Processing 24,000 Visa Transactions per Second: How It’s Done

VisaNet, the card network’s payment processing system, handles an average of 150 million transactions per day and the firm claims it is capable of processing more than 24,000 Visa transactions per second.

The most-accepted payments brand for e-commerce sales in the U.S. and Canada, Visa has been investing heavily in its infrastructure and its network just keeps expanding — there are more than 3 billion Visa debit and credit cards worldwide, and counting.

How is the payment world’s behemoth doing it? Well, that’s exactly what we will be looking at today. But first, let’s run through some numbers.

Table of Contents

1. Visa by the Numbers
2. Visa Transaction Processing — Who Is Involved?
3. Transaction Flow for Visa Magnetic-Stripe and Chip Cards
   • Transaction Life Cycles
     • Credit and Debit Transaction Online Authorization Process
     • Transaction Clearing and Settlement
4. Visa Transaction Process for SMS-Based Point-of-Sale and ATM
5. General Rules for Visa Processing
   • Visa Card Acceptance
   • Transaction Surcharges
   • Minimum Transaction Amount
   • Prohibited Uses
   • Taxes
   • Convenience Fees
   • Government and Education Payment Program Service Fee
   • Laundering
   • Tips
   • No Cash Refunds
   • Deposit Time Limits
   • Suppressed Account Number and Expiration Date
   • Delivery of Products and Services
   • Deposits
   • Installment Payments
   • Cardholder Information
   • Merchant Servicer Registration
   • Storage of Sensitive Data and Payment Application Use

Visa by the Numbers

Visa is a global payments technology company, which connects consumers, merchants, financial institutions, businesses, strategic partners and government entities in just about every country in the world, to enable fast, secure and reliable electronic payments.

VisaNet, the company’s transaction processing network, facilitates authorization, clearing and settlement of payment transactions and the numbers — payments volume, number of transactions and number of cards in circulation — are huge.

Visa Transaction Processing — Who Is Involved?

Apart from the merchant and their customers, there are several other participants in the Visa transaction process. Let’s take a look at who they are and what they do:

• A cardholder is an authorized user of a Visa debit or credit card or other Visa payment products.
• A merchant is any business, which is authorized to accept Visa cards for the payment of products and services.
• An acquirer is a bank, which contracts with merchants to accept Visa cards for the payment of products and services. An acquirer may also contract with a third party processor to provide processing services.
• A card issuer is a bank, which maintains the Visa cardholder relationship. It issues Visa cards and contracts with cardholders for the billing and payment of transactions.
• A Payment Facilitator (PF) is a company, which can enter into a contract with an acquirer to provide payment services to a merchant.
• Visa is a publicly-traded company, which works with card issuers and acquirers. Visa provides card products, promotes its brand, and makes the rules and regulations governing the participation in its programs. Visa also operates the world’s biggest retail payments network to enable the flow of transactions between acquirers and card issuers.
• VisaNet is part of Visa’s electronic payment system and is a collection of systems, which includes:
  • An authorization system through which card issuers can approve or decline Visa card transactions.
  • A clearing and settlement system, which processes transactions electronically between acquirers and issuers to make sure that:
    • Transaction information flows from acquirers to issuers, to be then posted to cardholders’ accounts.
    • Transaction payments flow from issuers to acquirers, to be then credited to the merchant accounts.

Transaction Flow for Visa Magnetic-Stripe and Chip Cards

Transaction Life Cycles

The charts below illustrate the life cycle of Visa payment card transactions for both card-present and card-not-present payments. Details may vary from one merchant, acquirer or card issuer to another, depending on card and transaction type, as well as the processing system used.

Credit and Debit Transaction Online Authorization Process

During the authorization process, a Visa card transaction is approved or declined by the issuer, or by Visa on the issuer’s behalf.

1. The merchant or cardholder inserts a card into a chip-reading device, swipes it through a magnetic stripe card reader, or waves it in front of a Visa payWave reader.
2. The merchant enters the transaction amount and, if necessary, sends an authorization request to the acquirer. In some locations, chip and Visa payWave allow for chip-based offline authorization.
3. The acquirer sends an electronic authorization request to VisaNet or determines the network to which the transaction should be routed.
4. VisaNet sends the request on to the card issuer.
5. The card issuer provides an online response.
6. VisaNet sends the issuer’s authorization response to the acquirer.
7. The acquirer forwards the response to the merchant.
8. The merchant receives the authorization response and finalizes the transaction accordingly.
9. A message is sent to terminal and a signature is requested, if required.

