What Is Physically on a Card

11.0 What this chapter gives you#

1. You will be able to name the six physical forms in which one card carries one piece of information, say which three are obsolete, and explain why all six are still there.
2. You will be able to read a track 2 record character by character, from the start sentinel to the check character, and say what each field is for.
3. You will be able to show that the 79-character and 40-character track limits are not round numbers but what the bit densities allow across 2.80 inches of usable track.
4. You will be able to explain why chip data written onto a blank magnetic stripe produces a card that is declined, and why that is a scheme rule rather than an implementation accident.
5. You will be able to read a three-digit service code and say whether the card is international, whether it carries a chip, and what the terminal should do about a PIN.
6. You will be able to say which of the eight ISO/IEC 7816-2 contacts do anything under EMV, and why C6 is a fossil.
7. You will be able to explain why a terminal accepting six brands runs six transaction state machines behind one tap.
8. You will be able to say why tag 57 is a track 2 record in shape only, and why tag 5F34 matters to anyone reconciling on the account number alone.
9. You will be able to justify the magnetic stripe’s survival to 2033 in terms of declined transactions rather than technology, and read the economics off the published timetable.
10. You will be able to describe how a card is laminated, punched, milled and personalised, and say where the boundary falls between plastics manufacturing and cryptographic key management.

Take the card out of your wallet and put it on the table in front of you. It weighs about five grams, and it carries, in six different physical forms, one piece of information that could be written on the back of a receipt: which account to charge.

Six. Not one. The number is stamped into the plastic so it stands proud of the surface. It is printed in ink. It is written magnetically into a strip of iron oxide. It is stored electrically inside a silicon chip. It can be recited over a radio link at 13.56 megahertz. And on many cards it is printed a second time, in small type, on the back.

Three of those six are obsolete. All six are still there.

This chapter is about the object itself: what each layer physically is, which standard governs it, what it holds, and why an industry that is otherwise ruthless about cost has not thrown any of it away.

The plain version#

Imagine you run a shop, and you have to leave a note for whoever opens up tomorrow. You do not know who that will be. It might be your grandmother, who only reads handwriting. It might be your colleague, who only checks the noticeboard. It might be the new assistant, who only reads text messages. You cannot teach any of them a new habit before morning, so you write the same note three times: once in pen, once pinned to the board, once as a text. The reader decides which copy they see.

A payment card is that note. It has to be readable by a card machine installed last month in a London coffee shop, by a petrol pump in rural Nebraska that has not been touched since 2009, and by a hotel in a country where the phone line to the bank is unreliable. Those machines cannot be upgraded on your behalf before you next buy a sandwich. So the card carries the same message in several formats at once.

What each copy of the note actually is#

The raised numbers on the front. These exist because of a machine most people under forty have never seen. Before card machines had telephone lines, a shop had a metal device with a roller. The shopkeeper laid your card in it, put a paper form on top with carbon paper underneath, and rolled the handle across. The raised digits pressed through the carbon and printed your account number on the form, which went in the post to the bank. That is why the numbers stick out rather than being printed flat: the card was a printing plate.

The brown or black stripe on the back. This is magnetic tape, exactly the same idea as a cassette. It has three parallel lanes running along its length, and a machine reads it by dragging a tiny magnetic sensor along one lane while you swipe. The whole stripe holds less than a short text message. The first lane holds seventy-nine characters, enough for your account number, your name, the expiry date and a few extra digits. The second holds forty and no name. The third holds a hundred and seven and is, in practice, empty.

The gold square. This is not a memory chip. It is a computer, with a processor, memory and a program, powered by the card machine through those gold contacts, which is why nothing happens until you push the card in. Unlike the stripe, the chip does not simply hand over what it knows. The terminal asks it questions and it answers with the results of calculations. That difference is the entire reason chips replaced stripes.

The invisible loop of wire. Somewhere inside the plastic, running around the edge of the card, is a coil of very fine wire you cannot see or feel. When you hold the card near a contactless reader, the reader’s own magnetic field induces a current in that loop, and the current powers the same chip. The card has no battery. It borrows power from the reader for the fraction of a second it needs.

The shiny hologram. A shopkeeper in 1990 could not phone the bank for every purchase, and needed a way to tell by eye that the card was real. A hologram was chosen because in 1985 you could not photocopy one, and printing one required equipment a forger with a garage did not have.

The white strip you sign. Once, the shopkeeper compared your signature on the receipt with the one on this strip. That comparison stopped being required years ago, and most people’s cards are now unsigned.

