ISO 8583 Authorization Message explanation

Question

While learning payment technologies, I have reviewed some issuer's documentation about their implementation of ISO 8583, even though I have seen how this kind of messaging works, I have not completely understood how the Authorization Message (MTI x1xx) really works.

The general definition I have found is that this message 'determines if funds are available, get an approval but do not post to account for reconciliation', but I want to understand the general lifecycle of this message.

If the amount requested in the authorization is approved, does it mean that the funds are held until another message is sent? If the funds are not held, why reversal messages (MTI x4xx) offer the possibility of reversing the authorization? If another request is not sent, what about of 'not posting it for reconciliation'? Do issuers have to follow an expiration time as a standard to cancel the authorization request?

I know that these questions may depend on each issuer's specifications, but every time I search for the definition of the authorization message I always get the same one or two lines of description (like the one I wrote before) and no more.

I want to get a full explanation for this message and some examples. I really want to dominate this subject, because I do not want to use something that I do not understand.

Haiphong

Answer 1

Instead of using the terms issuer or acquirer, I usually prefer to use the term "payment processor" to refer to the institution or computer system that you communicate with in order to get process payments. As you know different payment processors do things differently, so I can only give you a general idea of how ISO 8583 is usually used.

When an authorization request or an authorization advice is approved, a temporary hold is usually put on the authorized funds. The authorization response message, that indicates approval, will usually contain an authorization number. I do not know how long the temporary hold on the funds lasts before it expires (or whether that time varies by payment processor).

The next step is to either:

• Do nothing and let the hold expire.
• Send a reversal message to reverse the authorization (and release the hold immediately).
• Send a financial advice message, that contains the authorization number from the authorization response, to complete the transaction initiated by the authorization request/advice.

See the ISO 8583 Wikipedia page for background information

Apfel

Answer 2

As far as my experience in the payment sector is concerned here is my explanation, I hope it could help you to some extent.

Most of the switches or payment systems use DMS (Dual Message System) for transactions, means in each transaction two request messages are sent from the acquirer (ATM) to the issuer (i.e. CBS). Both messages' type is x100, only some fields differ which differenciate them.

The first one is Authorization Request which is used to authorize the cardholder (i.e whether his/her PIN is correct or not, here all the basic validation and verifications are done) it is called precheck. In this case, no amount is held on the CBS and no reversal message is required in case the transaction fails.

The second one is the actual transaction request message (i.e balance inquiry, cash withdrawal and etc..). In case of cash withdrawal, the acquirer requests the issuer for cash withdrawal (the routing is done through a switch or a payment system).

As the user is already authorized, but there is no response from the issuer or it is a timeout. There can be lots possibilities why the transaction failed or no response is received.

• The amount is debited from the customer in CBS but due to internet issue the resposne is not received by the aquier (ATM).
• The amoutn is debeited from the customer, but due to load of process in CBS the acquierer received response late (there is a time limit within the switch should receive response from CBS called timeout i.e 10 secenods or 15 seconds etc. each switch has its own rules and setting for timeout).

In above secnarios, the switch (SV, CSC, etc.) sends reversal advice (MTI x420) to the CBS or reversal advice repeat (MTI x421) after 5 seconds in case no response is received for reversal advice.

Then, the issuer (CBS) sends reversal response (MTI x430) which means the transaction is reverted (the amount is credited back to the account/ card) successfully.

This is the end. Both parties (issuer and acquirer) will be happy and there will be no money loss or fraud.

NOTE: - x in MTI determines the ISO 8583 version. - MTI stands for Message Type Identifier

Schutz

Answer 3

I worked on a Card Switch project for a bank where I worked with multiple card schemes like VISA and MasterCard. As per my knowledge, The 'Authorization Message' (1100) (ISO 8583/1993) usually sends two types of transactions:

1. Financial Transaction (Purchase, Cash Withdrawal)
2. Non-Financial Transaction (Cardholder Verification, Balance Inquiry)

Most of the payment processors use:

1. DMS (Dual Message System): Where the authorization is sent first and the advice files for settlement are sent separately (usually T+1 day for most of the card schemes).
2. SMS (Single Message System): It usually contains the Financial (1200) transactions where the authorization and advice are sent in a single request.

Authorization (1100) is used in DMS where transactions are approved without financial advice. The funds will be held until advice for those authorization transactions is sent. Usually, card schemes process the advice file the next day as incoming and outgoing files.

Note: The days of the amount to be held will depend on the payment processor. If an acquirer fails to settle the amount within the given time limit payment processor may charge fines accordingly.

As for the Reversal (1420), it can be initiated from the terminal like POS Void or it can be sent when the transaction is not successful due to network issues before the advice file is processed. Once the settlement of a transaction is done and reconciled, instead of Reversal, a Refund Transaction (20) is initiated.

Note: Both issuer and acquirer have to maintain a settlement bank for settlement and reconciliation.

Cowboy