Note: In some instances, a Payment Facilitator (PF) may transmit the authorization request and response between the merchant and the acquirer. The presence of a PF during the transaction process is dependent on the acquirer and the merchant payment service contractual agreement with the PF.

Transaction Clearing and Settlement

During the clearing and settlement of a card transaction, the information flows from acquirers to card issuers, before eventually posting to the cardholder’s accounts. VisaNet facilitates the payment to the acquirer the debit to the card issuer.

1. The merchant submits the transaction to the acquirer.
2. The acquirer credits the merchant’s account and submits the electronic transaction to Visa for settlement.
3. VisaNet:
   • Facilitates the settlement.
   • Pays the acquirer and debits the card issuer account, before send the transaction on.
4. The card issuer:
   • Posts the transaction to its cardholder’s account.
   • Sends the monthly statement to the cardholder.
5. The cardholder receives the statement.

Visa Transaction Process for SMS-Based Point-of-Sale and ATM

In certain cases, POS and ATM transactions are authorized and cleared (posted) at the same time and within a single message. You may see this referred to as an “online” or “Single-Message System (SMS)” debit transaction. Settlement takes place from single message processing at certain cut-off times during the day. The charts below illustrate the basic processing steps for a single message POS (Visa / Interlink) and ATM (Visa / Plus) transaction.

1. The customer presents a card for payment.
2. The merchant or cardholder places the card inside the chip-reading device, swipes it through a magnetic-stripe card reader, or alternatively waves it by a Visa payWave reader. The merchant then keys in the transaction amount. The cardholder enters the PIN, if needed. A message requesting transaction authorization is transmitted to the acquirer.
3. The acquirer’s system typically determines the network to which the transaction should then be routed. For Visa, Interlink or Visa Electron, the acquirer transmits the authorization request electronically to VisaNet. All other transactions are sent on to the appropriate network.
4. VisaNet:
   • Sends on the request to the card issuer.
   • Facilitates settlement.
5. The card issuer:
   • Furnishes an online response. Before approving a transaction, the card issuer ensures that the funds are available and does the following:
     • Checks for all “statused” accounts, including lost, stolen, counterfeit and available funds.
     • Validates the cardholder’s PIN, if needed.
   • Posts the transaction to the cardholder’s account.
6. VisaNet sends the card issuer’s authorization response on to the acquirer.
7. The acquirer then forwards the response on to the merchant.
8. The merchant receives the authorization response to complete the transaction accordingly.

Note: In some cases, when present, a Payment Facilitator (PF) may transmit the authorization request and response between the merchant and the acquirer.

General Rules for Visa Processing

Merchants are required to follow some basic card acceptance rules for all Visa card transactions. Careful adherence to those rules, as outlined below, help enhance customer satisfaction.

Visa Card Acceptance

Merchants are required to accept all types of Visa cards, as long as they are valid. To offer the broadest possible range of payment options to customers, merchants must accept all categories of Visa cards: debit, credit and prepaid.

Transaction Surcharges

Surcharges are not allowed, except in the U.S. and Asia Pacific (Australia and New Zealand). In both cases, merchants may assess a fixed or variable surcharge on a Visa credit card transaction, subject to certain conditions and applicable laws or regulations.

Minimum Transaction Amount

Minimum transaction amounts, which may be no greater than $10, may be imposed only on Visa credit card transactions.

Prohibited Uses

Visa cards can never be used for illegal purposes. Moreover, merchants may never use the Visa card or account number to refinance existing debts or as a payment for a debt deemed as uncollectible (for example, to recover funds for a dishonored check).

Taxes

Taxes must be included in the total transaction amount and must never be collected separately in cash.

Convenience Fees

Merchants who offer an alternative payment channel (e.g. mail, telephone or e-commerce) for customers to pay for products or services may add a convenience fee to the transaction amount.

