9F27 Cryptogram Information Data (CID)

The Cryptogram Information Data is a single byte the card returns with every GENERATE AC response. It tells the terminal which type of cryptogram the card produced, and so what the card decided: decline, approve offline or go online.

Reading the byte

• Bits 8–7, cryptogram type: 00 AAC (decline), 01 TC (approve offline), 10 ARQC (go online), 11 reserved.
• Bits 6–5: payment system specific.
• Bit 4: advice required.
• Bits 3–1, reason or advice code: 000 no information, 001 service not allowed, 010 PIN try limit exceeded, 011 issuer authentication failed, others reserved.

So 00 is an AAC, 40 a TC and 80 an ARQC.

Where it fits

The terminal requests a cryptogram type in the GENERATE AC command, based on terminal action analysis. The card may return the same type or a more conservative one: it can answer an ARQC request with an AAC, but never answer an AAC request with a TC. The CID is how the terminal learns what the card actually did. In a format 1 response (template 80), the CID is the first byte of the response data rather than a separate TLV object.

Example

9F27 01 80: the card returned an ARQC. The terminal must send the transaction online, with the Application Cryptogram in 9F26, for the issuer to decide.

Common mistakes

• Testing the whole byte against 80 instead of masking bits 8–7. A value of 88 is still an ARQC, with the advice bit set.
• Assuming the card returned what the terminal asked for.
• Missing the CID in format 1 responses because it has no tag there.