In What Money Actually Is, we established that money is a ledger, a shared record of who owes what to whom. But when you tap your card at a coffee shop, the ledger update isn’t simple. Your money isn’t in the same bank as the shop’s money. Your bank isn’t in the same country as the card network. Nobody trusts anyone else. And yet, in under two seconds, everybody agrees that you’ve paid. How?
The tap
You hold your card against the terminal. An NFC radio in the card powers up, it doesn’t have a battery; the terminal’s electromagnetic field provides the energy, the same principle as a transformer. The card and terminal exchange a few hundred bytes of data: card number, expiry, a one-time cryptogram generated by the card’s chip that proves the physical card is present. This entire near-field conversation takes about half a second.
If the amount is below the contactless limit, $200 in Australia as of 2022, raised from $100 during the pandemic, the terminal doesn’t ask for a PIN. Above it, you’ll need to verify. The limit varies by country: it’s $250 in the US (though US contactless adoption is much lower), £100 in the UK, and €50 in much of Europe.
But here’s the thing that surprises people: the terminal isn’t talking to your bank. It’s talking to the shop’s bank. Everything that follows is a chain of messages between organisations that have agreed on a protocol, passing your payment along like a relay race.
The four-party model
The modern card payment system involves four parties, which is why the industry calls it the four-party model (or four-corner model). Understanding these four parties explains almost everything about how card payments work, including why they cost what they cost.
The cardholder is you. You have a card issued by your bank.
The issuer is your bank, the one that gave you the card. They extended you a line of credit (for a credit card) or gave you access to your deposit account (for a debit card). They’re on the hook if you don’t pay your bill or if fraud occurs on your card. In Australia, the big four issuers are CBA, Westpac, NAB, and ANZ, though dozens of smaller banks and fintechs issue cards too.
The acquirer is the merchant’s bank, the financial institution that processes payments on behalf of the coffee shop. The shop has a “merchant account” with this acquirer, and the acquirer provided (or arranged) the card terminal. In Australia, large acquirers include CBA, Tyro, Fiserv (formerly First Data), and Square. The acquirer takes the risk that the merchant is legitimate and won’t generate excessive chargebacks.
The card network is Visa, Mastercard, or (in Australia and some other markets) eftpos. The card network doesn’t hold anyone’s money. It doesn’t issue cards. It doesn’t process payments on behalf of merchants. What it does is run the messaging system that connects issuers and acquirers, and it sets the rules that everyone follows.
This is the part that confuses people: Visa is not a bank. Visa is a messaging network. When you tap your Visa card, Visa routes the authorisation request from the acquirer to your issuer, and routes the response back. It’s a very fast, very reliable, very expensive post office. Mastercard works the same way. Between them, they process roughly 700 million transactions per day globally (Nilson Report, 2023).
American Express and Discover are different, they’re three-party models, where the network is also the issuer and the acquirer. Amex issues the card, signs up the merchant, and handles the whole thing. This gives them more control but means they need merchant relationships everywhere, which is why Amex acceptance is patchier than Visa or Mastercard.
The authorisation
When you tap, here’s what actually happens, step by step.
Step 1: Terminal to acquirer. The terminal packages the transaction details, card number, cryptogram, amount, merchant identifier, timestamp, and sends them over the internet (or a dedicated line) to the acquirer’s processing system. This takes a few hundred milliseconds.
Step 2: Acquirer to network. The acquirer identifies the card network from the card number. Visa card numbers start with 4. Mastercard numbers start with 5 (or 2, since 2017). The acquirer formats an authorisation request message using the ISO 8583 standard, the financial messaging format that has been the backbone of card payments since 1987, and sends it to the network.
ISO 8583 deserves a closer look. It’s a binary message format that defines fields for everything: card number (field 2), processing code (field 3), amount (field 4), transmission date (field 7), and so on, up to 128 possible fields. Every card terminal in the world, every acquirer, every network, and every issuer speaks ISO 8583. It’s not elegant, it’s a product of the 1980s, with packed-decimal encoding and fixed-length fields, but it’s universal, and universality matters more than elegance in payments.
Step 3: Network to issuer. The card network looks up which issuer owns the card number (this is determined by the first six to eight digits, called the BIN. Bank Identification Number) and routes the message to that issuer’s authorisation system. If you have a CBA Visa card and you’re buying coffee in Perth, the message goes from the acquirer in Australia, to Visa’s processing centre (probably in the US or Singapore), to CBA’s authorisation system in Sydney.
Step 4: Issuer decides. Your bank’s system checks: Is this card valid? Is it blocked or reported stolen? Is there enough credit (or enough money in the account for debit)? Does this transaction look suspicious? Has the daily spending limit been exceeded? Is the merchant in a blocked category? This is where fraud detection kicks in, we’ll cover that in detail in How Fraud Detection Works.
The issuer returns an authorisation response: approved, declined, or “refer to issuer” (which effectively means declined, no one picks up a phone anymore). The whole decision typically takes under 100 milliseconds.
Step 5: Back up the chain. The response travels back: issuer to network, network to acquirer, acquirer to terminal. Your card beeps or the terminal shows “APPROVED.” The barista hands you your coffee. The whole thing took maybe 1.5 seconds.
