Mastercard · NFC

Mastercard contactless, full session

Step through a transaction one command at a time. Every field named, every status word explained.

Taught in modules

Step 2 of 566

Response2 bytes

6A 82

Status word

6A82File or application not found.

Decoded objects

No TLV objects in this response.

Exercises

Answer from the capture above. The explanation is worth reading either way.

Level 1
The terminal first selects 1PAY.SYS.DDF01. What status word does the card answer with?
Level 2
Tag 5F28 carries the issuer country code. What is its value, and which country is it?
Level 3
In the CVM list (tag 8E), what is the very first cardholder verification method the card proposes?
Level 3
Tag 9F35 is the Terminal Type, and it appears in this capture. Is it telling you what kind of terminal this was, or something else?
Level 3
Add up the CDOL1 in this capture. How many bytes of data does the card require the terminal to supply when it asks for a cryptogram?
Level 2
One entry in the CDOL1 is the terminal's contribution of freshness: four bytes it must generate anew for every transaction. Which tag is it?
Level 3
CDOL2 (tag 8D) is much shorter than CDOL1. What is CDOL2 for?
Level 2
The Cryptogram Information Data (tag 9F27) is 80. Which of the three cryptogram types did the card return: TC, ARQC or AAC?
Level 1
How many transactions has this card performed, according to its Application Transaction Counter (tag 9F36)? Answer in decimal.
Level 3
The CDOL1 lists what the card demands before it will produce a cryptogram. One of those entries is the terminal's own record of everything that went wrong during the transaction. Which tag is it?
Level 2
Tag 9F27 appears in this capture with three different values: 80, 40 and 00. Which cryptogram type is 00?
Level 2
The Application Transaction Counter (tag 9F36) appears in this capture as 0083, 0084 and 0085. How many transactions does that represent, and what does the counter guarantee?
Level 3
The Application Interchange Profile (tag 82) on this card is 1800. Which forms of offline data authentication does it support: SDA, DDA, CDA, or none?
Level 3
This card's IAC Denial (tag 9F0E) is 00 00 00 00 00. What has the issuer said?
Level 3
This card's IAC Online is B4 70 84 80 00 and its IAC Default is B4 50 84 00 00. Look at byte 4. Which condition is in Online but not in Default, and why would the issuer drop it?
Level 2
Tags 9F0D, 9F0E and 9F0F are read from the card. What is the terminal-side equivalent called, and who sets it?
Level 4
This card's tag 9F6E is seven bytes. Open the PayPal Mastercard capture and read its 9F6E too. Five of the seven bytes are byte-identical across the two cards. Give those five bytes.

Where this capture is taught

Every module below practices on this exact capture.

Decode your own bytes

Other capturesEMV contact transaction Mastercard business card Visa debit EMV replay session