Mutual authentication between card and transaction partners