Hacker News Reader

Comment by vjagrawal1984 | Hacker News Reader

vjagrawal1984

In the face of so many outages from big companies, I wonder how Visa/MasterCard is so resilient.

Is it because they are over the curve and don't make "any" changes to their system. As opposed to other companies, we are still maturing?

View on HN

Mainframes.

> Visa, for example, uses the mainframe to process billions of credit and debit card payments every year.

> According to some estimates, up to $3 trillion in daily commerce flows through mainframes.

https://www.share.org/blog/mainframe-matters-how-mainframes-...

https://blog.syncsort.com/2018/06/mainframe/9-mainframe-stat...

https://www.ibm.com/it-infrastructure/servers/mainframes

Specifically they run IBM zTPF on their mainframes, which is also used by airlines. Some installations have uptimes measured in decades.

https://www.ibm.com/it-infrastructure/z/transaction-processi...

It's rarely the hardware that fails, it's more often due to software. So I wonder what the software that's running on mainframes does differently than the software that's written for ordinary computers.

May it's not what it does but that it is written in COBOL?

> So I wonder what the software that's running on mainframes does differently than the software that's written for ordinary computers.

Not change.

Both have had plenty of downtime:

https://www.ft.com/content/1fd2a066-860f-11e8-a29d-73e3d4545...

I suspect they sometimes 'fail open' (ie. allow all payments through and reconcile later) too.

No they don't. If I sell a diamond ring for $20k and Visa passes that the card is valid but it's not. The buyer just got a free $20k ring. Card could be expired, cancelled, or not have enough balance. The merchant must be paid, their processor has to pay them, the bank that issued the card must provide that credit until the card holder pays it back. If the card was expired or a card with a $10 balance. The card holder will refuse, it get's really mess fast. Visa is not willing to assume such risk, they simply provide a network. If it goes down, it goes down and everyone on their network is screwed.

When dispute is at play, it's a hot potato that no one wants to hold between the merchant, processor, ISO, sales agent & bank. The card networks have been smart to eliminate themselves from that step.

Actually, merchants, acquirers, and issuers can do this. It happens sometimes. When it happens, other limits come into play downstream, such as terminal configuration. There are separate offline limits, and it is unlikely they would set it that high, so a $20,000 offline charge would be declined, even if a lesser charge would be approved, stored, and processed later. As for expired cards, the expiration date is on the mag stripe and in the chip, so the transaction could be rejected at any point, even offline at the terminal. It's also printed on the card so it might be rejected before it's even swiped or dipped.

It's even done regularly in some cases, various US airlines take "offline" card transactions and process them later for food & drinks.

There are of course limits on how big an offline transaction you can take intentionally or unintentionally and probably the airline wears the full cost of failed transactions in this case.

Doesn't matter that much when its for a $5 coffee, plus they know who you were if they really wanted to chase it down.

And as mentioned electronic terminals absolutely have automatic offline modes also.

> No they don’t.

On the contrary, I developed early merchant and payment gateway tech, and they absolutely do. The scenario you describe is extraordinarily rare, which allows an arbitrage between CAP perfection and customer satisfaction.

On a separate note, at any given time, some parts of our national payments ecosystem are “down”. There are enough players involved you have an appearance of resilience.

You can see this in a mall, when one store’s card swipe terminals are down, and another’s are not, and almost never happens that all the stores are down at the same time.

You can think of all these other players as an incidental circuit breaker pattern upstream of Visa.

VisaNet itself is surprisingly unscaled, capable of only about 24,000 transactions per second. Twenty years ago, our gateway would hit 15,000 transactions per second real world use. To do that, we scattered/gathered across many independent paths into card networks and various merchant banks.

https://usa.visa.com/content/dam/VCOM/download/corporate/med...

https://www.capgemini.com/wp-content/uploads/2017/07/Domesti...

They absolutely do, it is called "stand-in processing". I saw this while working in ATM at a major bank. The terminal operator (e.g. in our case, the ATM authorization system) can stand-in for the payment network when required. There are per-card number transaction limits that are well-defined in their contracts, and fraud liability can shift during this period of time. The payment network can also stand in for the issuer. In either case, once the network is restored all the authorization advices are forwarded.

Credit cards are very asynchronous, going back to the days when carbon copy paper was used and no in time verification might have been involved at all.

Shop owners would even get a reward for snipping a bad credit user’s card in half (something that survives to this day only as a meme).

That’s a great point. In spite of technical changes such as Apple Pay/Android Pay, chip cards, and so on, I can never recall an instance when I was unable to use a credit card globally. It seems most failures to running a credit card are pretty localized, too, and never at the interchange level...

I suspect there's a lot of caching involved as well. When making a purchase you probably don't need all the info to go all the way to the bank and back.

Stolen/lost cards can simply be flagged in a master db/table and can be rejected quickly for example.

They're also much simpler and the system behind payment solution didn't changed that much in the last 10 years.

They are also miles behind on features customers want...

For example:

* My credit card statement should have links to the merchant, the address, a list of the things I bought, a link to the returns process, etc.

* Why can't my statement also have the total number of calories I've purchased in the last month, or grams of carbon in fuel I've put in the truck?

* Why can't I use my mastercard to pay another mastercard user directly?

* Why hasn't mastercard produced a '2 factor' for card payments rather than forcing every bank to implement their own?

* Why can't I buy a dual Mastercard/Visa/Other card, which works with merchants who are picky and will only accept one or the other?

* Why are we still issuing bits of plastic in the digital age anyway?

* Why don't the cards have a microusb plug on one edge, or NFC to plug into a phone or computer to log in, to act as an identity card, to authenticate or make payments, or anything else other companies issue smartcards for?

* Why don't mastercard work with mobile providers to issue cards that you can spend your pay-as-you-go balance with, turning a mobile provider into a bank.

It seems mastercards business is 'stuck', and there are opportunities to innovate all around them, but they won't.

>Why are we still issuing bits of plastic in the digital age anyway?

Phones die.

If you don’t care, I suggest you look into Apple Pay or something similar. You’ll find many merchants that you won’t be able to pay.

Maybe in the US; here in the UK, contactless payment is now close to universal for any vendor who accepts cards. This suggests it’s eminently possible.

In the west, but in China you pay everything with wechat or alipay and similar solutions are popping up in Asia in every country with success. But in China it is accepted everywhere. And when it is not it still is because usually the shop cashiers will use their own phone to complete the transaction.

Half of what you "want" is a quasi-dystopian nightmare.

Don’t be such a pessimist. There’s nothing “quasi” about it.

If this is what he wants for himself, it's not dystopian, it's personal info.

Why would you want Target telling Mastercard that you bought Spongebob underwear and 1,968 calories worth of freeze pops?

Why do you believe this isn't already the case?

They are not, they go down quite often. lol.

Reply on news.ycombinator.com