The first two digits of DE22 carry the PAN entry mode — the mechanism that read the card number. Below is the full list. Anything not in this table is either scheme-private or a value your acquirer defined; check the relevant scheme manual before assuming a meaning.
| Code | PAN entry mode |
|---|---|
00 | Unknown |
01 | Manual key entry |
02 | Magnetic stripe read |
03 | Bar code |
04 | OCR |
05 | Chip (ICC), CVV reliable |
07 | Contactless chip (EMV) |
10 | Credential on file |
80 | Fallback from chip to magnetic stripe |
81 | E-commerce |
90 | Magnetic stripe, full track read |
91 | Contactless magnetic stripe |
95 | Chip, CVV/iCVV unreliable |
The third digit is PIN entry capability — a statement about the terminal, not about whether a PIN was actually entered on this transaction. A terminal can be PIN-capable and still run a signature or no-CVM transaction.
| Digit | PIN entry capability |
|---|---|
0 | Unspecified |
1 | PIN entry capable |
2 | Not PIN entry capable |
8 | Reserved |
9 | Capable but PIN not used this time |
Split it two-and-one. The first two digits index the PAN entry table, the last digit indexes the PIN table. Four examples that cover most of what you will see in a real log:
| DE22 | Reads as |
|---|---|
051 | Chip read, CVV reliable + terminal is PIN capable — a normal contact EMV sale |
071 | Contactless EMV + PIN capable — a normal tap |
810 | E-commerce + PIN capability unspecified — a card-not-present sale |
802 | Chip-to-magstripe fallback + terminal not PIN capable |
Most of the table is background. Four values do real work when you are debugging declines or disputes:
80 — fallback. The chip failed to read and the terminal fell back to the stripe. Issuers commonly treat fallback as elevated risk, and some decline it outright. A sudden rise in 80 across one merchant usually means a dying card reader, not fraud.05 vs 95. Both are chip reads. 05 asserts the card verification value was reliable; 95 says it was not. Treating them as interchangeable hides a real signal.07 vs 91. Both are contactless taps, but 07 is full EMV contactless while 91 is contactless carrying magstripe-rules data. The cryptographic protection differs.81 and 10. Card-not-present. Neither carries a chip cryptogram, so authentication has to come from elsewhere — 3-D Secure, a network token, or a stored-credential indicator.DE22 travels in the authorization request (0100 / 0200) and is echoed through the rest of the transaction's life. It is one of the fields an issuer's risk engine reads before it ever looks at the amount, and it is usually the first thing a disputes analyst checks when arguing about liability.