Fair point, problem is that theres no short answer here. We partners with a bank to get our own BIN (https://en.wikipedia.org/wiki/Payment_card_number), that when loaded onto the networks, gets routed to our core infrastructure. There are many ways to segment this BIN, randomly, PRIN(?), few other industry standards, and so when you want to issue a new consumer a new card # you use whatever your algorithm is, and assign it to that customers account (or whatever exactly your data model is).

So its 2/3rds BD to get setup, 1/3 enterprise engineering and a lot of integration work to get fully setup and running. Payments is the only trillion dollar industry where nothing is written down, we're working on changing that since we find a lot of the stories fascinating and so do most people we retell them to.

If anyone is in Oakland area and wants a primer, always happy to share, we spent 3 years learning industry and now its our time to start giving back.

Yes, many times over, but always looking for holes, and actually that infrastructure is separate from the pieces that are exposed to public web.

Traditionally, we do it this way too, these piece of the payments ecosystem are all whitelisted IPs for access and MPLC circuits for connections.

As a credit card issuer, Getfinal's been audited for PCI-DSS compliance.

https://getfinal.com/security/