💳 Payment cards

The card's place in French payments

A cashless payment is any transfer of funds recorded as an entry on an account. In France, the card is by far the leading cashless payment method by volume. It overtook the check in the early 2000s, then captured most of the growth in everyday payments, driven first by contactless and then by mobile payments. Its share by value remains marginal. Credit transfers account for more than 90% of the amounts exchanged, because they carry salaries, B2B flows, and high-value payments.

The average ticket is the total amount paid by card divided by the number of transactions. It has fallen steadily, from about €50 in the early 2010s to about €30 today, because cards are replacing cash for small amounts, down to the bakery. Raising the contactless limit to €50 in May 2020 sped up the shift by bringing below the contactless threshold payments that had until then required a PIN.

Card types: debit, credit, deferred debit, prepaid, commercial

The French term “carte bancaire” covers several products with very different debiting mechanics, costs, and regulatory regimes. Since the EU IFR 2015/751 regulation, schemes must identify each card as debit, credit, or commercial. That category directly determines the applicable interchange, the fee the acquirer pays the issuer on each transaction.

• In France, “credit card” is often misused to mean a deferred debit card. True revolving credit on a card remains a minority product, unlike in the US or the UK.
• Cards with systematic authorization, which check the balance on every transaction, are used for entry-level offers and financially vulnerable customers: no overdraft is possible, but they are declined at tolls and parking lots that have historically worked offline.
• Virtual cards (single-use or time-limited numbers generated on demand) are booming both for businesses (supplier payments, online travel agencies) and for consumers (e-commerce).

CB-Visa and CB-Mastercard co-badging

Co-badging means carrying two payment brands on the same instrument. Almost all cards issued by the major French banks are co-badged, which remains a French specialty. The same chip carries CB, the domestic scheme run by the GIE Cartes Bancaires banking consortium, and Visa or Mastercard, used for international transactions and for e-commerce outside the CB network.

In mainland France, a transaction at a CB-affiliated merchant is routed over the CB network by default. Visa or Mastercard take over only outside France, on foreign merchant websites, or at the few merchants not affiliated with CB. Article 8 of the IFR guarantees freedom of brand choice. The merchant can set a priority, but the cardholder must be able to override it at the terminal, with a dedicated key or an on-screen choice.

Technically, co-badging takes the form of two separate EMV applications on the chip (the CB AID A0000000421010, and the Visa or Mastercard AID), each with its own keys and parameters. The terminal builds the list of AIDs it shares with the card, called the candidate list in EMV application selection, and then applies the priority rules.

Anatomy: PAN, BIN, CVV, magnetic stripe, chip

Every physical and logical element of a card plays a specific role in the payment chain, and each carries its own risk profile. The PAN identifies the account, the CVV2 serves as evidence of possession of the physical card in card-not-present sales, and the chip generates a cryptogram unique to each transaction. PCI DSS rules, fraud patterns, and tokenization are all defined in relation to these elements, each referring to the element it protects or replaces.

  4970 1034 5678 9015          <- PAN (Primary Account Number), 16 digits here
  |______|                        (13 to 19 digits depending on the scheme, ISO/IEC 7812)
     |
  49701034  <- IIN / BIN: identifies the issuer and the product
              (8 digits since April 2022, historically 6)

  First digit(s) = MII, identifies the scheme:
    4xxxxx          -> Visa
    51-55 / 2221-2720 -> Mastercard
    34 / 37         -> American Express (15 digits)
    6xxxxx          -> Discover, UnionPay...

  5678901  <- individual account identifier assigned by the issuer
        5  <- Luhn check digit (weighted sum mod 10)
              catches typing errors, NOT fraud

;4970103456789015=29072011234567890?
 |________________|
        PAN         2907  <- expiry date in YYMM format (July 2029)
                        201 <- service code:
                              2xx = international use + EMV chip present
                                    (the terminal must read the chip)
                              x0x = normal authorization, no issuer restriction
                              xx1 = no usage restriction
                                    (PIN required at ATMs only)
                    ...     <- discretionary data, including the CVV1
                               (not the same as the CVV2 printed on the back!)

Track cloning (skimming) has become useless in EMV markets:
service code 2xx forces a chip read, and the stripe alone
is declined (the "chip liability shift" rule).

Limits, authorizations, and declines

A card limit is the maximum amount the cardholder can spend over a given period. Every card has separate payment and withdrawal limits, calculated over a rolling period, often 30 days for payments and 7 days for withdrawals. The card tier sets these amounts. Issuers increasingly adjust them in real time through the cardholder's banking app.

• Contactless card payments: a €50 maximum per transaction since May 2020, with SCA soft limits (typically €150 cumulative or 5 consecutive transactions) that trigger a PIN request, as required by PSD2 (RTS Art. 11).
• Mobile payments (Apple Pay, Google Pay) are not subject to the €50 limit: biometric unlocking (CDCVM) counts as strong authentication.
• Exceeding a limit results in an issuer decline with response code 51 (“insufficient funds / limit exceeded”); the merchant sees only the decline, never the detailed reason on the customer's side.
• Limits are an issuer risk management tool, not a guarantee for the merchant: an approved authorization can still end in a dispute and a chargeback.

The card in the four-corner model

The four-corner model describes how a card transaction is organized among four separate parties: the cardholder, the merchant, the issuing bank, and the acquiring bank. The scheme (CB, Visa, or Mastercard) coordinates the four. It sets the rules, runs the authorization network, and organizes clearing and settlement between the two banks.

That night, the day's transactions go through end-of-day batch upload: the terminal sends them to the acquirer, and they are then cleared. The issuer settles with the acquirer for the amount minus interchange. The acquirer credits the merchant for the amount minus the merchant service charge (MSC), which bundles interchange, scheme fees, and the acquirer's margin. The cardholder's account is debited according to the card type, immediate or deferred.