A worked example#

Suppose your card number is 4111 1111 1111 1111, it expires in December 2026, and your name is on it. Here is what is actually written into the second lane of the magnetic stripe, character for character:

;4111111111111111=2612201123456789012?

Read it left to right. The semicolon says “the data starts here”. Then sixteen digits of account number. The equals sign says “account number finished”. Then 2612, which is December 2026 written year-first. Then 201, a three-digit code telling the terminal what the card is allowed to do. Then twelve digits the bank uses for its own purposes. Then a question mark, which says “data ends here”, followed by one more character the reader uses to check it did not misread anything.

Thirty-eight characters. That is the whole of what a swipe transmits, and if you can read it you can make a working copy of the card. That single sentence is the reason the chip exists.

The first lane holds a richer version of the same thing, with your name in it:

%B4111111111111111^SINGH/SHIKHAR^2612201123456789?

The chip, by contrast, holds tens of thousands of characters, most of which it will never show anybody, because most of it is keys.

Where the plain version stops being true#

The note-in-three-formats picture is the right shape. Four things about it are wrong, and each of the four matters.

First, the copies are not identical, and the differences are the security. The plain version says the chip and the stripe carry the same message. They carry deliberately different messages. The chip does hold something that looks like the second lane of the stripe, and it even uses the same layout, but one field inside it is set to a different value on purpose. If a criminal reads the chip’s copy and writes it onto a blank magnetic stripe, the resulting card will be declined, because the value the issuer expects from a swipe is not the value the chip carries. This is not an accident of implementation. It is a scheme rule, and it is why chip data cannot be trivially downgraded into a stripe clone. Chapter 13 is about the four different check values that make this work.

Second, the chip does not “hold” your account number in the sense the analogy implies. It holds it, yes, and will read it out. But the thing the terminal actually needs from the chip is not stored on it at all: it is computed, freshly, for that transaction, using a secret key that never leaves the silicon. The card is not a container. It is a participant. Treating it as a container is the single most common misunderstanding among people building their first card integration, and it leads directly to designs that try to “read the card and send the data”, which is exactly what EMV was built to make impossible.

Third, “obsolete” and “unused” are different words. It is tempting to read the embossing, the hologram, the signature panel and the stripe as vestigial decoration. Three of the four genuinely are. The stripe is not: it is still the fallback when a chip fails to read, still the only thing some unattended machines can handle, and still in daily use in parts of the world. An issuer removing the stripe is not simplifying a card; it is accepting a measurable rate of declined transactions in exchange. That is a commercial decision with a number attached, and it is why removing it has needed a decade-long timetable.

Fourth, the plastic itself is engineered, not just cut to size. The plain version treats the card body as an inert rectangle. It is a laminated stack of polymer sheets built to survive bending, torsion, being sat on, being left on a dashboard, and thousands of passes through a reader, all while keeping a chip module and a wire antenna intact inside it. There are international standards for how far it may bend before it has failed, and how large a burr the punching die may leave on its edge. Card manufacturing is a precision plastics business with a cryptographic key-management business bolted to the end of it.

With those four corrections in place, the technical version will land properly.

The technical version#

The card body: ISO/IEC 7810 and what ID-1 means#

The format is called ID-1, and it is defined in ISO/IEC 7810, Identification cards — Physical characteristics. The nominal dimensions are 85.60 mm by 53.98 mm with a nominal thickness of 0.76 mm. ISO/IEC 7810:2019 states these as tolerance bands rather than nominals: for an unused ID-1 card, width 85.47 mm to 85.72 mm, height 53.92 mm to 54.03 mm, and thickness 0.68 mm to 0.84 mm. Corners are rounded to a radius of 2.88 mm to 3.48 mm. Edge burrs left by the punching die must not stand more than 0.08 mm above the card surface.

The same standard defines the other card sizes you will meet in this industry: ID-000 at 25.10 mm by 15.10 mm maximum, which is the full-size SIM outline; ID-2 at approximately 105 mm by 74 mm; and ID-3 at approximately 125 mm by 88 mm, which is the passport format. All four share the same thickness band.

ID-1 cards are also specified for mechanical behaviour. Under the standard’s bending test, an ID-1 card’s deformation must fall between 13 mm and 35 mm: too rigid and it cracks around the chip cavity, too limp and it will not feed through a reader. The test procedures themselves live in a separate series, ISO/IEC 10373-1, Cards and security devices for personal identification — Test methods — Part 1: General characteristics, and card service life evaluation is covered by ISO/IEC 24789-1:2024 and ISO/IEC 24789-2:2024.

