Payment Systems#
Reference of card networks, real-time payment rails, ACH / wire / settlement schemes, payment processors, and the identifier schemes that link them. Useful for fraud investigations, money-flow tracing, FinCrime / AML work, and PCI-DSS scoping.
For currencies see Currencies. For exchanges see Exchanges & Markets. For sanctions see Sanctions Lists. For cryptocurrencies see Cryptocurrencies.
Card networks (4-party model)#
Network |
Notes |
|---|---|
Visa |
Largest by volume; ~$15T annual; Visa Direct push payments; Visa+ alias; B2B Connect. |
Mastercard |
~$9T annual; Mastercard Send push; Send Cross-Border. |
American Express |
Closed-loop (issuer + network); ~$1.5T. |
Discover |
Closed-loop US; Diners Club; PULSE network. |
JCB |
Japan Credit Bureau; widely accepted in JP/Asia. |
UnionPay |
CN dominant; ~$25T (incl. domestic); CUP brand. |
RuPay |
IN domestic; bank-backed. |
Mir |
RU domestic; central-bank-backed since Crimea sanctions. |
BC Card |
KR. |
Bancontact |
BE. |
Cartes Bancaires (CB) |
FR. |
Maestro |
Mastercard debit; sunsetting in EU. |
V Pay |
Visa debit (EU); sunsetting. |
Card identifier schemes#
Scheme |
Notes |
|---|---|
PAN |
Primary Account Number; 13-19 digits; Luhn check digit. |
BIN / IIN |
First 6-8 digits of PAN; identifies issuer; ISO 7812. |
ISO 7812 |
Card numbering standard. |
ISO 8583 |
Card-network message format. |
ISO 20022 |
Modern cross-border + RTP messaging; replacing SWIFT MT in 2025. |
SWIFT BIC |
8/11-char bank identifier; ISO 9362. |
IBAN |
International Bank Account Number; ISO 13616. |
ABA RTN |
9-digit US bank routing number. |
SEPA IBAN |
EU IBAN format. |
IFSC |
Indian Financial System Code (NEFT / RTGS). |
BSB |
Australian Bank-State-Branch. |
CUIT / CBU |
Argentina. |
Aadhaar |
IN digital ID linked to UPI. |
ABN / ACN |
Australian business numbers. |
Major issuers / acquirers / processors#
Entity |
Country |
Notes |
|---|---|---|
Chase Paymentech |
US |
Issuer + acquirer. |
Bank of America Merc |
hant Services |
US Acquirer. |
Wells Fargo Merchant |
US |
Acquirer. |
Stripe |
US |
Modern processor; SaaS; popular with tech startups. |
Adyen |
NL |
Global processor. |
Braintree |
US |
PayPal-owned. |
PayPal |
US |
P2P + processor + BNPL. |
Square (Block) |
US |
SMB. |
Worldpay (FIS) |
US |
Large acquirer; FIS-owned. |
Fiserv |
US |
Processor; First Data. |
Global Payments |
US |
Processor. |
TSYS |
US |
Acquired by Global Payments. |
Klarna |
SE |
BNPL. |
Afterpay (Block) |
AU |
BNPL. |
Affirm |
US |
BNPL. |
Zip |
AU |
BNPL. |
Toss Payments |
KR |
Processor. |
Razorpay |
IN |
Processor. |
PayU |
Naspers |
Global EM processor. |
Paystack |
NG |
Pan-African. |
Flutterwave |
NG |
Pan-African. |
Mercado Pago |
AR |
LatAm. |
Pago.gov.it |
IT |
Sovereign payment. |
Worldline |
FR |
EU processor. |
Nexi |
IT |
EU processor. |
Ingenico |
FR |
POS terminals (Worldline). |
Verifone |
US |
POS terminals. |
Adyen |
NL |
EU processor. |
ACH / interbank#
Scheme |
Region |
Notes |
|---|---|---|
ACH |
US |
NACHA-administered; T+1 / T+2 settlement; same-day option. |