But, and this is the crucial bit, no money has moved yet. The authorisation is a promise. Your bank has said “yes, this cardholder is good for it.” That’s all. The actual movement of money comes later.
Clearing and settlement
The movement of money between banks happens in two stages: clearing (working out who owes whom) and settlement (actually transferring the funds).
Clearing happens in batches. At the end of each day (or multiple times per day), the acquirer sends a batch of all the day’s authorised transactions to the card network. The network matches these against the authorisations it routed, aggregates them by issuer, and calculates the net amounts. If CBA-issued cards spent $1 million at merchants using Westpac as their acquirer, and Westpac-issued cards spent $800,000 at merchants using CBA as their acquirer, the net flow is $200,000 from CBA to Westpac. This netting is important, it dramatically reduces the number of actual money transfers needed.
Settlement is when the money moves. The card networks settle through commercial banks that hold settlement accounts. In Australia, final settlement happens through the Reserve Bank of Australia’s RITS (Reserve Bank Information and Transfer System). The funds move between the banks’ exchange settlement accounts at the RBA. This is the final, irrevocable transfer, the point where the ledger entry becomes official.
The whole clearing and settlement cycle typically takes one to three business days, depending on the market and the network. This is why merchants don’t receive their money instantly. The coffee shop you tapped your card at this morning will see the funds in their account tomorrow, or the day after.
Why does it take so long? Not for technical reasons. The computers could settle in real time. It takes days because the batch-processing model is deeply embedded in the banking system’s risk management and liquidity planning. Banks need time to net positions, manage their settlement accounts, handle exceptions and disputes, and satisfy regulatory requirements. There are also time zones, a transaction involving a US issuer and an Australian acquirer crosses the International Date Line, and the two banks’ batch cycles don’t align. The delays are institutional, not technical, which is exactly why they’ve been so hard to eliminate.
Interchange: the hidden tax
Every card transaction incurs an interchange fee, a payment from the acquirer to the issuer. When you buy that coffee, the acquirer doesn’t pass the full amount to the merchant. It deducts the acquirer’s own fee (called the merchant service fee), and a component of that fee is interchange, which flows back to the card-issuing bank.
Interchange is the economic engine of the card system. It compensates the issuer for the risk of extending credit, the cost of fraud protection, and the interest-free period you enjoy on credit card purchases. Without interchange, issuers would have no incentive to issue cards, and the system would collapse.
The rates vary by country, card type, and merchant category. In Australia, the RBA regulates interchange and has pushed rates down significantly. The weighted average interchange rate for credit cards in Australia is capped at 0.50%, and for debit cards at $0.085 per transaction (or 0.20% for percentage-based schemes). In the US, where interchange is less regulated, credit card interchange averages around 2.0-2.5%, dramatically higher. The Durbin Amendment (2010) capped US debit interchange for large banks at roughly 0.05% plus $0.22 per transaction, but credit cards remain expensive.
To put numbers on it: if you buy a $5 coffee with a Visa credit card in the US, the merchant might pay $0.30 in total fees, about 6% of the transaction. In Australia, the same transaction might cost the merchant $0.05-0.10. This is why some US merchants still refuse cards for small purchases, and why the Australian merchant experience is noticeably different.
The merchant never sees the interchange line item directly, they see a single merchant service fee from their acquirer, which bundles interchange, the network’s assessment fee, and the acquirer’s own margin. But interchange is typically 70-80% of the total fee. When merchants complain about card acceptance costs, they’re mostly complaining about interchange.
SWIFT and correspondent banking
Card payments handle retail transactions. But what about sending money to another country? What about a business paying a supplier in Germany, or a parent sending money to a child studying in Japan?
This is the domain of SWIFT, the Society for Worldwide Interbank Financial Telecommunication. Founded in 1973 and headquartered in Belgium, SWIFT is a messaging network connecting over 11,000 financial institutions in more than 200 countries. Like Visa, SWIFT doesn’t move money. It sends messages, specifically, standardised financial messages that tell banks what to do.
A SWIFT payment message (an MT103, in SWIFT’s terminology) says something like: “Bank A in Sydney, please debit your customer’s account and arrange for Bank B in Frankfurt to credit this beneficiary’s account with this amount in euros.” The message travels over SWIFT’s secure network, and the banks handle the actual money movement.
But here’s the problem: Bank A in Sydney and Bank B in Frankfurt probably don’t have accounts with each other. They don’t have a direct settlement relationship. So the payment has to go through correspondent banks, intermediary banks that maintain accounts (called nostro and vostro accounts, from the Italian for “ours” and “yours”) with banks in other countries.
The chain might look like this: your bank in Sydney sends the SWIFT message to its US dollar correspondent in New York (probably a major bank like JPMorgan or Citibank). That correspondent converts the currency, takes a fee, and sends a new SWIFT message to its correspondent relationship in Europe, who sends a message to the beneficiary’s bank in Frankfurt, who credits the beneficiary’s account. Each step takes time and costs money. Each intermediary takes a cut. By the time the payment arrives, the recipient might have lost 3-5% in fees and spreads, and it might have taken three to five business days.
