Credit Card & Payment Messaging

Start here: the MTI, the bitmap and the data elements, a full authorization request decoded field by field, and where every code table lives.

The same value in three encodings, byte for byte — 0200 is 4 bytes in ASCII, 2 in packed BCD, 4 in EBCDIC — plus a full CP500 table and how to tell which one a dump uses.

Every well-established AID by scheme, plus why the terminal's 9F06 and the card's 4F can legitimately differ — and what "card not supported" usually means.

Hex to field numbers and back, with the arithmetic spelled out — plus the secondary-bitmap mistake that silently invents fields 65–128.

Every message type indicator you will meet — 0100, 0200, 0400, 0800 and their responses — plus what each of the four digits means and the three pairs people mix up.

Every numeric currency code with its alpha code and minor units — 764 THB, 840 USD, 392 JPY — and why the exponent decides where DE 4's decimal point goes.

Merchant category codes grouped by trade, with what each one actually affects — issuer risk rules, cashback, and why a wrong MCC gets a transaction declined.

The field reference: DE2/3/4/11/37/39 and other high-frequency fields in one plain sentence each, the rest grouped by purpose — amounts, time, institutions, clearing — plus why reserved fields differ between networks.

00 approved / 05 do not honor / 51 insufficient funds / 54 expired / 91 issuer down… each code's meaning, what to do, and soft-vs-hard declines.

All DE3 transaction types and the from/to account digits — 000000 purchase, 010000 cash withdrawal.

Every DE22 PAN entry mode code plus the PIN-capability digit — 05 chip, 80 fallback, 81 e-commerce.

Every EMV TLV tag you'll meet in DE55, grouped by purpose — with length, format, meaning, and how to read a tag byte that continues into the next one.

Nothing in a refund message says which purchase it reverses. DE38 approval code, DE37 RRN, DE31 acquirer reference data, Visa TID, Mastercard TLID — who generates each, what the rules guarantee, when each fails to match.

Libraries don't fail at parsing — they fail on the config you gave them. The six structural causes, the three silent ones that never raise an error, and what to rule out first.

"The UnionPay spec" is three different layers. Which one your question belongs to changes the answer — with the 1987 version anchor traced to published standards.

Authorization, financial, reversal, network management and a chip transaction with DE55 — each broken down field by field, and one click away from the parser.

The lingua franca of card payments. What an MTI is, how to read the bitmap, what the 128 data elements do — practise with the parser on this site.

What n 6, n ..19 and ans ...999 mean — and why the dot count is the length prefix.

Authorization, capture, clearing, settlement, refunds and chargebacks — the differences, explained once and for all.

0400 or 0420? How to fill DE90, why DE95 carries the remainder not the difference, how a retry becomes a double charge, and how a lost reversal turns into an orphaned hold — with a production checklist.

The only messages on the link that carry no money — and the first thing you hit during certification. Why DE 70, not the MTI, is the real opcode.

The issuer approves 30.00 of a 50.00 sale. Response code 10, a rewritten DE 4, and how to cut DE 54 into its 20-character groups.

STAN is a same-day trace number; RRN is a cross-system tracker.

Amounts are integers in minor units; convert using the currency's decimals.

0100 and 1240 use different dictionaries: DE22 subfields renamed, the MCC moves from DE18 to DE26, DE48 subelements become PDS tags — the publicly documented crosswalk.

Not the same kind of standard. The cross-border cutover finished in November 2025 and never touched the acquirer-to-issuer path — which of your links moved, and which did not.

Passing 3DS does not move liability — the authorization carrying the result does. Why Visa and Mastercard number ECI in opposite directions, and what to check when the outcome is wrong.

One is UTC by definition, the rest are local — and the field that says "local" never says which local. What you can and cannot derive from it.

Encoding (BCD/EBCDIC), headers, bitmap count, private DE48/62/63/55 — where the scheme conventions differ.

Why chip cards are safer, what each EMV TLV tag in DE55 means, how the ARQC cryptogram is generated, and how TVR/CVM drive the authorization decision.

Every Terminal Verification Results bit, byte by byte — and why a set bit is not a decline.

Capability, process, result — what the card declared, what the terminal recorded, and what actually ran.

Why a transaction can fail with DE 39 = 00 — the card returns AAC on the second GENERATE AC. Tag 9F27 bit by bit, with a worked trace.

The rule-by-rule algorithm behind every PIN prompt — and how to answer "the receipt says PIN verified but I never entered one".

How the transaction counter makes every cryptogram single-use, how it pairs with 9F13 — and why a gap in the sequence is not fraud on its own.

Every tag manual stops at "proprietary data". How to actually cut an IAD apart — Visa 0/1/3 and M/Chip layouts, DKI, CVN, and the CVR.

The wall of chip-transaction acronyms, each in one line with its TLV tag — look them up while decoding DE55.

Cardholder, merchant, issuer, acquirer — plus the card network. Who's involved in a swipe and how the money moves.

How each scheme links purchase, refund and dispute into one transaction, and why the Visa side cannot be assumed present.

A stand-in card number sits in DE 2, DE 14 is often empty, and reconciling by card number splits one cardholder into several.

The first 6–8 digits — they route the transaction to the right issuer.

Card security codes; the printed CVV2 must never be stored.

A merchant's "industry ID" — drives fees, rewards and risk.