Card payments and schemesمدفوعات البطاقات والشبكات

This arrangement is called the four-party model (النموذج رباعي الأطراف), and it is as old as cards themselves. It has held its shape since the 1960s: everything above it and below it changed, and it did not.

The mistake beginners make most often is treating the approval and the money as one thing. They are not. The approval is a message that travels out and back in two seconds; the money moves later, by a completely different route. Separate the two in your head and half of this topic becomes obvious.

Who is in the picture?

Before any explanation, here are the players and what each one does. There are five, and no sixth name appears anywhere in the rest of this article:

• The cardholder, you. You hold the card. If it is a credit card you do not hold the account it spends from.
• The shop, who sells to you. It does not know your bank and does not want to.
• The issuer (البنك المُصدِر), your bank. It issued the card, and it alone decides whether a transaction is approved or declined.
• The acquirer (الجهة المستحوذة), the company the shop signed with in order to take cards. It installs the terminal, receives the transaction, and transfers the shop its takings a day or two later. In Saudi Arabia Geidea and neoleap are two examples of this role.
• The network (الشبكة), mada, Visa or Mastercard. It carries the messages and sets the rules. It holds nobody's money and decides nothing.

Those five together are the payments ecosystem (منظومة المدفوعات): the chain of companies one message passes through so that a seller can take money from a buyer they have never met.

If something confuses you later on, it is most likely the issuer and the acquirer. The first serves you, the second serves the shop, both are a licensed bank or company, and the network is neither of them.

Why is a sixty-year-old system still running?

Worth pausing on. Everything in technology has changed since the 1960s and this arrangement has not. So why has nobody replaced it?

Because it solved a harder problem than it looks. How does a shopkeeper in Jeddah accept a card issued by a bank in Germany to a person they have never met?

The shop does not know the bank, does not trust the buyer, and has nobody to call to check. The solution that emerged was that each party trusts the network only, not the other parties. The shop trusts that the network will pay it. The bank trusts that the network will collect from it. Both sign with the network rather than with each other.

Which is where the name comes from. The four are the ones holding contracts: you, the shop, your bank and the acquirer serving the shop. The network is not a fifth, because it is the party the other four signed with rather than one of them. Six take part in a payment; four have contracts.

That is the value of common rules: millions of parties who do not know each other can transact without bilateral agreements. The plastic card is not the invention. The agreement about who guarantees what when things go wrong is.

Which is why the model has held. A new competitor does not merely need better technology. It needs to persuade millions of merchants and thousands of banks to move on the same day.

The message that travels in two seconds

When you tap your card, not one riyal leaves your account at that moment. This happens instead:

1. 1The terminal in the shop builds an authorisation request and sends it to the acquirer that serves the shop.
2. 2The acquirer reads the first digits of the card to identify the network, and passes the message on.
3. 3The network routes the message to your bank. It decides nothing and holds nobody's money.
4. 4Your bank decides: is there enough balance, is the card active, and is this behaviour normal for you.
5. 5The answer returns along the same path in reverse and appears on the screen.

What happens in your account on approval is a hold, not a debit. Your bank takes the amount out of your available balance and reserves it, and not one riyal has moved to anybody yet. What turns that hold into real money is a further step, and it is the subject of the next section.

Authorisation is one thing, capture is another

The hold that just happened is not money anybody has taken. It is your bank's promise that the amount is reserved, and it expires on its own if the shop never asks for it. Asking is a second message, entirely separate from the first, and it is called capture (التحصيل). It means: I have shipped the goods, take the money now.

So the chain is three steps rather than two: authorisation reserves, capture claims, then clearing and settlement move the money. No transaction enters clearing before it has been captured.

When does a shop send the capture? That is its own decision, and it varies with what it sells:

• In a physical shop, the two happen almost together, because the goods crossed the counter as you stood there.
• In online shops, it authorises at checkout and captures at dispatch. That is why your card is not debited when you order from an online shop, but when the parcel leaves.
• In hotels and fuel stations, it authorises an estimate and captures the real amount, which is usually lower. This is a partial capture, and it is the explanation for the hold you saw change a day later.
• And if the shop never captures at all, the hold falls away by itself after some days and the amount returns to your available balance, with no notification and no line on your statement.

The money comes later

After capture, at the end of the day, the acquirer gathers all of the shop's transactions and sends them to the network in one batch. That stage is called clearing. The network then works out the net position between banks: this bank owes that one so much, that one owes a third so much. Only the net amounts move between banks, in the stage called settlement.

That is why a shop receives its money a day or two later rather than instantly. The delay is not a flaw in the system; it is the system. Moving one net amount between two banks is orders of magnitude cheaper than moving a million small ones.

Who takes what

Suppose a shop sells something for 100 riyals and receives 98 two days later. The two missing riyals are not one fee but three:

• Interchange (رسوم التبادل), which goes to your issuing bank. It is usually the largest of the three.
• The scheme fee, which goes to mada, Visa or Mastercard for routing the message and setting the rules.
• The acquirer's margin, which is what the shop's provider earns.

Interchange is the key to a lot of otherwise puzzling behaviour. It funds the rewards and air miles on your card, which your bank pays for out of that fee rather than out of generosity. It is why some small shops refuse cards or impose a minimum purchase. And it is why banks are far keener to issue cards than to serve merchants.

This is also why regulators in many countries cap interchange: in the end the buyer pays it, inside the price.

Debit and credit

The difference between them is not the shape of the plastic but whose money is being spent. A debit card spends your balance. A credit card spends the bank's money and bills you at the end of the month. So the bank carries real risk on the second and none on the first.

The fees follow that risk. Interchange on credit cards is higher than on debit cards in almost every market, because the bank is funding, deferring and collecting. It is also why rewards and air miles are almost exclusively a credit card feature: there is a bigger fee paying for them.

Most cards in Saudi Arabia are debit cards on the mada network. That explains why card acceptance in the Kingdom looks cheaper than anything you read in an American article about it.

Why mada is usually cheaper

mada is a domestic Saudi network, so the transaction stays between two banks inside the Kingdom in one currency. A global card adds an international scheme fee, and may add a currency conversion and a cross-border layer on top. That is why many shops prefer to route on mada where they can. It is a technical setting in the terminal, not a matter of taste.

When the cardholder objects

A cardholder can dispute a transaction, which is called a chargeback. Your bank pulls the money back from the shop first, and only then asks the shop to prove the transaction was good. The burden sits with the shop, not the buyer, and the deadlines are set by the network's rules and measured in days.

That is why shops care so much about receipts, delivery records, and a stored record of the customer's consent. Those are the evidence, and nothing else helps once a dispute is open.

What this means if you are building

If you are an engineer or a product owner, the first rule is that card numbers never enter your systems. PCI DSS (معيار PCI DSS) imposes heavy obligations on every system that touches a card number, and the cheapest route to compliance is not to touch one.

In practice, the browser or the app sends the number straight to the payment provider, which hands you back a token that stands in for the card and is worthless to anyone else. You store the token and use it for later transactions. This is called tokenisation (الترميز), and it is the most consequential architectural decision in this topic.

One last layer is 3-D Secure, the extra check that sends you to your bank's page or texts you a code. In many cases it shifts liability for fraud from the shop to the issuing bank, which is why shops use it despite losing some customers halfway through it.