A conventional payment card is not a solid slab. It is a laminated sandwich: overlay, printed front core, an inner inlay carrying the antenna, printed back core, rear overlay. The magnetic stripe sits on or within the rear overlay. The overlays take the abrasion so the print does not.

The magnetic stripe#

Two standards families govern the stripe. ISO/IEC 7811 covers the recording technique: what the stripe is, where it is, and how bits are written to it. ISO/IEC 7813 covers what a financial card must put on tracks 1 and 2. Track 3 content is specified separately in ISO/IEC 4909.

ISO/IEC 7811 is published in parts, and the numbering has a history that catches people out:

If a supplier quotes you ISO/IEC 7811-4 for track geometry, they are quoting a withdrawn part. The geometry is still correct; the reference is stale.

Where the stripe is#

ISO/IEC 7811-2 places the stripe on the back of the card, no closer than 2.92 mm (0.115 in) to the reference edge, with a minimum length of 82.55 mm (3.250 in) and a minimum width of either 6.35 mm (0.25 in) or 10.28 mm (0.405 in) depending on how many tracks are encoded. A stripe 82.55 mm long on a card 85.60 mm wide is effectively edge to edge.

The three tracks are parallel bands measured from the top reference edge. The figures as originally published in ISO/IEC 7811-4 and 7811-5 are:

Each band is therefore about 2.80 mm wide, with a guard gap of half a millimetre or so between them. Longitudinally, the centreline of the first data bit — the start sentinel — sits 7.44 mm ± 0.50 mm (0.293 in ± 0.020 in) from one end of the card, and the last data bit must not come closer than 6.93 mm (0.273 in) to the other. That leaves roughly 71 mm, or 2.80 inches, of usable track. Remember that figure; it is what makes the character limits come out where they do.

How bits are written#

The recording method is two-frequency coherent-phase encoding, universally abbreviated F2F and also known as Aiken biphase. There is a flux transition at every bit-cell boundary; a cell containing a 1 has an additional transition in the middle of the cell and a cell containing a 0 does not. ISO/IEC 7811-2 states it plainly: a flux transition occurring between clock transitions signifies a one, and its absence signifies a zero.

That is the property which made magnetic stripes work at all in the 1960s. Because every bit cell begins with a transition, the reader recovers the clock from the data itself, so it does not care how fast you swipe, only that you swipe at a roughly constant speed. A self-clocking code was the price of building a reader with no motor and no precision transport.

Average bit densities are:

Now the arithmetic. Track 1 at 210 bits per inch across 2.80 inches of usable length yields about 588 bits, which at 7 bits per character is 84 characters — comfortably above the 79-character maximum. Track 2 at 75 bits per inch across the same length yields about 210 bits, which at 5 bits per character is 42 characters, against a 40-character maximum. The limits in the standard are not arbitrary round numbers; they are what the physics allows with margin.

Track 1’s 64-character set is the printable ASCII range from 0x20 to 0x5F with 32 subtracted from each value, giving six data bits per character. Track 2 and track 3 use a 16-character set: the digits 0 to 9 plus the six symbols : ; < = > ?, which is ASCII 0x30 to 0x3F with 48 subtracted, giving four data bits per character. In both cases the data bits are followed by one odd parity bit: ISO/IEC 7811-2 requires that the total number of one-bits recorded for each character, including the parity bit, be odd. Bits within a character are recorded least significant first.

After the end sentinel comes a longitudinal redundancy check character. The rule is column parity: taken across every character on the track including the LRC itself, the count of one-bits in each corresponding bit position must be even. The LRC’s own parity bit is still odd parity, computed over the LRC character. Between per-character odd parity and per-column even parity, a single misread bit is always detected and its position can usually be located.

Coercivity#

Coercivity is the field strength needed to flip the magnetisation of the stripe’s oxide particles, and it distinguishes a stripe that survives a handbag magnet from one that does not. The ISO standards are explicit about not specifying it: ISO/IEC 7811-6 states that coercivity influences many of the quantities specified in the document but is not itself specified. What the standards specify instead is the resulting signal amplitude, which is what a reader actually cares about.

The commercial vocabulary is nonetheless universal. Low coercivity (“LoCo”) stripes are typically brown; high coercivity (“HiCo”) stripes are typically black. The figures usually quoted are around 300 Oe for LoCo and 2,750 Oe or 4,000 Oe for HiCo, and card manufacturers and reader vendors quote them with striking consistency, but no public specification states them; they are trade convention rather than published requirement, which is exactly what one would expect of a family of standards that declines to specify coercivity at all. What is verifiable is that a specific intermediate grade has a standard of its own: ISO/IEC 7811-8 is titled Magnetic stripe — Coercivity of 51,7 kA/m (650 Oe). Payment cards are HiCo; hotel keys and transit tickets are usually LoCo, being disposable.

