Application Transaction Counter:
It is the number of transactions made with the card up to that moment. It increases by 1 with each transaction. It can also be used as a transaction number, which makes transactions easier to track.
Where is the ATC kept?
The ATC is a 2-byte counter kept on the card and is carried in EMV with tag 9F36. Its value is managed by the card; the terminal or the merchant cannot change it. The counter increases every time the card starts a transaction, whether the transaction is approved or declined.
Its role in security
The ATC is one of the data elements used in calculating the cryptogram generated by the card. Since a different ATC value is used in each transaction, the issuing bank can detect an attempt to copy the same transaction data and send it again. The bank compares the ATC value coming from the card with the last value it has seen:
- If the incoming value has been seen before or is smaller than the previous value, the transaction may be a replayed transaction.
- If there is a much bigger gap than expected between two transactions, it raises suspicion that the card may have been cloned or that many offline transactions have been made.
Relationship with offline transactions
The card also stores the ATC value used in the last online transaction. The difference between the current ATC and this value shows how many offline transactions the card has made in a row. This difference is compared with the consecutive offline transaction limits (LCOL/UCOL) to decide whether the transaction should be sent online.
