EMV Cryptogram Breakdown
Every chip transaction produces a cryptogram, and the type of cryptogram tells you how much the issuer trusts it. This reference decodes the three you will meet.
| Type | Full name | Produced by | Meaning |
|---|---|---|---|
| ARQC | Authorisation Request Cryptogram | Terminal, during authorisation | The issuer must decide whether to approve |
| TC | Transaction Certificate | Issuer, on approval | Approved and committed |
| AAC | Application Authentication Cryptogram | Issuer, on decline | Declined, and the reason is inside |
The terminal generates an ARQC, which is a message authentication code over the transaction data plus a unpredictable number and the application transaction counter. The issuer recomputes the same MAC. If they match, the terminal is authentic and the data has not been altered in transit. The issuer then answers with a TC or an AAC.
How this tool works
The ARQC is a MAC computed over a fixed field set: the transaction amount, the unpredictable number, the transaction date and time, the application transaction counter and other terminal data. The issuer recomputes it with the same key. A match proves the terminal held the key and the data was intact. The response cryptogram is either a TC for approval or an AAC carrying the issuer decline reason.
When to use it
- Understand which cryptogram a transaction produced
- Debug a terminal that produces invalid MACs
- Read the issuer response in a chip log
- Explain a decline that carries an AAC reason
Frequently asked questions
What is an ARQC?
The Authorisation Request Cryptogram the terminal sends to the issuer with the authorisation request.
What is the difference between a TC and an AAC?
A TC means approved and committed. An AAC means declined, and it carries the reason code.
What is the MAC?
The message authentication code inside the cryptogram, computed over the transaction data.
Why does the unpredictable number matter?
It makes every MAC unique so a replayed cryptogram cannot be reused.