What is actually written: ISO/IEC 7813#

ISO/IEC 7813 defines the data content of tracks 1 and 2 on a financial transaction card. Track 1 uses a format code; format code B is the one the financial industry uses, and format code A is reserved for the card issuer’s proprietary use.

Track 1, format B, in order:

Total: 79 characters maximum.

Track 2, in order:

Total: 40 characters maximum.

Two details are routinely got wrong. First, the expiry date and service code are not unconditionally four and three digits: ISO/IEC 7813 permits a placeholder character in place of either, ^ on track 1 and = on track 2, for cards where the field does not apply. A parser assuming fixed offsets after the PAN will break on such a card. Second, the PAN is variable length up to 19 digits; its structure, and the issuer identification number inside it, are governed by ISO/IEC 7812 and are the subject of the next chapter.

The discretionary data field is where the interesting things hide. On most cards it carries a PIN verification field and a card verification value. The value encoded on the stripe is CVV1 or CVC1, and it is not the number printed on the back. Chapter 13 explains why there are four of these values and what attack each one defeats.

The service code#

The service code is three digits, sits immediately after the expiry date on both tracks, and tells the terminal what the issuer permits. It is worth learning because it is also one of the inputs to the card verification value algorithm, which means an issuer cannot change it without invalidating every CVV already in the field.

So 201 is an international chip card, normal authorisation processing, no terminal restrictions. 221 is the same card with the issuer requiring online authorisation. 121 is a stripe-only international card. 702 is a private card, goods and services only, prompt for PIN where a pad exists.

A first digit of 2 or 6 is the stripe telling a swipe terminal there is a chip on this card, use it. That is the mechanism by which a chip-capable terminal refuses a swipe on a chip card and asks the customer to insert instead. It is also the field a fraudster with a stripe writer changes first, which is precisely why the service code is fed into the CVV computation.

Track 3#

Track 3 was designed to be read and written by the terminal, so an offline ATM could decrement a balance held on the card itself. Its content is specified in ISO/IEC 4909. It is, in payments, dead: almost no issuer encodes it and almost no terminal reads it. It survives in the standards, and in the physical geometry of the stripe, as a reserved band of plastic that nothing uses.

The chip#

The contact chip is governed by ISO/IEC 7816. Part 1 covers physical characteristics, part 2 the dimensions and location of the contacts, part 3 the electrical interface and transmission protocols, and part 4 the organisation, security and commands for interchange. EMV Book 1, Application Independent ICC to Terminal Interface Requirements, states directly that the EMV specification is based on the ISO/IEC 7816 series and then narrows it: EMV is a profile of 7816, not a superset.

The contacts#

ISO/IEC 7816-2 defines eight contacts, C1 to C8, in two rows of four on the front face of the card. Each must present a conductive rectangle of at least 2.0 mm by 1.7 mm. Horizontally, measured from the left edge of the card, the four columns occupy bands at 19.23 mm to 20.93 mm, 21.77 mm to 23.47 mm, 24.31 mm to 26.01 mm, and 26.85 mm to 28.55 mm. Vertically, the upper row’s required conductive area extends to 10.25 mm from the upper edge and the lower row’s begins at 12.25 mm.

The assignments, as EMV Book 1 sets them out:

Note C6. On the earliest smart cards, VPP supplied the elevated programming voltage needed to write EEPROM. Modern chips generate that voltage internally with a charge pump, so EMV forbids relying on it. If you have wondered why the gold plate has eight pads when only five do anything, that is the answer: two are reserved and one is a fossil. There is a second fossil: before 1990 an alternative contact position was in use, and ISO/IEC 7816-2 still discusses electrical isolation of the zones so a terminal can accept cards built to either convention.

Electrical behaviour#

EMV Book 1 specifies that the card shall operate at 5 V ± 0.5 V DC with a maximum current requirement of 50 mA, and that the terminal shall supply 5 V ± 0.4 V DC with a steady-state output current in the range 0 to 55 mA. The clock frequency must be in the range 1 MHz to 5 MHz, and once the card has answered to reset the terminal must hold the clock within ±1% of the frequency used during that answer to reset, for the remainder of the card session.

Two transmission protocols are defined: T=0, a character-oriented asynchronous half-duplex protocol, and T=1, a block-oriented asynchronous half-duplex protocol. EMV requires that a card support one of them and that a terminal support both. This asymmetry is deliberate: it lets issuers choose a chip platform without fragmenting the terminal estate.

