Now, before I delve into the data you can find on a payment card,
it is important to recognize that the long‑term future of the
payment card isn't certain because with smart devices and
smartphones it's possible to make payment card transactions
without an actual payment card, and that trend is only going to increase.
But to understand even how the smart payment devices work,
we need to start with where card payments started,
and that's with physical payment cards.
Although all payment cards use different logos and colors,
they all have the same data elements on them,
and they're usually always in the same place on the card.
So let's find out where the data is on a payment card.
Starting on the front, there will always be the name of the card issuer,
typically a bank or a card brand or a card scheme.
Some cards will have this funny symbol that looks like ripples,
which says the card can be used with a contactless transaction.
And the majority of cards now contain a smart EMV chip that
helps make the transactions more secure.
Now we get to the data that's normally embossed on a card.
Across the middle of the card is typically a 15 or 16 or even 19‑digit number,
whereas the payment industry calls it the primary account number or PAN.
The first six or eight digits of the PAN are special because they're unique to
each bank and are called the bank identification number,
or BIN.
Some cards will have a valid from or a start date,
but all cards will have an expiration date after which
time the card is no longer valid.
Depending on which bank issued the card,
this could be labeled as valid til or until end or expiration date.
The cardholder's name will be there and,
finally, a logo from the card brand or card scheme,
American Express, Discover, JCB, Mastercard,
UnionPay, or Visa.
Turning to the back of the card, there's a lot less here.
The magnetic stripe contains all the data on the front of the card and more in
a digital form that can be read by a merchant's equipment.
It actually contains a couple of data formats known as tracks
that the merchant's system knows how to read.
These are brilliantly called track 1 and track 2.
And although the magnetic stripe is usually black or dark brown,
some manufacturers try really hard to make them an
attractive silver or gold magnetic stripe,
so you might see them as different colors.
So it might not even look like a magnetic stripe.
It might look like a piece of decoration.
But it's always going to be there in the same physical place on the card.
However, because of the recent adoption of chip cards and chip readers,
we're starting to see some cards issued without the magnetic stripe,
and they're called chip‑only cards.
There'll be a signature strip.
So when the cardholder signs a receipt,
the merchant will be able to compare the signature on
the receipt with the one on the card.
Yeah, I know that never happens,
that merchants never actually physically check signatures anymore.
And again, with chip cards,
pins provide the authentication that it's the customer making the transaction.
But that's what the signature strip is for.
And finally, most cards will contain a hologram so the merchants could,
if they wanted, look at the card and check to make sure it isn't a forgery.
Now, looking in a bit more detail at the magnetic
stripe on the back of the card,
we said it contains two tracks of data called track 1 and track 2.
The first track, track 1, is 80 characters long,
and it contains the primary account number,
the cardholder name, the expiration date,
and a service code that says what sort of card it is.
And you can see those numbers there encoded on that magnetic stripe.
What's also there is some dates that's using the
authentication process to prove the card is real.
This is called sensitive authentication data.
It's data that's been sent by the merchant to the
issuer that says if I've got this data,
it's probably more likely than not that I've got the real card.
There can be two types of sensitive authentication data on track 1.
Firstly,
the secret three‑digit number that's not printed anywhere on
the card that only the issuing bank knows.
Annoyingly, each card brand has a different name for this.
Visa calls it the card verification value, or CVV.
Mastercard calls it the card validation code, or CVC.
You'll see both written down quite commonly.
I'm going to stick to CVV for most of these terms.
There's also another value in there, which is used to validate PINs,
personal identification numbers, called the pin verification value,
or PVV.
But then I've not shown any of what might be after the card verification value.
Basically,
the rule is that anything from the card verification value onwards
that the issuer of card can do with what they want.
So it's usually got CVV there.
It's usually got PVV in there.
And this is quite important because there's some rules in PCI DSS
that say what data a merchant is allowed to store.
And so basically, any of the information you can see on screen in green,
so that's the service code and to the left of the service code,
the merchant can store any time they want.
Anything to the right of the service code,
so all the stuff that is shown in red,
and I've just shown 0s there because what's there is up to the issuer,
that data cannot be stored.
If we look at the other track, track 2, it's much shorter.
It's just 40 characters.
And again, you see it contains the primary account number,
the expiration date, and the service code.
Again,
to the right of the service code is information that
will be used by the card issuer.
And just as before, a merchant cannot store any of that information.
And it's typically going to be the CVV, the card verification value, in there.