Building a Real-Time Global Network Before Anyone Had the Words for It
The Money Stack — Episode 3 of 10
In September 1958, Bank of America mailed sixty thousand credit cards to the residents of Fresno, California.
Nobody had asked for one. Nobody had been credit-checked. The cards simply arrived in envelopes, fully activated, with a spending limit attached, addressed to strangers.
It went about as well as you would expect. Fraud was immediate and widespread. Delinquency climbed past twenty percent. The programme haemorrhaged money and became known internally, with considerable embarrassment, as the Fresno Drop.
It also worked.
Because the problem with a credit card is not the card. The card is a piece of plastic. The problem is the network. A card is worth precisely nothing unless a merchant who has never seen you before will accept it in under two seconds, and a merchant will only accept it if someone credible guarantees payment on the spot. That requires every bank to have a relationship with every other bank, in real time, all the time, across the entire country.
The Fresno Drop was a brute-force solution to a cold-start problem. Flood one city with cards, and merchants have no reasonable choice but to build the infrastructure to accept them.
It was reckless, arguably illegal, and it seeded the network that became Visa.
The Chicken and the Egg
A two-sided network has a particular kind of problem at launch. Cardholders will not carry a card that merchants do not accept. Merchants will not install a terminal for a card that customers do not carry. Neither side has a reason to move first. The network is worthless until it already exists.
Diners Club solved this in 1950, crudely. Frank McNamara approached two hundred restaurants in New York and convinced them to accept a charge card on the promise that he would personally bring wealthy customers through their doors. He then approached those customers and told them they could dine at two hundred restaurants without carrying cash. Neither side knew the other had only just agreed.
It worked because McNamara solved both sides simultaneously through salesmanship and slight misrepresentation. The resulting product settled monthly, had no electronic component whatsoever, and worked only in New York. But it proved the concept: you could intermediate a payment between strangers, take a fee, and build a business on it.
Bank of America saw this and asked what would happen if you removed the geography.
Dee Hock and the Cooperative
By the late 1960s, the BankAmericard had been licensed to hundreds of banks across the United States and the system was in chaos. Every licensee issued their own cards, set their own terms, and accepted other licensees’ cards inconsistently. Fraud was rampant because there was no central fraud detection. Chargebacks were resolved differently everywhere. The whole enterprise was one scandal away from collapse.
A branch manager named Dee Hock was given the task of fixing it. What he produced was genuinely radical.
Hock argued that what the system needed was not a stronger central authority but a cooperative owned by the competing banks themselves. Nobody would own the network. Everybody would use it. Rules would be universal and non-negotiable. Any card issued by any member would be accepted by any merchant working with any other member, anywhere. The network’s value came from its universality, and its universality required that no single party could be advantaged over any other.
In 1976, BankAmericard became Visa. The cooperative model that Hock designed is still the governance structure of the card networks today. The insight holds: a payment network whose members compete with each other can only function if the network itself is neutral ground.
What Happens in Two Seconds
When you tap your card on a terminal, you set off a chain of events involving four separate institutions across potentially three continents, resolving in under two seconds. Here is what actually happens.
The terminal captures your card details: the primary account number, the expiry date, and a cryptographic value called the authorisation request cryptogram, generated by the chip using a key that never leaves the card. This cryptogram proves the physical card is present without exposing the underlying keys. It is sent to the acquirer: the bank that processes payments on behalf of the merchant.
The acquirer reformats the transaction into an ISO 8583 message, a binary format with numbered fields and a bitmap indicating which fields are present. Field 2 is the primary account number. Field 4 is the transaction amount. Field 7 is the transmission date and time. This message is routed to the appropriate card network: Visa, Mastercard, Verve, or Interswitch, depending on the card.
The network routes the message to the issuer: your bank, the institution that issued the card. The issuer now runs a series of checks in fractions of a second. Is this card number real and active? Has it been reported stolen? Are there sufficient funds or credit available? Does the transaction match the cardholder’s usual patterns? Is the cryptogram valid?
