Card Present Credit Card Processing

Overview

Card Present payment transaction is made when the cardholder is physically present along with the card at the point of purchase.

Card Present transactions are made by using one of the following hardware devices:

magnetic swipe reader
contactless, chip reader
point of sale (POS), mobile POS device

Card Not Present payment transactions incur higher interchange fees than Card Present because of the higher risk of credit card fraud in Card Not Present.

Card Present Credit Card Flow

This flow covers the system interactions that occur for the standard, happy-path credit card use case:

The card reader or POS device reads, encrypts, and sends the card track data to the middleware.
The middleware receives the encrypted data and creates and sends a CreditCardAuthRequest message to the Payment Service.
The middleware receives an approval.
The webstore places the order in the order management system.

Middleware

The middleware system converts the encrypted card data into a Payment CreditCardAuth API call and returns the result back to the client webstore.

The middleware system is responsible for making Payment API calls and key management. The middleware system handles the following responsibilities:

embeds the private key used to encrypt card data into the card reading devices
decrypts the encrypted card data and converts it to a Payment Credit Card Auth API call
returns the result of the Payment Credit Card Auth API call to the webstore
rotates the public key of the card reading devices

RAP middleware is the current middleware system used to integrate with Payment Service. Alternative middleware solutions may be available in the future.

Provisioning Card Reader Devices

As part of the store's onboarding process, Payment Service creates a pair of private and public keys. The public key is used to encrypt the card track data. The private key is used by Payment Service to decrypt the information. Payment Service assigns new keys when the public key is due for rotation. The middleware handles installation of new public keys onto the card reading devices.

For more on the encryption architecture, see Payment API Client-Side Encryption.

The following hardware devices are supported:

Magnetic swipe card reader
Near Field Communication (NFC) and Radio-Frequency Identification (RFID) devices, such as Apple Pay, expressPay, and similar devices