What has to happen, and in what order, for a withdrawal to be approved?
A withdrawal is a question sent to one bank and answered by another, in a few seconds, through machines that mostly belong to neither. The card reader reads a chip or a stripe. The encrypting PIN pad turns the PIN into a block under a key it shares with the host, so the number never crosses the wire in clear. The terminal handler packages card data, PIN block, amount and terminal identity into an ISO 8583 request, the message format the whole industry speaks, and sends it to the switch.
The switch reads the first six to eight digits of the card, the BIN, and consults a routing table to decide who can answer. If the card belongs to the bank that owns the machine, the transaction is on-us and goes straight to the core. If not, it is off-us and goes out over a network, STAR, NYCE or PULSE, or the card brands' Cirrus and Plus, to the issuer. Along the way a hardware security module translates the PIN block from the terminal's key to the network's key without ever exposing the PIN.
The issuer's host does the actual deciding: is the card open, does the PIN verify, is there money, is this the fourth withdrawal in ten minutes in a city the cardholder has never visited. It answers with an approval code or a decline reason and places a hold on the funds. No money has moved. If the dispenser then fails to hand out the cash, the terminal sends a reversal and the hold is released. The transaction that half-happened is the single largest source of ATM disputes.
The shape of that round trip is the same for a debit purchase at a store, which is why an ATM person can read a payments diagram and a payments person can read an ATM one. This track takes each piece in turn, then hands off to the payments track, which follows the money after the yes: clearing, settlement, and the three days in between.
Who the acquirer is, who the issuer is, and why the same withdrawal costs a different amount depending on whose machine it is.
plus 6 more parts in production