payment flows

Payment Through My Lens: The payments industry is a complex ecosystem that brings together many participants—each operating under globally recognized standards such as those defined by ISO, EMVCo, Wallet Providers, and Regulators. My interest lies in understanding this landscape end-to-end and how these standards shape real-world payment experiences.

This page is my way of curating and organizing the standards-based knowledge gained over the years. The snippets and diagrams shared here are conceptual summaries drawn from public specifications and industry best practices.

Content:
1. Card-based payment flow
2. Token-based payment flow
3. In-app purchase payment flow

card-based payment flow
Card-based payment flow diagram

Figure 1 - Brief Overview: The diagram illustrates the communication flow in both contact and contactless EMV transactions when a card is inserted into, or tapped on, a payment terminal.
During a transaction, messages are exchanged sequentially between each participant in the payment flow, and each step requires mutual agreement before moving to the next stage.
Most EMV chip cards in the market today use Cryptogram Version 18 (CVN18), with CVN10 as its predecessor. Each message follows a defined specification that determines how the data elements are structured. A message typically consists of multiple fields, and the primary differences between contact and contactless transactions can be seen in the POS Entry Mode (ISO Field 22) and in the presence of the Form Factor Indicator (Tag 9F6E) within ICC Data Field 55.
The Cryptogram Version (CVN) indicates the algorithm used by the card to generate the cryptogram. CVN information is carried in Tag 9F10 – Issuer Application Data, one of the standard tags included within Field 55 (ICC Chip Data).

token-based payment flow
Token-based payment flow diagram

Figure 2 - Brief Overview: This flow highlights the fundamentals of payment tokenization and token-based transactions. Digital wallets such as Apple Pay (SE), Samsung Pay (HCE), Google Pay (HCE), and issuer-specific HCE wallets enable transactions to originate from a mobile device using NFC technology. Many of these wallets also extend to wearable devices such as the Apple Watch, Garmin, or Swatch, allowing payments to be performed through a variety of form factors.
Similar to a chip-based transaction—where data is read from the card’s chip profile, for token-based transactions; data is read from the token profile stored within the wallet.
A device-bound token cryptogram is then generated using cryptographic keys stored either in the Secure Element (SE) for SE-based wallets or in the cloud for HCE-based wallets.

The cryptogram version used in SE-based wallets differs from that used by HCE wallets, and only the network scheme can validate a token-based cryptogram. The token-based cryptogram ensures the integrity of the transaction-specific data.

SE: Secure Element
HCE: Host Card Emulation
NFC: Near Field Communication

in-app purchase payment flow
In-app purchase payment flow diagram

Figure 3 - Brief Overview: This flow outlines the sequence of interactions when a cardholder makes a purchase within a merchant’s mobile application using for example the button1 : "Buy with [xPay wallet name]". In-App
This is referred to as an in-app purchase because the merchant app has integrated the wallet provider’s in-app payment APIs, enabling the use of active payment tokens stored either in the device’s digital wallet or as a cloud-based token.

At the start of the transaction, the merchant must request a token-based cryptogram from the network scheme by submitting the required data elements in an API request. The network scheme uses this information to generate a cryptogram and return the corresponding Electronic Commerce Indicator (ECI) value (typically ECI 05, 06, or 07).

The cryptogram generated for an in-app transactions is known as the Token Authentication Verification Value (TAVV). It is unique for each transaction. The algorithm for generating the TAVV is proprietary to the network scheme, and only the network scheme can validate it. If the transaction contains a valid TAVV, the network will forward it to the issuer for authorization. If the TAVV has been compromised, it will fail validation, the transaction will be declined in STIP, and depending on the BIN configuration, the issuer may receive a STIP authorization advice (0120 message).

ECI 05 (Visa) or 02 (MC): Authenticated
ECI 06 (Visa) or 01 (MC): Attempted authentication
ECI 07 (Visa) or 00(MC): Not Authenticated
STIP: Stand-In Processing
BIN: Bank Institution Number
0120: A type of message called as Advice that is sent by network scheme to issuers based on the BIN configuration.

1 source: apple pay marketing guidelines