The 5,000-Mile Sprint: What Happens Between the Tap and the Beep

The $25 trillion journey of a one-kilobyte packet.

I order a large Diet Coke at McDonald’s (the best Diet Coke in the world, and yes, I will die on this hill). $1.99. I tap my card on the reader. The machine beeps before the lid’s on the cup.

In that fraction of a second, a data packet left the terminal, traveled across a private network you’ve never heard of, bounced through a data center in Virginia that has a moat around it, reached my bank’s authorization servers, got approved, and came all the way back. The receipt was printing before I grabbed a straw.

Part 1 covered what happens at the terminal: the chip wakes up, runs a cryptographic handshake, and generates a one-time proof called the ARQC. Now that proof needs to travel. And the road it takes is one of the quietest engineering feats in daily life.

The Smallest Package in the Building

The ARQC doesn’t travel alone. It leaves the terminal inside a structured message called an ISO 8583 packet, a format first standardized in 1987 that still carries every card authorization on earth.

Inside the packet: your card number (or its token), the transaction amount, the merchant’s ID, a category code, the terminal ID, the date, and the currency code. Plus the ARQC, the one-time cryptographic proof from your chip.

The whole thing is under 1 kilobyte. Smaller than most email signatures. The most sophisticated financial network on the planet routes a packet the size of a text message.

Off the Grid

That packet leaves the terminal over a dedicated, TLS-encrypted fiber connection to McDonald’s acquiring bank. The public internet plays no part in this.

The acquirer (a company like JPMorgan Merchant Services) is McDonald’s financial sponsor inside the card network. It holds a credentialed relationship with Visa or Mastercard and has agreed to represent the merchant on the network. Its only job is routing.

That first hop: 50 to 100 milliseconds.

The Road Nobody Built Twice

The packet arrives at VisaNet, Visa’s private global network, running through seven independent data centers across the U.S., London, and Singapore.

The flagship facility in Ashburn, Virginia sits on 44 acres. Concrete walls 18 inches thick, rated for 170 mph winds. A roof spanning 8.5 acres, designed to hold 20 feet of snow. Twenty-eight megawatts of backup power. 100,000 gallons of diesel, enough to run five days without the grid. 5,750 tons of cooling. 500 petabytes of stored transaction data. The road leading in has hydraulic bollards that can stop a car at 50 mph; anything faster hits a hairpin turn and lands in a drainage pond that functions as a literal moat. Only 75 of Visa’s employees worldwide are cleared to enter the secure data halls.

Trying to find pictures of that moat by the way... impossible. We’ll just have to take the internet’s word for it.

If the power grid fails, it keeps running. If the internet goes down, it keeps running. Each data center operates independently of the others and independently of every external utility.

Think of VisaNet like a privately owned Interstate Highway System where every vehicle pays a toll. Visa posted $40.0 billion in net revenue in fiscal year 2025. More than half was profit. The company doesn’t lend money, take credit risk, or hold customer deposits. It just owns the road.

Mastercard runs a parallel private network called Banknet, backed by over 1,000 data centers globally. Same economic model. Between them, Visa and Mastercard carried over $25 trillion in payment volume last year.

The barrier to competition is the infrastructure itself. Building a network like this costs billions, requires credentialed relationships with every major bank on earth, and demands the kind of uptime that tolerates roughly 32 seconds of unplanned downtime per year. Nobody has replicated it.

The Quiet Swap

Two things happen inside VisaNet that are worth diving deeper into.

First: if you paid with your phone, a quiet exchange takes place here. The token your phone sent, a 16-digit stand-in called a Device Primary Account Number, gets mapped back to your real card number inside the network’s secure vault. The merchant never had your real number. The acquirer never had it. The terminal didn’t either. Your actual card number surfaces here, briefly, inside a hardened data center, before anyone else in the chain sees it.

Each entity in the chain knows less than the one before it. The merchant sees the least. The network sees everything, for milliseconds.

Second: the network reads the first eight digits of your card number, the Bank Identification Number, and knows exactly which bank issued your card. Every BIN is provisioned by the network itself. Visa controls the global routing table for $16 trillion in annual payments volume.

This all takes 20 to 50 milliseconds. Then the packet moves on.

100 Milliseconds

Your bank receives the authorization request. It has roughly 100 milliseconds to respond.

In that window: validate the ARQC (run the same cryptographic math the chip ran and compare the output), check the available balance, confirm the card hasn’t been reported stolen, and run a fraud score across hundreds of behavioral signals simultaneously.

Then it sends back an authorization code and its own cryptogram, the ARPC, so your chip can verify the response came from the real bank. Authentication runs both ways, just like in Part 1.

(What happens inside those 100 milliseconds has quietly become one of the most sophisticated real-time AI systems in commercial use. That story is Part 6.)

Diet Coke

The response reverses. Issuer to network to acquirer to terminal.

Your chip receives the ARPC and validates it. The terminal beeps. Green light.

Total elapsed: under a second. Total distance for that $1.99 Diet Coke in Chicago to reach a Chase authorization server and come back: roughly 1,200 miles. Total data transmitted: less than 1 kilobyte.

Visa processes 322 billion of these every year. 83,000 per second at peak capacity. Uptime: 99.9999% (yes, really).

Every Diet Coke. Every Target stop. Every $4.50 latte. The same four hops, the same private road, the same packet smaller than a text message.

What Happens Next

The networks don’t just carry the transaction. They charge for the road. Every hop, every routing decision, every millisecond of infrastructure shows up as a fee carved from every purchase before the merchant sees a cent.

That math, who pays what, to whom, for how much, is Part 3.