What the chip holds#

Data on an EMV chip is organised as BER-TLV data objects, each identified by a tag. The identity-carrying ones are:

Tag 57, Track 2 Equivalent Data, is the one that causes confusion. It has the same field order as the magnetic stripe’s track 2 — PAN, separator, expiry date, service code, discretionary data — but it is packed as compressed numeric, two digits per byte, so the separator is the hexadecimal nibble D rather than the character =, and the final nibble is padded with F if the digit count is odd. It is a track 2 record in shape only. Its discretionary data carries the chip’s own card verification value, conventionally set to a different value from the stripe’s, so that lifting tag 57 off a chip and encoding it onto a blank stripe produces a card that fails verification.

Note also 5F34, the PAN sequence number. When a bank reissues a card after loss without changing the PAN, this is the field that distinguishes the new plastic from the old. Reconciliation systems keying on PAN alone will merge two physically distinct cards, a bug that only surfaces during a dispute.

Everything above is data the chip will hand over. The keys it uses to generate cryptograms are not in that list, because they are not readable by any command. That is the point of the chip, and the subject of chapter 15.

The contactless antenna#

The radio layer is ISO/IEC 14443, Cards and security devices for personal identification — Contactless proximity objects, in four parts: part 1 physical characteristics, part 2 radio frequency power and signal interface, part 3 initialisation and anticollision, part 4 transmission protocol. In 14443’s vocabulary the card is a PICC (proximity integrated circuit card) and the reader is a PCD (proximity coupling device).

The physical parameters from ISO/IEC 14443-2 are:

Two signalling types are defined and both are in use on payment cards. Type A uses 100% amplitude-shift keying with modified Miller coding from reader to card, and on-off keying of an 847 kHz subcarrier with Manchester coding from card to reader. Type B uses roughly 10% ASK from reader to card, with the modulation index required to lie between 8% and 14%, encoded NRZ-L, and binary phase-shift keying of the subcarrier from card to reader. A terminal must support both; a card implements one.

The 100% modulation of Type A is worth pausing on. Switching the field fully off is a blunt instrument, and during those gaps the card runs on whatever charge it has stored in its supply capacitor. Type B’s shallower modulation never removes power. Both survive because both were deployed before either won.

The card side of this is a coil: several turns of fine enamelled copper wire ultrasonically embedded into an inlay layer of the card body, or an etched or printed conductive track on a substrate. ISO/IEC 14443-1 defines antenna size classes; a full-size payment card carries a Class 1 antenna, the largest, running close to the perimeter. The chip module connects to it either galvanically, by welding or soldering the wire ends to terminals on the underside of the module, or inductively, by putting a small coil on the module which couples to a matching loop in the card antenna. The inductive approach — Infineon’s Coil on Module, and equivalents from other vendors — removes two solder joints from the most mechanically stressed part of the card.

On top of 14443 sits the EMV contactless specification set. It is published as EMV Contactless Specifications for Payment Systems in several books:

Book D is the EMV profile of ISO/IEC 14443. Book B, Entry Point, is the logic that decides which kernel to invoke based on the application identifier the card presents. The kernels map to schemes as follows: Kernel 2 (Book C-2) for Mastercard AIDs, Kernel 3 for Visa, Kernel 4 for American Express, Kernel 5 for JCB, Kernel 6 for Discover, and Kernel 7 for UnionPay. Kernel 1 was removed from Book A as of version 2.7. Kernel 8, Book C-8, was published by EMVCo on 5 October 2022 as a scheme-neutral kernel intended to coexist with the legacy kernels and, over time, reduce the number terminals must carry.

That list is the honest answer to “why is contactless acceptance so complicated”. A terminal accepting six brands runs six transaction state machines behind one tap.

Embossing#

ISO/IEC 7811-1 governs embossing. It specifies three typefaces: ISO 1073-1 OCR-A in sizes I and IV, ISO 1073-2 OCR-B in sizes I and IV, and the type font Farrington 7B — the slightly squarish face you will recognise from every embossed card you have ever held.

Machine-readable embossed characters are 4.32 mm (0.170 in) high with a centre-to-centre spacing of 3.63 mm ± 0.15 mm (0.143 in ± 0.006 in). Visually readable characters, used for name and address lines, are set at 2.54 mm ± 0.15 mm (0.100 in ± 0.006 in) pitch.