FedACH |
US |
Operated by the Federal Reserve. |
EPN |
US |
Electronic Payments Network (TCH). |
Fedwire |
US |
Real-time gross settlement (RTGS) for large value. |
CHIPS |
US |
Clearing House Interbank Payments System (large value). |
SEPA Credit Transfer |
EU |
EUR retail credit; T+1 ish. |
SEPA Direct Debit |
EU |
Pull-based. |
SEPA Instant (SCT Ins |
|
10-second instant; mandated for all EU EUR by 2025. |
TARGET2 / TARGET2-S2P |
EU |
ECB-operated RTGS. |
TIPS |
EU |
ECB instant payment settlement. |
CHAPS |
UK |
UK RTGS; large value. |
Faster Payments |
UK |
UK retail instant. |
Bacs Direct Credit / |
D irect Debit |
UK Batch ACH. |
NEFT / RTGS / IMPS |
IN |
National batch / RTGS / Immediate Payment Service. |
UPI |
IN |
Unified Payments Interface; most-used real-time rail by volume globally. |
Pix |
BR |
BCB instant payments; ~150M users. |
PromptPay |
TH |
Mobile real-time. |
PayNow |
SG |
MAS-backed real-time. |
DuitNow |
MY |
Real-time. |
QRIS |
ID |
QR-payments standard. |
GIRO / FAST |
SG |
Slower batch / instant. |
Zelle |
US |
P2P over banks (Early Warning Services). |
RTP |
US |
The Clearing House Real-Time Payments. |
FedNow |
US |
Federal Reserve instant payments; launched July 2023. |
SWIFT + cross-border#
Scheme |
Notes |
|---|---|
SWIFT MT |
Legacy message format (MT103 single-customer credit transfer); migrating to ISO 20022 by Nov 2025. |
SWIFT MX |
XML-based; ISO 20022. |
SWIFT gpi |
Global payments innovation; tracks cross-border in real-time. |
SWIFT alliance |
Network of ~11k+ banks. |
SPFS |
Russian alternative to SWIFT. |
CIPS |
China Cross-border Interbank Payment System. |
SFMS |
India. |
ACS |
IN domestic settlement. |
RIPPLE / RippleNet |
Distributed-ledger cross-border. |
mBridge |
BIS-led CBDC bridge (CN, HK, TH, AE). |
Project Agorá |
BIS multi-CBDC. |
Mobile / wallets#
Wallet |
Vendor |
Notes |
|---|---|---|
Apple Pay |
Apple |
Tokenised card; Secure Enclave. |
Google Pay / Wallet |
Tokenised; passkey-derived. |
|
Samsung Pay |
Samsung |
Tokenised + MST (legacy mag-stripe emulation). |
WeChat Pay |
Tencent |
Dominant in CN; QR-based. |
Alipay |
Ant Group |
Dominant in CN; QR-based. |
PayTM |
Paytm |
IN; UPI + cards. |
PhonePe |
Walmart |
IN; UPI. |
GPay |
IN UPI implementation. |
|
Zelle |
EWS |
US bank-bundled P2P. |
Venmo |
PayPal |
US P2P. |
Cash App |
Block |
US P2P + BTC. |
Revolut |
Revolut |
UK / EU neobank. |
Wise |
Wise |
Cross-border P2P. |
Remitly |
Remitly |
Cross-border remittance. |
WorldRemit / Western |
Union Remit |
Cross-border remittance. |
M-Pesa |
Safaricom |
KE mobile money; ~50M users. |
MTN MoMo |
MTN |
Pan-African mobile money. |
Airtel Money |
Airtel |
Pan-African mobile money. |
Orange Money |
Orange |
West Africa mobile money. |
Standards / regulation#
Standard / law |
Notes |
|---|---|
PCI-DSS v4.0 |
Payment Card Industry Data Security Standard; PCI Council. |
PA-DSS / P2PE |
Payment Application / Point-to-Point Encryption. |
PIN-PED, SCS, EMV |
Hardware terminal standards. |
EMV |
Europay / Mastercard / Visa chip standard. |
3-D Secure 2.x |
