledger
The whole second timeline, as the two banks would book it. The hold from the two-second act becomes a real debit only at settlement; the café's money arrives after the net transfer, tolls already subtracted.
ONE PAYMENT · TWO TIMELINES€4.50 · CAFE NOVA
DAY 0 · 19:42:07APPROVED IN 2.0 S
DAY 0 · 22:14CAPTURED
DAY 1CLEARED · FEES DUE
DAY 1SETTLED NET €4.41
DAY 2PAID OUT €4.41
✂ ✂ ✂
APPROVED → PAID≈ 32 HOURS
TIMESTAMPS ARE ILLUSTRATIVE. THE FEE MODEL (€0.09 ON €4.50) IS A CARD-PRESENT ILLUSTRATION CONSISTENT WITH THE RATES IN THE NEXT SECTION.
08Three tolls
Every card payment pays three tolls between the beep and the payout. Interchange goes to the issuer — the price of its guarantee. In the EEA it is capped by law at 0.2% of the amount for consumer debit cards and 0.3% for credit. The scheme fee goes to the network for routing and rules. The acquirer's markup pays the processor that runs the merchant's side.
Merchants rarely see three numbers; they see one blended price. One published example: Stripe's standard EU rate for EEA cards, 1.5% + €0.25 per online payment — €1.00 of a €50 sale. Card-present tolls run lower, as below.
INTERCHANGE · CAPPED€0.10
SCHEME FEE€0.06
ACQUIRER MARKUP€0.19
MERCHANT KEEPS€49.65
ONE PUBLISHED BLENDED PRICE · STRIPE EU ONLINE · 1.5% + €0.25
€50 → €1.00
65,000
The scale of the loop
Transaction messages per second — the stated capacity of Visa's network. The loop you just scrolled through ran billions of times last year: in fiscal 2025, 329 billion transactions carried Visa brands, 258 billion of them processed on Visa's own networks, moving about $17 trillion between people and shops.
258B PROCESSED · FY2025
$17T VOLUME
175M+ LOCATIONS
14,500 BANKS
CAPACITY, NOT AVERAGE LOAD — THE FIGURE IS VISA'S OWN STRESS-TEST NUMBER.
Approved. Not paid. The beep was only the vote of confidence.
The whole idea
A card payment is two promises and a reconciliation.
In the two seconds, five parties agree that €4.50 is owed: your bank checks, signs off, and reserves the money. In the days after, millions of those promises are captured, cleared, and settled as net transfers between banks — and the merchant finally gets paid, minus three tolls. The speed you feel is in the messages; the money itself is patient.
Once you see the two timelines, ordinary mysteries resolve. The pending charge on your account is a hold waiting for capture. The fuel pump that pre-approves €120 is only asking for a bigger promise. The café that prefers cash is avoiding the tolls. And the guarantee-before-transfer shape is not unique to cards — it is the same instinct that makes databases write a log before they move data.
FINAL RECEIPTTHE WHOLE STORY
TAP19:42:07 · €4.50
QUESTION + ANSWER0100 → 0110 · 2.0 S
PROMISES MADEHOLD + GUARANTEE
MONEY MOVEDDAY 1 · NET
CAFÉ PAIDDAY 2 · €4.41
✂ ✂ ✂
THANK YOUPLEASE SCROLL AGAIN