Relief height — how far the character stands proud of the surface — is specified twice, once for unused cards and once for cards returned from the field, because embossing flattens with use:

The standard defines two embossing areas. Area 1 is the identification number line and accommodates a maximum of 19 character positions — the same 19 as the maximum PAN length, which is not a coincidence. Area 2 is the name and address area and accommodates four lines of 27 characters each.

Embossing exists because of the manual imprinter, and its machine-readability requirement exists because for a period the industry expected imprinted vouchers to be read back optically. Neither use case survives. Most cards issued today are flat: the PAN is applied by laser engraving, thermal transfer or indent printing, and a growing number carry no PAN on the front at all. Embossing on a modern card is a design choice about how the card feels in the hand, and usually a premium one.

The hologram#

The optical variable device was introduced in the 1980s for one reason: a shopkeeper needed a counterfeit test that required no equipment, no phone call, and no training beyond “tilt it”. It worked because holographic origination equipment was, at the time, capital-intensive and rare.

The schemes have been steadily reducing it. Visa’s guidance is that hologram options were consolidated to a single design: vendors ceased production of the standard and mini dove designs on 31 December 2020, and from 1 January 2021 the updated Visa Product Brand Standards removed those options, leaving the silhouetted dove as the sole hologram. Cards carrying the Premium Visa Brand Mark do not require a dove hologram at all, because the brand mark itself carries the anti-counterfeiting security features.

The direction of travel is the same everywhere, and the reason is straightforward. A security feature that only works when a human inspects it loses its value in proportion to how many transactions involve a human inspecting anything. In a market where the overwhelming majority of face-to-face transactions are a tap and the rest are card-not-present, the hologram is defending a shrinking perimeter.

The signature panel#

The panel is a printed receptive coating — a surface that ink will bind to, which the card’s glossy overlay will not — usually laid over a tint or repeating pattern chosen so that an attempt to erase and re-sign leaves a visible mark.

Mastercard announced on 17 October 2017 that signatures would no longer be required at the point of sale in the United States and Canada from April 2018, and subsequently made the change global. From April 2019, Mastercard issuers globally were no longer required to include a signature panel on the back of Mastercard products. The other major schemes moved on comparable timelines.

The panel persists on many cards for two reasons that have nothing to do with payments: some jurisdictions and some non-payment uses of the card still expect a signature, and card designs are expensive to change so issuers batch such changes. Where the panel remains, it typically carries the printed card verification value — CVV2, CVC2 or CID depending on scheme — which chapter 13 distinguishes from the three other things called “the security code”.

Tactile identifiers#

ISO/IEC 7811-9 specifies a tactile identifier mark: a raised feature that lets a cardholder who cannot see the card determine what it is by touch.

The best-known implementation is Mastercard’s Touch Card, announced on 25 October 2021. It places a notch on the short side of the card, with the shape encoding the product type: a squarish notch for credit, a rounded notch for debit, and a triangular notch for prepaid. The notch also tells the cardholder which way round to insert the card, which matters when the chip contacts are on one face and one end only.

This is the one feature on the card that is getting more common rather than less, and the only one whose reader is a person rather than a machine.

Why all of this coexists#

The honest answer is that a payment card is a network device with a five-year life, and the network it talks to has a thirty-year life. Every acceptance device in the world constrains what a card may stop carrying, and no issuer controls that estate.

The magnetic stripe is the clearest case, because for once there is a published timetable. Mastercard announced on 23 August 2021 that the stripe would no longer be required on new cards in selected regions including Europe from 2024; that the United States would follow from 2027; that from 2029 no new Mastercard cards would be issued with a magnetic stripe; and that by 2033 no Mastercard cards with stripes would remain in circulation. That is a twelve-year plan to remove a feature already technically obsolete in Europe.

Read that timetable and you can reconstruct the economics. Between 2021 and 2033 the cost of carrying the stripe — a few pence of tape and a persistent cloning risk — was judged lower than the cost of the transactions that would fail without it. The stripe is not there because anybody wants it. It is there because removing it costs more than keeping it, and the crossover point arrives at different dates in different regions. As of 2026 the early milestones are in force in Europe; the later ones remain a stated intention, and the industry has revised such timetables before.

The same logic, with smaller numbers, explains the embossing, the hologram and the signature panel. Each survives in the space between “no longer required” and “actively removed”, and that space is measured in years.

Manufacturing and personalisation in outline#

Card production splits cleanly into two phases with different security regimes. Card manufacturing produces cards that are identical to one another. Personalisation makes one card belong to one cardholder. Everything expensive about card security governance lives at the boundary between them.

