Anatomy of a Bank Card

The front of a card carries the cardholder name, the card number, the expiry date and usually the scheme logo, while the back carries the magnetic stripe, the signature panel and the three digit security code. The card number, also called the Primary Account Number or PAN, is typically 16 digits long, and its first six to eight digits identify the issuing bank and the scheme, while the remaining digits identify the individual account. The expiry date tells a terminal and a website when the card stops being valid, and a card used after expiry will be declined. The security code, printed on the back for most cards, proves the cardholder holds the physical card, which is why it is used for online purchases. The chip, the small gold contact plate on the front of the card, is a secure computer that stores the card data and runs the checks that approve or decline a transaction. When a card is inserted into a terminal, the chip talks to the terminal, checks the PIN, applies the card limits and creates a cryptogram, which is a one time code that proves the card is genuine. The magnetic stripe on the back is an older technology that stores the same card data in a magnetic band, and it is read by swiping the card through a terminal. The stripe can be copied more easily than the chip, which is why chip transactions replaced stripe transactions in most countries, and why some cards no longer carry a stripe at all. The contactless antenna is a thin coil inside the card that lets it communicate with a terminal by radio when the card is held near the reader. A tap creates the same kind of cryptogram as a chip insertion, but without a PIN for low value payments, and the limit for a PIN free tap is set by the country or the scheme, often around EUR 50. Above that limit, or after several consecutive taps, the terminal asks for a PIN, which resets the contactless counter. The antenna also works inside a phone or a watch when the card is tokenised, which means the real card number is replaced by a device specific token, so a stolen phone does not expose the real PAN. Each element of the card maps to a data field in the transaction, and a business analyst must know which field carries which value. The PAN identifies the issuer and the account, the expiry date is checked at authorisation, the service code tells the terminal whether chip, stripe or contactless is allowed, and the cryptogram proves the card is genuine. The security code is checked only for card-not-present payments, and it must never be stored after authorisation, because storing it breaks the scheme rules and creates a fraud risk. Testing should cover a card with an expired date, a wrong security code, a blocked chip and a damaged stripe, because each failure must produce a clear decline code and a message the cardholder can understand. Worked example with numbers: a cardholder holds a Meridian Bank debit card with PAN 5432 1098 7654 3210, and the first six digits, 543210, are the Bank Identification Number that names Meridian Bank as the issuer, while the last four digits, 3210, are the only part the merchant may print on a receipt. When the cardholder taps the card for a EUR 45 purchase, the chip creates a cryptogram that proves the card is genuine, and the terminal sends the PAN, the expiry date, the amount and the cryptogram to the acquirer. The acquirer routes the request to the scheme, the scheme routes it to Meridian Bank, and the bank checks the account balance before it approves, all in under two seconds. Failure and recovery: the card fails when the chip is damaged, when the card is expired, or when the PAN is entered wrong. If the chip is damaged, the terminal falls back to the magnetic stripe, but the issuer may decline a fallback transaction, because the stripe is easier to copy than the chip, and the cardholder must then use another payment method or a new card. If the card is expired, the issuer declines the transaction, and the cardholder must use a replacement card. The recovery for a damaged chip is a replacement card, which takes three to five working days, and the cardholder should be given a way to pay in the meantime, such as a mobile wallet linked to the same account. For a business analyst, product owner or subject matter expert, the card anatomy requirement must state which data element maps to which transaction field, the PAN to the account, the expiry date to the validity check, the service code to the terminal behaviour, and the cryptogram to the authentication. The requirement must also state the masking rule, only the last four digits of the PAN may be shown on a receipt or a screen, and must state that the full PAN must never be stored in plain text. The test pack must include a card with a damaged chip, an expired card, and a card with a wrong PAN, because each case exercises a different part of the anatomy. Source: ISO/IEC 7812; EMV specifications; last reviewed 7 November 2026.