Cryptogram and EMV Transaction Flow

Owned by IT-ADMIN G (Deactivated)
Last updated: Jan 15, 2024 by Yan Mu
3 min read

3 types of cryptograms can be generated by the card:
- An AAC is generated whenever a card declines a transaction.
- An ARQC is generated whenever a card requests online authorization.
- A TC is generated whenever a card approves a transaction.



Here’s part of what I’ve learned from EMV Book 3.

  • The data object list for Gen AC 1 is in 8C.

  • The CDOL for Gen AC 2 is in 8D.

  • The CDOL data is (are) gathered by the kernel. You do not request these tags in the SDK.

  • If Gen AC 1 gives ‘ARQC’, you’re supposed to go online. (If it gives TC or AAC, you’re done.)

  • If you go online, you will get back tag 89 (auth code, typically printed on the receipt), 8A (ARC), optionally tag 91, and optionally 71 and/or 72.

  • If you can’t go online, you need to manually set 8A to ‘Z3’ for the 2nd Gen AC and proceed to Completion.



  • Tag 91 (Issuer Authentication Data) can be 8 to 16 bytes of stuff. (It varies because it allows for discretionary data.) It will contain the decision of the issuer plus flags indicating things to do or not do before completion. (Has nothing to do with scripts.) The decision of the issuer is in the top bit of Byte 2 (bit ON==Approved Online). See Annex C8 of Book 3.



DISCUSSION

Issuer Authentication is optional, so Tag 91 is optional. (Obviously,