1
00:00:01,250 --> 00:00:01,742
Beep.

2
00:00:01,742 --> 00:00:02,628
Approved.

3
00:00:04,375 --> 00:00:06,179
That took less than two seconds.

4
00:00:06,179 --> 00:00:10,406
You have done it a thousand times, and you probably never thought about it.

5
00:00:11,250 --> 00:00:23,841
But in those two seconds, your payment woke up a computer with no battery, visited at least three different companies, passed a fraud check run by a machine learning model, and came back with an answer.

6
00:00:25,000 --> 00:00:27,040
And here is the strange part.

7
00:00:27,040 --> 00:00:28,095
No money moved.

8
00:00:28,095 --> 00:00:28,658
Not yet.

9
00:00:30,625 --> 00:00:34,408
Let's slow those two seconds down, and follow the tap all the way.

10
00:00:36,875 --> 00:00:39,458
It starts here, at the café counter.

11
00:00:39,458 --> 00:00:41,826
The terminal is always listening.

12
00:00:41,826 --> 00:00:46,562
It sends out a weak radio field, only about four centimetres deep.

13
00:00:47,500 --> 00:00:49,292
Your card has no battery.

14
00:00:49,292 --> 00:00:53,592
When it enters that field, the field itself powers the chip.

15
00:00:53,592 --> 00:00:58,179
For a split second, a tiny computer inside the plastic wakes up.

16
00:01:00,000 --> 00:01:03,433
The terminal and the chip start a short conversation.

17
00:01:03,433 --> 00:01:06,672
The terminal asks, which payment apps do you have?

18
00:01:06,672 --> 00:01:10,041
The chip answers with a list, and they agree on one.

19
00:01:10,625 --> 00:01:14,470
Then the terminal sends the details of the purchase.

20
00:01:14,470 --> 00:01:15,283
The amount.

21
00:01:15,283 --> 00:01:16,245
The currency.

22
00:01:16,245 --> 00:01:16,910
The date.

23
00:01:16,910 --> 00:01:19,572
And a random number it just made up.

24
00:01:20,625 --> 00:01:25,562
The chip mixes all of that with a secret key that never leaves the chip.

25
00:01:25,562 --> 00:01:27,139
Out comes a cryptogram.

26
00:01:27,139 --> 00:01:33,241
A one-time code that proves this card is real, and that it agreed to this exact purchase.

27
00:01:35,000 --> 00:01:38,281
That is why copying a chip card is so hard.

28
00:01:38,281 --> 00:01:42,860
An old magnetic stripe gave the same data every single time.

29
00:01:42,860 --> 00:01:46,751
Copy it once, and you could use it again and again.

30
00:01:46,751 --> 00:01:48,964
A cryptogram only works once.

31
00:01:50,625 --> 00:01:54,067
If you pay with your phone, there is one more trick.

32
00:01:54,067 --> 00:01:57,046
Your phone never sends your real card number.

33
00:01:57,046 --> 00:01:58,171
It sends a token.

34
00:01:58,171 --> 00:02:01,812
A stand-in number that only works from that one device.

35
00:02:02,500 --> 00:02:06,900
If a thief somehow copied that token, it would be useless anywhere else.

36
00:02:09,375 --> 00:02:12,079
Now the terminal has everything it needs.

37
00:02:12,079 --> 00:02:20,653
It packs it all into a message, in a format banks have used since the late nineteen-eighties, called ISO eighty-five eighty-three.

38
00:02:21,250 --> 00:02:24,462
Think of it as a form with numbered boxes.

39
00:02:24,462 --> 00:02:26,756
Box two holds the card number.

40
00:02:26,756 --> 00:02:28,362
Box four, the amount.

41
00:02:28,362 --> 00:02:30,580
Box forty-nine, the currency.

42
00:02:30,580 --> 00:02:35,015
Box fifty-five, the chip data, with the cryptogram inside.

43
00:02:36,875 --> 00:02:41,310
The message is encrypted, and sent to the café's payment company.

44
00:02:41,310 --> 00:02:44,926
In the industry, that company is called the acquirer.

45
00:02:44,926 --> 00:02:47,246
It is the café's side of the deal.

46
00:02:48,125 --> 00:02:57,598
The acquirer checks that the café is a real merchant in good standing, adds its own details, and then looks at the first digits of the card number.

47
00:02:58,750 --> 00:03:04,515
Those first six to eight digits say who issued the card, and which network it belongs to.