Merchants, which charge a convenience fee must ensure that the fee is:

• Charged for a bona fide convenience in the form of an alternative payment channel (e.g. mail, telephone or e-commerce) outside the merchant’s customary payment channels (i.e., not exclusively for the acceptance of the Visa card).
• Disclosed clearly to the cardholder as a fee for the alternative payment channel convenience.
• Disclosed prior to the completion of the transaction and the cardholder has been given the opportunity to cancel.
• Added only to a transaction completed in a card-not-present environment.
• A flat or fixed amount, irrespective of the value of the payment due.
• Applicable to all payment forms, which are accepted in the payment channel.
• Included as part of the total transaction amount.

The convenience fee must not be:

• Charged by a third party.
• Added to a recurring transaction.

Moreover, U.S. merchants, which assess a surcharge on a Visa credit card transaction may not charge a convenience fee in addition to the surcharge.

Government and Education Payment Program Service Fee

Any Government and Education Payment Program Service fees must be properly disclosed and processed.

In the U.S., a government or education merchant may assess a fixed or variable service fee for the processing of a Visa card transaction if that fee is:

• Clearly disclosed prior to the completion of the transaction and the cardholder is offered the opportunity to cancel.
• Processed as a separate transaction.

The government and education transaction must include:

• Government authority’s or education institution’s name in the Merchant Name field (e.g., “U.S. Treasury Tax Payment” for federal tax payments or “CA DMV” for a state automobile registration payments; the merchant name cannot exceed 25 characters in length).
• Customer support phone number in the Merchant City field.
• State of the merchant in the Merchant State field.

The service fee transaction must include:

• Merchant or service provider name in the first 3, 7 or 12 positions, followed by an asterisk (*) in the next position, followed by the words “Service Fee”.
• Customer support phone number in the Merchant City field.
• State of the service provider in the Merchant State field.

To qualify for the the most favorable interchange rate, all card transactions must be CPS qualified.

Laundering

Merchants are required to deposit transactions only for their own business. Depositing transactions for another business, which does not have a valid merchant agreement, is known as laundering and is not allowed. Laundering is a type of fraud, associated with high chargeback rates and the potential for accommodating illegal activity.

Tips

U.S. restaurant, taxicab, limousine, bar, tavern, beauty / barber shop and health / beauty spa merchant transactions involving a Visa credit or debit card may receive tips from their customers. Merchants must never estimate the tip, but must follow Visa procedures.

Note that cardholders can now check their credit or checking accounts almost instantaneously using their phones. An authorization that includes an estimated tip can reduce a cardholder’s available funds or credit by an unrecognizable or unexpected amount.

This kind of transaction may take place if a cardholder leaves a cash tip or adds a tip that is less than the estimated amount used for the authorization. This practice applies to magnetic-stripe and chip transactions.

In some restaurants, if the tip is unknown when the authorization takes place, the merchant must authorize only the known amount, but may clear for up to 20 percent greater than the authorized amount. If the tip is greater than 20 percent, the merchant may then obtain a second authorization.

No Cash Refunds

Cash refunds for returned merchandise, which was originally purchased with a Visa card are not allowed. Visa does not typically permit cash refunds for any credit or debit card transaction. By issuing credits, merchants protect their customers from individuals who might fraudulently make a purchase on their Visa card account and then return the merchandise for cash.

If a transaction was completed with a Visa prepaid card, and the cardholder is returning items, but no longer possess the card, which was used for payment, the merchant may give a cash refund or in-store credit.

Deposit Time Limits

Visa transaction receipts should be deposited as specified by the acquirer. There are deadlines, by which an acquirer must process a transaction.

Suppressed Account Number and Expiration Date

The Visa account number must be suppressed in accordance with Visa Rules and local laws and regulations. Visa requires that the account number be partly suppressed on the receipt, however, rules will vary by region.

The expiration date should not be displayed on the cardholder copy of the transaction receipt and point-of-sale (POS) terminals must comply with these requirements.

Delivery of Products and Services

Merchandise or services must be delivered to the cardholder at the time of the transaction. Cardholders expect immediate delivery of products and services unless other delivery arrangements have been made.

