How To Read NFC Card Directories

We will instruct you here how to read contactless, i.e. NFC card directories, in other words, how to find the list of NFC credit or debit contactless applications that a given NFC card supports.

The detail instructions are provided in EMVCO® documentation, specifically, “EMV® Contactless Specifications for Payment System. Book B. Entry Point Specifications”.

Everything in this post is confirmed via experiments with real cards.

We intentionally do not use here any instructions beyond EMV® documentation. That is why information provided here is not enough for building a real NFC Terminal (PoS).

We do not provide here the exact formats of APDU Request-Response for ISO14443-4 commands because you will be using a specific NFC reader with its specific API, to invoke such commands.

Attn: to bad guys. You cannot find any useful information in this post that would help you to make fraudulent transactions, simply because the NFC EMV card does not provide data useful for this.

Step-by-Step Instructions

Step 1. Select PPSE. Issue Select command with file name “2PAY.SYS.DDF01”. and analyze APDU Response in further steps.

Step 2. Find Tag “6F” – FCI Template

Step 3. In the latter tag body (tag value), find Tag “A5” -> FCI Proprietary template

Step 4. In the latter tag body, find Tag “BF0C” – FCI Issuer Discretionary Data.

Step 5. In the body of FCI Issuer Discretionary Data, find all Tags “61” – Directory Entries. There may be more than one such tag there. However, all cards known to us comprise exactly one Directory Entry.

Step 6. In each Directory Entry you may find at least the following tags

  • Tag 4F – ADF Name, such as “A000031010” for Visa application AID, “A000041010” for Mastercard, etc. We always find such a tag in cards known to us.
  • Tag “50” – Application Label, such as “Visa Credit”, etc. We always find such a tag in cards known to us.
  • Tag “9F2A”, Kernel Identifier. We never find such a tag in cards known to us. Default kernels are Kernel 2 for Mastercard and Kernel 3 for Visa.

Having the list of ADF Names, you can continue reading NFC Data. See how to do this for Visa card and Mastercard card.