Seeing and controlling the system behind contactless transit payments

Overview

When a commuter taps a card, a whole payment system answers in milliseconds...

Visa's Payment Management System is the infrastructure layer that processes, routes and manages EMV contactless payments across mass transit networks. When a commuter taps a credit card, debit card, QR code or mobility card at a subway turnstile, PMS handles the transaction authorization, validation and financial settlement, all in milliseconds and offline-first by Visa's own standard.

The 2024 pilot in Brasília's Metro DF went live in production at two gates of the Central and Águas Claras stations, after a year of technical integration between BRB (the bank), Visa and the transit operator Transdata. Branded cards, mobility cards and QR code were all validated.

...but the operators running it could not see what was happening.

Transit companies, banks and city agencies need to see what is happening, act when something breaks and report performance up the chain. That is where design came in.

A survey by Visa found that 88% of travelers expect public transit systems to offer contactless payment.

Visa survey, 2021

My role

I led the UX design of the dashboards and the operator admin panel.

The work covered system visibility dashboards and the operator admin panel for enterprise-level financial control, across three metropolitan transit networks. I worked with cross-functional teams to design and implement scalable payment solutions for urban mobility.

The problem

What breaks when you can't see the system

EMV transit payments are a technically complex multi-party system. Transactions flow between validators, acquirers, processors and card networks, often fully offline. When something fails, it fails silently. The pain points were structural:

1. No real-time system visibility. Operators had no unified interface to monitor transaction flows, terminal health or error rates across gates and stations.
2. Fragmented admin control. Each partner (BRB, Transdata and the city agency teams) had different access surfaces and different data, with no shared source of truth.
3. Multi-tenant complexity. The same PMS infrastructure served multiple operators across cities and countries, but the access and reporting model did not reflect that hierarchy.
4. High stakes, low tolerance. A misconfigured terminal or an undetected error can block thousands of daily commuters from boarding.
5. International expansion. As the rollout extended to Rio de Janeiro and Buenos Aires, the admin panel had to scale across different regulatory, banking and operational contexts.

Users

Four kinds of operator share one system, with very different priorities.

The PMS admin panel serves operators, not end consumers. Understanding their different mental models was foundational to every design decision.

1. Transit operator, such as Metrô DF. Monitors gate and station performance daily. The main concern: are commuters getting through, and is the system stable?
2. Acquiring bank, such as BRB. Needs financial reconciliation, settlement reports and anomaly alerts. Accuracy above everything.
3. Technical integrator, such as Transdata. Manages firmware, terminal configuration and deployment logistics, and needs low-level access and device diagnostics.
4. Visa program oversight. Monitors network-wide KPIs across cities and operators: adoption rates, failure patterns and expansion readiness.

The design challenge was one cohesive interface that serves all of them, without drowning any group in information meant for another.

Two pillars

System visibility and admin control

1. System visibility dashboard. Real-time and near-real-time monitoring of transaction flows, terminal health, payment method distribution, approval rates and error signals, designed to surface the right signal at the right moment instead of everything at once, without overwhelming operators who are not data analysts.
2. Operator admin panel. A multi-tenant management interface where transit companies and banking partners configure access, manage devices, review settlement reports and handle exception cases, with strict role-based access across entities with very different technical literacy.

Reflection

The best result of this work is the one commuters never notice.

No commuter sees the admin panel. They feel it when a turnstile opens in under half a second, when a settlement reconciles without intervention, when an expansion to a new city does not require rebuilding the product from scratch. Design is the reason.

This project solidified my belief that the most impactful product design happens where deep technical understanding meets genuine user empathy. Complexity is where it matters most.