The issuer returns an authorisation response: approved, declined, or a referral code. This response travels back through the network to the acquirer to the terminal. The terminal displays its result.
Total elapsed time from tap to approval: under two seconds. The participants in this exchange may be on different continents, operating under different regulatory regimes, using systems built in different decades.
Authorisation is Not Payment
Here is the thing most people do not realise about that green light on the terminal.
When your card is authorised, no money moves. The issuer places a hold on the funds: a reservation. The merchant has a promise of payment, not the payment itself. The actual transfer of money happens later, through a completely separate process called clearing and settlement, typically overnight or the following business day.
Banks and card networks historically ran authorisation and settlement as separate systems on different infrastructure. Authorisation was real-time by necessity: you cannot make a customer wait. Settlement was batch-processed by design: netting thousands of transactions together is far more efficient than settling each one individually.
This is why a hotel can hold funds on your card for incidentals and release them days later. It is why a refund takes three to five business days even when the merchant processes it immediately. The authorisation disappears in seconds. The settlement takes days. They are different things, and they run on different clocks.
Interchange: Why Your Bank Gives You Lounge Access
Every time you pay a merchant by card, the merchant pays a fee. This fee is called the interchange rate, and it flows, in the main, not to Visa or Mastercard but to your bank: the issuing bank.
The logic was this: issuers take on the credit risk. They fund the transaction before they receive settlement. They bear the fraud liability in most disputes. Without a fee that compensates for this risk, no bank would issue cards. The interchange exists to make participation economically rational for issuers.
The consequence is that your bank has a strong incentive to encourage you to spend. Cashback, air miles, lounge access, concierge services: all funded, ultimately, by the interchange your spending generates at the expense of the merchants you buy from. Every time you use a premium rewards card, the restaurant, the shop, or the petrol station absorbs a slightly higher fee so that you can have a free coffee at the airport.
Merchants know this and resent it. The legal battles over interchange rates are among the longest-running antitrust disputes in financial services.
Security as an Arms Race
The history of card security is a history of fraud finding the gap between one protection and the next.
Signatures could be forged and were rarely verified. The magnetic stripe encoded everything the attacker needed to clone a card, and card-skimming devices read it without the cardholder knowing. EMV chips, introduced across most of the world in the 1990s and in the United States considerably later, generated unique cryptographic values per transaction, making cloned cards useless even when the stripe data was stolen.
Fraudsters moved online, where the chip was irrelevant, and card-not-present fraud increased sharply wherever chip adoption grew. Contactless payments introduced a new concern, resolved in practice by transaction limits and device-held cryptographic keys rather than static card numbers.
Tokenisation is the current layer: the merchant never sees your real card number at all. A token, specific to that merchant or that device, is generated for each transaction. Compromising the merchant’s systems yields nothing useful. The actual card number never leaves the issuer’s infrastructure.
Each protection is real. Each creates a different attack surface. The attack surface migrates to wherever the weakest point is, and the weakest point changes with every new protection deployed.
The Shop Stopped Being a Place
By 2000, Visa had built one of the most sophisticated real-time distributed transaction systems on earth. Sub-second latency. Global reach. Billions of transactions per year. A governance model that kept thousands of competing banks cooperating on shared infrastructure.
And then the shop stopped being a place.
Once commerce moved online, the physical card was no longer present. The terminal was gone. The cryptographic handshake between chip and reader was impossible. The entire security model, built on the assumption of a physical transaction at a physical location, had to be rebuilt from scratch for a world of form fields and delivery addresses.
The companies that solved that problem were not banks. They were not card networks. They were software businesses that understood something the incumbents had missed: the real product was not the payment rail. It was the integration. It was the seven lines of code.
Episode 4: The Internet Changes Everything — why the interface ran ahead of the infrastructure, and the class of bugs that followed. Coming 23rd September, 2026.
The Money Stack is a ten-part series on the history and technology of how money moves.