For card-not-present transactions, cardholders should be clearly informed of the delivery method and tentative delivery date. Transactions cannot be deposited until the products have been shipped or services received.

Deposits

For transactions where the customer pays a deposit, two authorizations are required: one for the deposit amount and one for the balance amount. Some merchandise requires delivery after the transaction date, in which case the customer pays a deposit at the time of the transaction and agrees to pay the balance upon delivery of the merchandise or services.

To complete a deposit transaction, merchants are required to:

• Create two transaction receipts, one for the deposit amount and one for the balance. Write, print out, or stamp “Deposit” or “Balance,” as needed, on the receipt.
• Obtain an authorization for each transaction receipt on their respective transaction dates. An authorization code must be present on each receipt. If the POS device does not automatically print authorization codes on sales receipts, write the codes on the receipts so they are clearly identifiable as such.
• Ensure that “Delayed Delivery,” is written, printed or stamped along with the authorization code, on each transaction receipt.

Merchants may deposit the deposit portion of the transaction prior to the delivery of the goods or services. However, the balance portion of the transaction must not be deposited prior to delivery.

Installment Payments

An installment payment is a functionality of the credit card to allow a customer to pay the full amount of the transaction in installments. This can be done through interest-bearing financing (granted by the card issuer), allowing the merchant to be paid in one lump sum, or with interest-free financing granted by the merchant.

Cardholder Information

Cardholder account numbers and personal information must be kept confidential. Customers expect any personal or financial information they may give provide in the course of a transaction to be safeguarded.

Keeping that trust is essential to fraud prevention and good customer service. Cardholder account numbers and other personal information should be released only to the acquirer or processor or as specifically required by law.

Merchant Servicer Registration

Merchants and their Visa acquirers must ensure that Third Party Agents who are handling Visa account numbers are registered in accordance with the Visa Core Rules and Visa Product and Service Rules.

Visa defines a merchant servicer (MS) as a Third Party Agent, which has a direct relationship with a merchant and is storing, processing, transmitting or otherwise has access to Visa account numbers on the merchants’ behalf. This type of Third Party Agent performs services such as payment gateway, shopping cart, fraud scrubbing, loyalty programs, POS integrator, etc.

Merchants and their acquirers are responsible for ensuring each MS maintains compliance with the Payment Card Industry (PCI) Data Security Standard (DSS), validates PCI DSS compliance with Visa and is preoperly registered as a MS with Visa.

Visa recommends that merchants who use POS integrators use certified integrators or resellers from the Payment Card Industry Security Standards Council Qualified Integrators and Resellers (QIR) Program, which provides payment application developers, integrators and resellers with the training to help merchants and industry participants install and configure validated PA-DSS payment applications to ensure a merchant’s PCI DSS compliance.

Many merchant POS systems are set up with remote access services, so that integrators and resellers can provide monitoring and software support. If remote access to the POS system is not configured or maintained in compliance with PCI DSS and PA-DSS (e.g. with default or shared remote access IDs without two-factor authentication or regular password changes), merchants can be infected with malware, which puts them at risk for breaches and cardholder data compromises.

Storage of Sensitive Data and Payment Application Use

All stored, processed or transmitted sensitive cardholder account or transaction information must be compliant with the PCI DSS and the Visa Core Rules and Visa Product and Service Rules. To protect sensitive customer and transaction information from compromise merchants that store, process or transmit cardholder account or transaction data must:

• Keep all material containing account numbers, paper as well as electronically, in a secure area accessible only to selected personnel. Merchants with paper receipts need to be extremely careful during the storage or transfer of sensitive information and should at all times:
  • Promptly provide the drafts to the acquirer.
  • Destroy all copies of the drafts, which are not delivered to the acquirer.
• Render cardholder data unreadable, both in storage and before discarding.
• Never keep full-track, magnetic-stripe, CVV2 and chip data, following transaction authorization. Storage of track data elements in excess of name, personal account number (PAN) and expiration date after transaction authorization is strictly prohibited.
• Use payment applications, which comply with the PCI Payment Application Data Security Standard (PA-DSS).

Image source: Wikimedia / Lance Cpl. Brandon R. Holgersen.