🔢 Card payment codes and identifiers

MCC: the merchant category code

The MCC (Merchant Category Code, ISO 18245) is a 4-digit code, assigned by the acquirer, that classifies the merchant's business. It travels in every authorization (DE18) and every clearing presentment. It drives a wide range of processing: interchange tables, program eligibility, stand-in limits, usage restrictions (corporate cards, teen cards), cardholder cashback, reporting obligations, and even regulatory blocks (gambling, crypto).

• The MCC is assigned per merchant agreement: a merchant with several lines of business can have several agreements or MIDs with different MCCs.
• Issuers rely on the MCC for parental controls, corporate cards (permitted categories), and cashback programs.
• In reporting, cross-referencing MCC and approval rate reveals specific pockets of declines (e.g., MCC 6051 declined more often by some issuers).

BIN / IIN: identifying the issuer

The first digits of the PAN form the IIN (Issuer Identification Number, ISO/IEC 7812), commonly called the BIN. Historically 6 digits long, the standard moved to 8 digits in April 2022 to deal with a shortage of ranges. The first digit (MII) indicates the family: 4 = Visa, 5 (and 2221–2720) = Mastercard, 3 = Amex/Diners/JCB, 6 = Discover/UnionPay, and so on. The BIN drives routing, meaning which issuer the authorization is sent to. It also feeds the BIN tables that PSPs use to detect the issuing country, card type (debit/credit, consumer/commercial), and co-badged brands.

PAN : 4 9 7 0 1 0 1 2 3 4 5 6 7 8 9 0
      |_____________|                     IIN/BIN, 8 digits: 49701012
      |                                   MII: 4 = Visa
                      |___________|       individual account identifier
                                    |     Luhn check digit (modulo 10 check)

Luhn check (right -> left):
  double every second digit, subtract 9 if > 9,
  add everything up: total % 10 == 0  =>  PAN is structurally valid.
Caution: Luhn validates the FORMAT, not whether the account exists
(response code 14 "invalid card number" is still possible).

ARN, RRN, STAN: tracing a transaction

A single transaction carries several distinct identifiers, which vary by processing stage and by the party that generates them. Each has its own scope: some only last for an authorization session, others survive until a dispute reaches arbitration. Telling them apart is essential for reconciliation and dispute management. Quote the wrong reference and the recipient won't find a match.

ARN : 2 433261 6192 00000123456 7
      |                              format: 2 = acquirer presentment
        |____|                       acquirer BIN (6 digits)
               |__|                  Julian date YDDD: 6192
                                     = year ...6, day 192 = 2026-07-11
                    |_________|      sequence number / film locator
                                |    check digit (Luhn)

Use: the ARN is what the issuer and the acquirer quote in
a chargeback or a retrieval request. Without an ARN, no
arbitration with the scheme is possible.

ECI: the e-commerce authentication indicator

The ECI (Electronic Commerce Indicator) describes the authentication level of a card-not-present transaction: full 3-D Secure, attempted, or none. It determines the liability shift. On a properly authenticated transaction, stolen or compromised card fraud is the issuer's loss, not the merchant's. Each scheme uses its own scale, so the same authentication outcome carries a different code at Visa and at Mastercard.

Transaction codes: the language of clearing

In clearing, every record carries a transaction code that identifies what kind of record it is. At Visa (Base II format) these are TCs, while at Mastercard (IPM) the MTI + function code combination plays the same role. These codes structure every clearing file and acquirer report, so you need to know them to read those files.

Mastercard uses the following IPM equivalents. 1240 with function code 200 = first presentment, the equivalent of Visa's TC05. Then 1240/205 = second presentment, 1442/450-453 = chargeback and later cycles, 1740 = miscellaneous fees (fee collection), and 1644/603 = documentation request (retrieval request). Acquirer reports aggregate these records; breaking them back down to the individual record shows the underlying transactions.

Reading a receipt and a merchant statement

The codes described above appear on two everyday documents: the receipt (sales slip), printed or digital, and the acquirer's monthly merchant statement. The first documents a single transaction. The second covers a full month of activity and the related billing.

        CARD PAYMENT
       CB CONTACTLESS             technology used (contact/contactless)
ON 07/11/26 AT 12:34:56           transaction date and time
DUPONT BAKERY                     merchant name (DE43)
75011 PARIS
1234567                           merchant contract number (MID)
00012345                          terminal number (TID)
############1234                  masked PAN (last 4 digits only)
A0000000421010  CB                AID: selected application (CB here)
                                  -> on a co-badged card, "VISA DEBIT" here
                                     would signal routing to the international brand
AUTH NO: 123456                   issuer authorization code (DE38)
001234  000012                    batch number / transaction number (STAN)
AMOUNT =
              12.50 EUR
DEBIT                             transaction direction (DEBIT/CREDIT)
      MERCHANT COPY               copy (merchant / customer)
   KEEP FOR 13 MONTHS             recommended retention period (disputes)

• The AID reveals the routing: A0000000421010 = CB, A0000000031010 = Visa, A0000000041010 = Mastercard. On a co-badged card, this is where you see which brand was actually used, and therefore the cost (see the interchange topic).
• The authorization code is printed on the receipt: it's what gets matched against the cardholder's bank statement when a customer disputes a payment they don't recognize.
• Masked PAN: a merchant receipt that shows more than the last 4 digits (or an expiration date) indicates a noncompliant terminal and should be escalated immediately.
• Contactless with no PIN line: a no-CVM transaction, which is easier to dispute; receipts for PIN transactions mention the verification.