Cardholder auth for CNP transactions; PSD2 SCA-aligned. |
PSD2 / PSD3 |
EU Payment Services Directive; SCA + open banking. |
PCI MPoC |
Mobile Payments on COTS (mobile devices accepting cards). |
PCI 3DS |
Standard for 3DS implementations. |
ISO 20022 |
Global financial-messaging standard. |
ISO 4217 |
Currency codes. |
NACHA Rules |
US ACH rule set. |
SEPA Rulebook |
EPC EU. |
Reg E (US) |
Electronic Funds Transfer rules. |
Reg Z (US) |
Truth in Lending. |
GDPR Art 9 |
Special-category data (biometrics, often used for payment auth). |
AML / KYC / BSA |
Anti-money-laundering frameworks; FinCEN / FATF. |
Travel Rule (FATF R16 |
) Beneficiary info for crypto + traditional cross-border. |
Common attacks#
Attack |
Notes |
|---|---|
Card skimming |
Magstripe (legacy); EMV chip is much harder; shimmers exist. |
e-Skimming / Magecart |
Web-based card-form theft (e.g. British Airways 2018; Ticketmaster). |
Carding |
Test stolen cards via small charity / micro-transactions; CCN resold on dark markets. |
ATM Jackpotting |
Drive-by USB/RDP attacks on ATM; Carbanak / Cobalt Group. |
ATM Black Box |
Hardware bypass to dispense cash. |
Cash trapping |
Physical device traps dispensed bills. |
EMV downgrade |
Force fallback to magstripe. |
SIM swap |
Hijack victim’s number to intercept OTP. |
BIN attack |
Brute valid PANs from BIN. |
3DS bypass |
Older 3DS1 + weak issuer auth. |
APP fraud |
Authorized Push Payment fraud (UK); social engineering. |
Business email comp. |
BEC; finance-team email spoofing. |
Refund fraud |
Insider / mule networks. |
Friendly fraud |
Customer disputes legit charge. |
Romance / pig-butch. |
Long-game social engineering. |
Telegram payment OTP |
Steal OTP via fake bank-employee scams (BR / IN heavy). |
Investigative resources#
Tool / source |
Notes |
|---|---|
BIN list databases |
Free + paid (BinList.net, BinDB, Stripe BIN lookup); identify issuer, country, brand. |
GLEIF |
LEI lookup for legal entities. |
SWIFT BIC directory |
BIC -> bank lookup. |
Refinitiv World-Check |
KYC / sanctions screening. |
Dow Jones Risk Center |
KYC. |
LexisNexis Bridger |
Sanctions / PEP. |
ComplyAdvantage |
AML SaaS. |
Chainalysis / Ellipti |
c / TRM Crypto KYT (see Cryptocurrencies). |
FinCEN BOI |
US Beneficial Ownership reports (CTA, Mar 2024). |
Companies House |
UK company search. |
Operator notes#
PAN handling: never log full PAN; PCI-DSS allows first6+last4 only. Tokenise on ingest.
3DS challenge is the highest-value control for CNP fraud; ensure issuer + acquirer coverage.
Cross-border investigation, subpoena friction is high; lean on FATF / Egmont channels and MLAT.
ISO 20022 migration (SWIFT, Fedwire, CHAPS) is the biggest payments-data project of 2025; richer beneficiary data improves AML signal.
CBDC pilots (mBridge, e-CNY, Digital Euro) are reshaping cross-border investigation; keep an eye on BIS.
Real-time = irreversible: FedNow / Pix / UPI / Zelle fraud has no clawback window; controls must be pre-pay.
QR-payments fraud (UPI, Pix, PromptPay) is a major vector in IN / BR / SEA; static QR replacement scams.