This is why international transfers are expensive and slow, and why companies like Wise (formerly TransferWise) built their businesses on bypassing the correspondent banking chain. Wise holds local bank accounts in many countries and does its own netting, if someone in Australia wants to send money to the UK and someone in the UK wants to send money to Australia, Wise can pair them internally without the money ever crossing a border. The money stays local; only the ledger entries cross.
Real-time payments
The slowness of traditional payment systems has driven a global push toward real-time payment systems, infrastructure that settles payments in seconds, 24 hours a day, 365 days a year.
Faster Payments in the UK launched in 2008 and was one of the first. A bank transfer that used to take three days now arrives in seconds. The system processes about 4 billion transactions per year.
NPP (New Payments Platform) in Australia launched in 2018. It enables real-time transfers between Australian bank accounts using PayID, you can send money to someone’s phone number or email address instead of needing their BSB and account number. The underlying infrastructure settles in real time through the RBA, meaning the money genuinely moves, it’s not just an IOU that settles later. NPP processes around 1.5 billion transactions per year and growing.
FedNow in the US launched in July 2023, and it’s remarkable mostly because of how late it arrived. The world’s largest economy, home to the world’s most sophisticated financial technology industry, didn’t have a real-time payment system until 2023. Before FedNow, the US had the ACH (Automated Clearing House) system, which typically settled next business day, and Fedwire, which was real-time but wholesale-only and expensive. Zelle, Venmo, and Cash App existed, but they were overlays on top of the existing slow infrastructure, they showed you the money instantly through clever float management, but the actual settlement still crawled through ACH.
UPI (Unified Payments Interface) in India, launched in 2016, is arguably the most successful real-time payment system in the world. It processed over 13 billion transactions in a single month (December 2024), more than all card transactions in India combined. UPI is free for consumers and nearly free for merchants, which is a deliberate policy choice by the Indian government and the RBI. The system connects directly to bank accounts, bypasses card networks entirely, and runs on QR codes and mobile phones. A street vendor in Mumbai can accept digital payments with zero hardware cost, just a printed QR code.
India went from a cash-dominated economy to a digital-first economy in under a decade, partly because of UPI and partly because of demonetisation (the Modi government withdrew 86% of banknotes by value in November 2016, forcing rapid digital adoption). Whatever you think of the policy, the technological achievement is extraordinary.
PIX in Brazil, launched in November 2020, followed a similar model. Instant, 24/7, free for individuals. Within two years, it had more users than credit and debit cards combined.
The pattern is clear: real-time payment systems, once they exist and reach critical mass, rapidly displace both cash and card payments. The card networks. Visa and Mastercard, are keenly aware of this threat, which is partly why they’ve been acquiring real-time payment companies and expanding into account-to-account payments. The messaging post office sees the competitors building their own postal services.
Why settlement takes three days (and why it shouldn’t)
The traditional card settlement cycle. T+2 or T+3 (transaction date plus two or three business days), exists for historical reasons that are increasingly hard to justify.
When card processing was manual, merchants collected paper vouchers, bundled them, and physically delivered them to their acquiring bank. The bank processed them, sent them to the card network, which sorted them and sent them to the issuing banks. Each step took a day. Three days was fast.
Today, every step is electronic, and the authorisation already happens in real time. The three-day delay exists because the batch clearing and settlement cycle was designed around the operational rhythms of banks in the 1970s, and changing it requires coordinating across thousands of institutions globally. It’s a coordination problem, not a technology problem.
The US equity markets faced the same issue. Stock trades settled on a T+3 cycle for decades, you’d buy a share on Monday and the settlement wouldn’t complete until Thursday. In May 2024, the SEC mandated a move to T+1 settlement. The reasoning was simple: every day of delay is a day of risk. If the counterparty fails between trade and settlement, you’re exposed.
Card payments are heading the same direction, slowly. Visa and Mastercard have both announced initiatives to accelerate settlement times. In some markets, next-day settlement is already available for an additional fee. But true real-time card settlement remains rare, because it would require rebuilding the liquidity management infrastructure that banks have relied on for fifty years.
The stack beneath the tap
The next time you tap your card, consider what just happened. An NFC radio powered by electromagnetic induction exchanged a cryptogram with a terminal. The terminal sent an ISO 8583 message to an acquirer, which routed it through a global network to your issuing bank, which checked your balance and fraud risk in under 100 milliseconds and sent back an approval. The money was promised but not yet moved. Later, the transaction was batched, netted, cleared, and settled through central bank systems. An interchange fee flowed from the acquirer to the issuer. The merchant received the funds, minus fees, a day or two later.
All of this infrastructure, built over fifty years, involving thousands of institutions, governed by rules negotiated across continents, exists so you can buy a coffee without thinking about it. And it works. Not perfectly, not cheaply, and not as fast as it could. But it works.
Of course, not everyone who taps a card is buying coffee. Some of them are stealing. And the system has to tell the difference, in real time, billions of times a day.
How Fraud Detection Works is next, the cat-and-mouse game that decides whether your transaction goes through or gets blocked.