Search
174 articles found
Online & Authorization
In EMV, data is stored in Tag-Length-Value (TLV) format, and it is carried between the card, the POS terminal, and the authorization system in this same format. This post lists every EMV Tag, its type, and its description.
HSM & Security
LMK stands for Local Master Key. The Local Master Key (LMK) is the HSM's master key, and all other keys used by the institution are secured under this key. As transaction volume increases, banks often use multiple HSMs to reduce the load on each device.
Fraud
A man-in-the-middle attack is a method in which an attacker inserts themselves between the server and client to intercept users' information, steal passwords, and gain access to accounts on a local network. This fraud mostly occurs over public internet connections.
Merchant & POS
In Turkey, there are 3 payment schemes we are used to seeing: MasterCard, Visa, and Troy. American Express and Diners Club are also used, though less widely. Russia's Central Bank recently said two Turkish banks are preparing to accept Mir cards.
Courier & Delivery
Although some banks use web service integration, banks generally handle card distribution with couriers through file exchanges, with information sent within the service instead.
Merchant & POS
The number of POS terminals, ATMs and cards in Türkiye is reported by BKM and updated monthly. Here is the link and how to read the figures.
ISO 8583
Field 3, Processing Code, is the field that shows what type of transaction is being performed and is critical for authorization. A Sale from POS differs from a Cash Withdrawal at an ATM.
Online & Authorization
F53 - PIN Encryption Control Information. When online PIN data is present, sending the F53 value is mandatory, except when DUKPT information is carried in Field 63, Tag 01. F53 consists of the following components.
Security
Fraud cases where scammers pose as bank staff or other institution employees to obtain citizens' banking information have increased significantly recently. Interestingly, the new fraud trend closely mirrors the steps of a genuine banking procedure.
Merchant & POS
Loyalty points are promotional rewards banks give customers for credit card transactions, tracked on a card/customer basis. Banks charge merchants a commission on POS transactions, and some share part of that commission with cardholders as points.
HCE
Token types vary depending on the verification method used in a transaction. In offline transactions, general checks are performed by the mobile app and card reader without any verification in the card system. In online transactions, token verification is sent to and verified by the issuer.
Payment Systems
A non-secure transaction is an e-commerce transaction approved without any verification before authorization, such as SMS OTP. In short, authorization is obtained by verifying only the card number, expiration date, and CVV2.