48
00:03:04,515 --> 00:03:08,466
So the acquirer knows exactly where to send the message next.

49
00:03:11,250 --> 00:03:13,291
Next stop, the card network.

50
00:03:13,291 --> 00:03:15,550
Names like Visa and Mastercard.

51
00:03:16,250 --> 00:03:18,755
Here is something many people get wrong.

52
00:03:18,755 --> 00:03:20,571
The network is not your bank.

53
00:03:20,571 --> 00:03:22,324
It does not hold your money.

54
00:03:22,324 --> 00:03:25,643
It is a giant switchboard between thousands of banks.

55
00:03:26,875 --> 00:03:34,174
Its job is to route each message to the right bank, fast, and to make sure every bank on it follows the same rules.

56
00:03:35,000 --> 00:03:43,522
If you paid with your phone, this is usually where the token is swapped back for your real card number, inside a secure vault.

57
00:03:43,522 --> 00:03:45,078
The café never sees it.

58
00:03:46,250 --> 00:03:51,812
From here, the message may cross a country, or even an ocean, in a fraction of a second.

59
00:03:55,625 --> 00:03:58,149
Finally, the message reaches your bank.

60
00:03:58,149 --> 00:04:02,744
In card language, your bank is the issuer, because it issued your card.

61
00:04:03,750 --> 00:04:05,766
Your bank now has to decide.

62
00:04:05,766 --> 00:04:06,558
Yes, or no.

63
00:04:06,558 --> 00:04:10,231
And it has to decide in a few hundred milliseconds.

64
00:04:11,250 --> 00:04:12,458
First, the basics.

65
00:04:12,458 --> 00:04:13,665
Is the card valid?

66
00:04:13,665 --> 00:04:15,410
Has it been reported lost?

67
00:04:15,410 --> 00:04:20,911
Does the cryptogram check out, using the secret key your bank put inside the chip?

68
00:04:21,875 --> 00:04:22,730
Then the money.

69
00:04:22,730 --> 00:04:26,549
Is there enough in the account, or enough room on the credit limit?

70
00:04:27,500 --> 00:04:29,611
And then, the part you never see.

71
00:04:29,611 --> 00:04:30,506
Fraud scoring.

72
00:04:30,506 --> 00:04:37,349
A machine learning model looks at this payment, and compares it with everything it knows about how you pay.

73
00:04:38,750 --> 00:04:40,258
Where you usually shop.

74
00:04:40,258 --> 00:04:42,027
How much you usually spend.

75
00:04:42,027 --> 00:04:43,535
What time of day it is.

76
00:04:43,535 --> 00:04:47,337
Whether your card was used in another country an hour ago.

77
00:04:48,125 --> 00:04:50,740
It gives the payment a risk score.

78
00:04:50,740 --> 00:04:52,124
Low risk, approve.

79
00:04:52,124 --> 00:04:56,508
High risk, decline, or ask for more proof, like your PIN.

80
00:04:58,125 --> 00:04:59,816
Today, your bank says yes.

81
00:04:59,816 --> 00:05:03,847
It puts a hold on the amount, and sends back an approval code.

82
00:05:05,625 --> 00:05:08,127
Now the answer travels all the way back.

83
00:05:08,127 --> 00:05:12,254
From the issuer, to the network, to the acquirer, to the terminal.

84
00:05:13,750 --> 00:05:14,243
Beep.

85
00:05:14,243 --> 00:05:15,129
Approved.

86
00:05:16,875 --> 00:05:20,203
Every step, there and back, in about one to two seconds.

87
00:05:23,125 --> 00:05:24,633
So the coffee is yours.

88
00:05:24,633 --> 00:05:26,599
But look at your bank account.

89
00:05:26,599 --> 00:05:28,238
The money is still there.

90
00:05:28,238 --> 00:05:30,139
It is only marked as pending.

91
00:05:31,250 --> 00:05:33,568
What happened was an authorization.

92
00:05:33,568 --> 00:05:34,230
A promise.

93
00:05:34,230 --> 00:05:38,534
Your bank promised the café that this money is reserved for them.

94
00:05:39,375 --> 00:05:41,175
The real money moves later.

95
00:05:41,175 --> 00:05:47,176
At the end of the day, the café sends all of its approved payments together, in one batch.

96
00:05:47,176 --> 00:05:49,109
This step is called clearing.