Manufacturing#

Artwork is separated and printed onto polymer sheets, many cards to a sheet — typical layouts are 21-up, 24-up or 48-up depending on the plant. Offset lithography remains dominant in secure card printing, with screen printing for metallic and opaque effects and digital printing growing for short runs.

The printed sheets are collated into a stack: overlay, front core, inlay, back core, overlay, with the antenna in the inlay. The stack is tacked together, usually by ultrasonic or thermal welding at the edges, so it cannot shift. Lamination follows: the stack goes between polished steel plates in a press, under heat and pressure, then cools under pressure. The polished plates give the card its finish; the cooling stage under load is what stops it curling.

The laminated sheet is then die-punched into individual ID-1 cards, which is where the 0.08 mm burr limit and the 2.88 mm to 3.48 mm corner radius are either achieved or missed. The magnetic stripe is applied either as part of the overlay film or hot-stamped as a tape after lamination. The hologram is hot-stamped.

For a chip card, a stepped cavity is then milled into the card face: a wide, shallow step to seat the contact plate flush with the surface, and a narrower, deeper pocket beneath it for the die and its bond wires. The module is placed over a hot-melt adhesive film and pressed by a heated die. On a dual-interface card, the module’s antenna terminals are joined to the embedded card antenna at this stage, or coupled inductively. Every card is then tested electrically, contact and contactless, and visually.

Personalisation#

Personalisation has a logical half and a physical half.

The logical half begins with data preparation inside a hardware security module. The issuer holds an Issuer Master Key; for each card the HSM derives card-specific keys by diversifying that master key over the PAN and the PAN sequence number, so compromising one card yields no information about any other. The output is a personalisation data set: application data, derived keys, the offline PIN, and the private key material used for offline data authentication.

Writing that data into the chip happens over a secure channel. The commands and structures are defined by the EMV Card Personalisation Specification, the channel by GlobalPlatform’s secure channel protocols — SCP02, triple-DES-based, deprecated but still widely deployed, and SCP03, AES-based. Where the personalisation bureau is not the key owner, secrets travel under separate transport keys: a data transport key, a PIN transport key and a key transport key. The bureau’s HSM decrypts under the transport keys and re-encrypts under the card’s session keys, so plaintext PINs and card keys never exist outside an HSM.

The physical half is embossing or laser engraving of the PAN, name and expiry; thermal transfer or indent printing of the CVV2; encoding of the magnetic stripe; and attachment of the card to its carrier for mailing. The PIN mailer, where one is produced, goes separately and is generated inside an HSM without any human seeing the value.

Who polices this#

The applicable standard is the PCI Card Production and Provisioning Security Requirements, published by the PCI Security Standards Council in two parts, Physical and Logical. Version 3.0 was announced on 13 January 2022 and covers card manufacturing, magnetic-stripe encoding and embossing, personalisation, chip initialising and embedding, storage, shipping and mailing, and the over-the-air provisioning of card credentials to devices.

One point matters commercially and is frequently misunderstood: while the requirements are maintained by PCI SSC, compliance is managed directly by the payment brands. A vendor works to the PCI document but is assessed and approved through each scheme’s own programme.

One card, summarised#

Six ways of saying one thing, one of which does the work.

The next chapter takes the thing itself — the number, all nineteen possible digits of it — and shows what each part of it means, who assigned it, and how a terminal knows in a millisecond that you have mistyped it.

11.98 Common wrong ideas#

Wrong: The chip and the stripe carry the same message in two formats. Right: They carry deliberately different values in one field, so chip data copied onto a blank stripe is declined — a scheme rule, not an accident of implementation.

Wrong: The chip is a container you read the account number out of. Right: It is a participant; what the terminal needs is computed freshly for that transaction using a key that never leaves the silicon, which is precisely what EMV was built to require.

Wrong: The stripe, the embossing, the hologram and the signature panel are equally vestigial. Right: Three of the four are, but the stripe is still the fallback when a chip fails to read and still the only thing some unattended machines handle, so removing it buys a measurable rate of declines.

Wrong: The card body is an inert rectangle cut to size. Right: It is a laminated polymer stack with tolerance bands, a specified bending deformation between 13 mm and 35 mm, and a limit of 0.08 mm on the burr the punching die may leave.

Wrong: ISO/IEC 7811-4 is the reference to quote for track geometry. Right: Parts 3, 4 and 5 were withdrawn and folded into Parts 1 and 2; the geometry is still correct but the citation is stale.

Wrong: LoCo at 300 Oe and HiCo at 2,750 or 4,000 Oe are figures from the standards. Right: ISO/IEC 7811-6 explicitly declines to specify coercivity and specifies the resulting signal amplitude instead; those numbers are trade convention.

