Payment Training

F · Foundations

The parties of a payment, data representation, card data and the codes met every day.

• F1 The payment ecosystemCardholder, merchant, acquirer, network and issuer: who does what, and who earns what.
• F2 Data representation and bit operationsHex, binary, BCD, ASCII and EBCDIC, XOR and bit numbering: the encodings behind most payment bugs.
• F3 Card data: PAN, Luhn, tracks and service codeWhat is on a card and how to read it: the PAN and its check digit, track data, the service code, masking.
• F4 The codes met every dayMTI, POS entry mode, condition code, response codes, MCC and currency codes.

B · Products, channels and flows

Debit, credit and prepaid; transaction types; authorisation, clearing and settlement; POS and ATM.

• B1 Debit, credit and prepaidWhere the money comes from, single vs dual message, CVMs, account selection, refunds, partial approval and disputes.
• B2 Transaction typesPurchase to batch close: each type's messages, processing code, amount fields, PIN rule and how it is undone.
• B3 Transaction flows: authorisation, clearing and settlementThe message sequences end to end, holds and posting, interchange and settlement, reversals, stand-in and chargebacks.
• B4 POSTerminal types and integration, entry modes, configuration, batches, receipts, tips and store-and-forward.
• B5 ATMThe ATM and its host, ATM transactions, dispensing and partial dispense, ATM keys, card retention and balancing.
• B6 Dynamic currency conversion (DCC)Letting a foreign cardholder pay in their own currency: eligibility, the rate and markup, the cardholder's choice and the receipt, the amounts in the messages, refunds, and how DCC compares with the network's conversion.

C · Cryptography

DES, TDES and AES; parity and check values; hash and HMAC; RSA and PKI; LRC and CRC.

• C1 DES, 3DES and AESBlock ciphers, two- and three-key TDES, modes, IVs and padding, and where payments use each.
• C2 Key parity and key check valuesOdd parity on DES keys, and the key check values (KCV) every key exchange is verified with.
• C3 Hash and HMACSHA-1 and SHA-2, HMAC, and the difference between a hash, a MAC and a signature.
• C4 RSA and PKI in paymentsKey pairs, signatures and certificates, and where payments use RSA: EMV, TR-34, TLS.
• C5 LRC, CRC and check digitsError detection on links and in data: LRC framing, CRC parameters, and why a checksum is not a MAC.

K · Key management

The key hierarchy, components, variants, TR-31 key blocks, remote key loading and DUKPT.

• K1 Key hierarchy and key typesFrom the HSM master key to working keys: every key type and its single purpose.
• K2 Components, split knowledge and dual controlHow custodians create, exchange and verify keys without anyone knowing the whole key.
• K3 Key variantsBinding a key to its use by XOR with a variant constant, and why key blocks replaced variants.
• K4 TR-31 key blocksThe header, the key usage and mode of use, versions A to D, wrapping, unwrapping and the MAC.
• K5 Remote key loading and TR-34Why remote key loading exists, and the TR-34 flows at a high level.
• K6 DUKPT (TDES)A unique key per transaction: BDK, IPEK, KSN, the counter and the PIN, MAC and data variants.
• K7 DUKPT AESAES DUKPT: derivation data, key types and usages, the 32-bit counter and the move from TDES DUKPT.

P · PIN and card security

PIN blocks, PIN verification, card verification values and the HSM.

• P1 PIN blocksISO 9564 formats 0 to 4: building, encrypting, decoding and translating PIN blocks.
• P2 PIN verification: IBM 3624 and Visa PVVWhat the issuer does with the PIN: natural PIN and offset, the decimalisation table, PVV.
• P3 Card verification valuesCVV, CVV2 and iCVV, the role of the service code, and dynamic values in concept.
• P4 The HSMWhat stays inside the HSM, and the commands a host sends to translate and verify PINs, MACs and cryptograms.

M · Messages and integrity

ISO 8583, MACs, and how messages travel between systems.

• M1 ISO 8583MTI, bitmaps, field types and lengths, encodings, the fields that matter and the message flows.
• M2 MACCBC-MAC, retail MAC, CMAC and HMAC: padding, truncation, what is MACed and with which key.
• M3 Message framing and host linksLength headers, STX / ETX / LRC, timeouts, retries, reversals on timeout, STAN and RRN, echo tests.

E · Chip and beyond

EMV for payment developers, card-not-present payments and tokenization.

• E1 EMV for payment developersChip vs stripe, TLV, the transaction at a glance, ARQC / ARPC key derivation and field 55.
• E2 Card-not-present: 3-D Secure and tokenization3-D Secure, ECI and CAVV, network tokens and their cryptograms, card-on-file, EMV QR.

S · Security, compliance and testing

Sensitive data and PCI, testing payment software, and a troubleshooting playbook.

• S1 PCI and sensitive dataWhat may be stored and what never, masking and truncation, test data, and the PCI standards in a developer's words.
• S2 Testing payment softwarePositive and negative tests per component, test cards, keys and simulators, known-answer tests, regression.
• S3 Troubleshooting playbookFrom a symptom (response code, HSM error, KCV mismatch, MAC failure) to the root cause.

Paths by role

• Terminal / POS developer: Builds the payment application on a terminal, PIN pad or SoftPOS (22 modules)
• ATM developer: Builds or integrates ATM software and the ATM host (24 modules)
• Host / switch developer: Builds the acquirer host, gateway or switch (28 modules)
• Issuer / HSM developer: Builds the authorisation system, card management or HSM integration (23 modules)
• Payment tester / QA: Tests any of the above and prepares certification (23 modules)
• Key custodian / security officer: Runs key ceremonies and owns key management procedures (12 modules)