97
00:05:50,000 --> 00:05:54,585
Overnight, the network adds up what every bank owes every other bank.

98
00:05:54,585 --> 00:05:58,373
Thousands of small payments become a few large transfers.

99
00:06:00,000 --> 00:06:01,680
This is called settlement.

100
00:06:01,680 --> 00:06:07,237
Usually one or two business days later, the money finally lands in the café's account.

101
00:06:10,000 --> 00:06:11,741
And not all of it lands there.

102
00:06:11,741 --> 00:06:13,714
Say you spent one hundred dollars.

103
00:06:14,375 --> 00:06:18,143
The café might receive around ninety-seven or ninety-eight.

104
00:06:18,143 --> 00:06:19,740
So where did the rest go?

105
00:06:21,250 --> 00:06:24,164
The biggest slice usually goes to your bank.

106
00:06:24,164 --> 00:06:25,820
It is called interchange.

107
00:06:25,820 --> 00:06:30,523
In the United States, it is often around two percent for a credit card.

108
00:06:31,875 --> 00:06:35,622
In the European Union, interchange is capped by law.

109
00:06:35,622 --> 00:06:41,818
Zero point two percent for debit cards, and zero point three percent for credit cards.

110
00:06:42,500 --> 00:06:46,649
A smaller slice goes to the network, for running the switchboard.

111
00:06:46,649 --> 00:06:51,308
And another slice goes to the acquirer, for handling the café's payments.

112
00:06:51,875 --> 00:06:56,056
This is also how credit cards can afford to give you rewards.

113
00:06:56,056 --> 00:07:00,443
Points and cashback are paid, in large part, out of interchange.

114
00:07:01,250 --> 00:07:05,370
And it is why some small shops ask for a minimum card payment.

115
00:07:05,370 --> 00:07:10,287
On a tiny purchase, a fixed fee of a few cents can eat most of the profit.

116
00:07:13,125 --> 00:07:15,682
What about when there is no internet at all?

117
00:07:15,682 --> 00:07:17,077
On a plane, for example.

118
00:07:18,125 --> 00:07:22,224
For small amounts, the terminal can approve the payment offline.

119
00:07:22,224 --> 00:07:27,989
The chip checks its own rules, and keeps a count of how many offline payments it has made.

120
00:07:28,750 --> 00:07:33,049
The terminal stores everything, and sends it once it is back online.

121
00:07:33,049 --> 00:07:37,538
That is why an in-flight snack can appear on your statement days later.

122
00:07:40,000 --> 00:07:42,508
And sometimes, the answer is no.

123
00:07:42,508 --> 00:07:47,445
A decline travels back along the same path, with a reason code.

124
00:07:47,445 --> 00:07:50,031
Code fifty-one, not enough money.

125
00:07:50,031 --> 00:07:52,147
Code fifty-five, wrong PIN.

126
00:07:53,125 --> 00:07:56,177
Sometimes a payment is disputed after it settles.

127
00:07:56,177 --> 00:07:59,354
You tell your bank you never got what you paid for.

128
00:08:00,000 --> 00:08:01,630
That starts a chargeback.

129
00:08:01,630 --> 00:08:09,325
The money flows backward, from the café's acquirer, through the network, to your bank, while both sides send evidence.

130
00:08:11,875 --> 00:08:13,652
So, let's put it all together.

131
00:08:14,375 --> 00:08:16,041
The tap powers the chip.

132
00:08:16,041 --> 00:08:18,608
The chip signs a one-time cryptogram.

133
00:08:18,608 --> 00:08:21,731
The terminal sends a message to the acquirer.

134
00:08:21,731 --> 00:08:24,160
The network routes it to your bank.

135
00:08:24,160 --> 00:08:27,977
Your bank checks it, scores it for fraud, and says yes.

136
00:08:28,750 --> 00:08:31,719
The answer races back, and the terminal beeps.

137
00:08:31,719 --> 00:08:33,332
All in about two seconds.

138
00:08:34,375 --> 00:08:37,684
Then, quietly, overnight, the real money moves.

139
00:08:37,684 --> 00:08:41,908
Minus a few small slices, for everyone who made it possible.

140
00:08:42,500 --> 00:08:45,372
Next time you hear that beep, you will know what it carried.

141
00:08:46,875 --> 00:08:51,015
If this made something invisible a little more visible, subscribe.

142
00:08:51,015 --> 00:08:54,842
There is a lot more hiding behind the things we do every day.