The Authorization Chain

Key Takeaways

• ISO 8583 limits data passed between acquirer and issuer
• Network adds cross‑card risk scores but lacks merchant context
• Issuers penalized for fraud, not for false declines
• Value‑added services revenue doubled for Visa and Mastercard
• Capital One’s Discover deal targets end‑to‑end intelligence

Pulse Analysis

The payment‑authorization ecosystem has long relied on ISO 8583, a protocol designed in the 1980s that forces merchants to compress device fingerprints, session behavior, and purchase history into a few static fields. Modern PSPs such as Adyen and Stripe can generate detailed risk scores, but the message format discards that intelligence before it reaches the issuing bank. This structural bottleneck creates a blind spot that hampers fraud detection accuracy and inflates false‑positive rates, especially for recurring or low‑value e‑commerce transactions.

Network operators like Visa and Mastercard have responded by layering their own real‑time scoring engines—Visa Advanced Authorization and Mastercard Decision Intelligence—onto the stripped‑down message. These services inject cross‑network behavioral data, offering a different lens on risk that can lift approvals. However, they cannot reconstruct the merchant‑specific context lost at the acquirer handoff, meaning the combined intelligence remains fragmented. The result is a misalignment of incentives: acquirers are paid per volume, networks earn per switch, while issuers face penalties for fraud but not for excessive declines.

The financial impact is evident in the rapid growth of value‑added services (VAS). Visa’s VAS revenue rose from roughly $5 billion in FY 2021 to $10.9 billion in FY 2025, and Mastercard’s grew from $5.4 billion to $13.3 billion over the same period. Capital One’s $35.3 billion acquisition of Discover underscores a strategic shift toward owning the entire authorization stack, eliminating data seams, and capturing the recurring VAS revenue stream. As the industry moves toward richer data sharing under PSD3 and ISO 20022, firms that integrate end‑to‑end intelligence will gain a competitive edge, while those that remain siloed risk losing volume to more integrated players.