Wrong: Expiry and service code are always four and three digits, so track 2 can be parsed at fixed offsets after the account number. Right: ISO/IEC 7813 permits a placeholder character in place of either, and the account number itself is variable up to nineteen digits.

Wrong: Tag 57 is the stripe’s track 2, so the two can be compared as strings. Right: It is compressed numeric at two digits per byte, with the hexadecimal nibble D as separator and F padding, and its discretionary data carries a different verification value on purpose.

Wrong: One account number identifies one piece of plastic. Right: A reissue after loss can carry the same number, distinguished only by tag 5F34, so reconciliation keyed on the number alone merges two physically distinct cards and the bug surfaces during a dispute.

Wrong: The gold plate has eight contacts because eight are needed. Right: Only five do anything under EMV; C4 and C8 are auxiliary and need not be physically present, and C6’s programming voltage is a fossil that modern chips generate internally.

11.99 Chapter summary in 20 lines#

1. A payment card carries one piece of information — which account to charge — in six different physical forms, three of which are obsolete and all six of which are still present.
2. It works like a note left in several formats at once, because the acceptance estate cannot be upgraded on your behalf before you next buy a sandwich.
3. The card body is ID-1 under ISO/IEC 7810, nominally 85.60 mm by 53.98 mm and 0.76 mm thick, specified as tolerance bands with corner radii and a burr limit.
4. It is not a slab but a laminated sandwich of overlay, front core, antenna inlay, back core and rear overlay, with a bending range specified so it neither cracks round the chip nor jams in a reader.
5. The magnetic stripe carries three parallel tracks recorded in self-clocking F2F encoding, so the reader recovers its clock from the data and does not care how fast you swipe.
6. Track 1 holds 79 alphanumeric characters, track 2 holds 40 numeric characters, and track 3 holds 107 and is, in payments, dead.
7. Those limits are what the physics allows with margin: 210 bits per inch across 2.80 usable inches at seven bits per character gives 84, against a 79-character maximum.
8. Per-character odd parity combined with per-column even parity in the check character means a single misread bit is always detected and can usually be located.
9. The standards specify signal amplitude rather than coercivity, so the familiar LoCo and HiCo figures are trade convention rather than published requirement.
10. ISO/IEC 7813 fixes what tracks 1 and 2 must carry, and the discretionary data field is where the PIN verification field and the stripe’s own card verification value hide.
11. The three-digit service code tells the terminal what the issuer permits, and a leading 2 or 6 is the stripe telling a swipe terminal that there is a chip and it should be used.
12. Because the service code feeds the card verification value computation, a fraudster who changes it invalidates the value, and an issuer cannot change it without invalidating every value already in the field.
13. The contact chip is governed by ISO/IEC 7816, of which EMV is a profile rather than a superset, with eight contacts of which five do anything.
14. Chip data is a set of BER-TLV objects, and tag 57 reproduces track 2 in compressed numeric with a deliberately different verification value, so a chip-to-stripe copy fails verification.
15. The keys that generate cryptograms appear in no tag list, because no command will read them out, and that is the point of the chip.
16. The contactless layer is ISO/IEC 14443 at 13.56 MHz, with two signalling types that every terminal must support and each card implements one of.
17. Above it sit the EMV contactless books with a kernel per scheme, which is the honest answer to why contactless acceptance is complicated: six brands mean six state machines behind one tap.
18. Embossing, the hologram and the signature panel each survive in the space between “no longer required” and “actively removed”, and that space is measured in years.
19. The tactile identifier mark is the one feature becoming more common rather than less, and the only one whose reader is a person rather than a machine.
20. The stripe is scheduled out over a twelve-year timetable to 2033 because the cost of carrying it was judged lower than the cost of the transactions that would fail without it, which is the economics of every layer on the card.

Chapter sources: ISO/IEC 7810:2019; ISO/IEC 7811 parts 1, 2, 4, 5, 6, 8, 9; ISO/IEC 7813:2006 and earlier editions; ISO/IEC 4909; ISO/IEC 7816-2 (1999 and 2007 editions); ISO/IEC 14443-2; ISO/IEC 10373-1; ISO/IEC 24789-1:2024; EMV Book 1, ICC to Terminal Interface Requirements; EMV Contactless Specifications for Payment Systems, Books A and D; EMVCo tag references and the October 2022 Kernel 8 announcement; PCI SSC Card Production and Provisioning Security Requirements v3.0; Mastercard and Visa published brand and product announcements.