A payment cryptogram is a one-time digital code that your chip card, contactless card, or mobile wallet generates during each transaction to prove the payment is genuine. Because the code is mathematically tied to that one purchase, anyone who intercepts it gets nothing they can reuse. This is what replaced the static data stored on magnetic stripes, which criminals could copy and replay at will, and it’s the main reason counterfeit card fraud at physical terminals has fallen sharply since chip cards became standard.
How the Code Is Built for a Single Transaction
When you insert, tap, or wave your card at a terminal, the chip runs a cryptographic calculation and produces a short, unique value. That value works like a digital fingerprint for the purchase: it encodes who is paying, how much, and when, then locks all of it together with a secret key that only the chip and your bank hold. The terminal sends this fingerprint to the bank, which runs the same math on its own end. If the two results match, the bank knows the card is real and nothing about the transaction has been altered in transit.
What makes this resistant to fraud is freshness. Every cryptogram depends in part on a random number the terminal generates on the spot. Someone who records a cryptogram from one purchase can’t replay it later, because the next terminal will produce a different random number and the old code won’t match.
Several inputs feed the calculation, each doing a specific job:
- The Application Transaction Counter, a tally inside the chip that goes up by one with every transaction, so no two cryptograms share a sequence number.
- The Unpredictable Number, a fresh random value the terminal produces for each purchase. This is the main defense against replay.
- The transaction amount and currency, binding the code to the exact figure so any change invalidates it.
- A secret key that lives inside the chip’s secure hardware and never leaves it. The bank holds a matching copy.
The chip runs these inputs through an encryption algorithm and produces the cryptogram in milliseconds. The whole exchange follows the EMV standard, originally developed by Europay, Mastercard, and Visa.
Three Kinds of Cryptograms the Chip Can Produce
The chip doesn’t always generate the same kind of code. Which one it produces depends on whether the transaction needs to go online for bank approval, can be completed offline, or should be declined immediately.
- An Authorization Request Cryptogram (ARQC) is the most common. The chip generates it when it wants the issuing bank to make the final decision, and the ARQC travels through the payment network carrying encrypted proof that a real chip started the transaction.
- A Transaction Certificate (TC) is generated when the chip approves the purchase without contacting the bank. It acts as a permanent cryptographic receipt. Locations with unreliable connectivity often rely on this.
- An Application Authentication Cryptogram (AAC) is the chip’s way of saying no. If its own risk checks flag a problem, it produces an AAC to decline the transaction before it ever reaches the bank.
After the bank receives and validates an ARQC, it sends back an Authorization Response Cryptogram, or ARPC. That lets the chip confirm the approval actually came from the legitimate bank and not from someone impersonating it. The round trip creates mutual authentication: the bank confirms the card is real, and the card confirms the bank is real.
How the Bank Verifies It
When the ARQC arrives at the issuing bank, the verification happens inside a Hardware Security Module, a tamper-resistant device built for cryptographic operations. The HSM stores the bank’s master keys in a way that prevents extraction, even by the bank’s own employees, and runs the same calculation the chip just performed. If the result matches the incoming cryptogram, the transaction is approved.
Hardware Security Modules follow strict certification requirements under PCI standards. Each cryptographic key inside is restricted to a single purpose, so a key used for PIN encryption can’t be repurposed to sign transactions, and every operation is logged for audit. The full round trip, from chip to terminal to network to HSM and back, takes less than a second for most in-store purchases. A mismatch at any step results in an immediate decline.
Contactless Cards and Mobile Wallets
Tapping a contactless card uses the same cryptogram framework as inserting a chip card. The chip communicates over near-field communication instead of through physical contact pins, but it still generates a one-time cryptogram tied to that specific transaction. EMVCo confirms that contactless chip transactions produce a unique security code for every purchase.
Mobile wallets like Apple Pay and Google Pay add another layer called tokenization. Instead of transmitting your actual card number, the wallet substitutes a device-specific token, a stand-in number that’s useless if stolen. The wallet then generates a cryptogram tied to that token and the transaction details. Google’s payment API, for example, returns tokenized cards with a 3-D Secure cryptogram and an electronic commerce indicator that the merchant passes through the payment network unchanged. Even if someone captured the token and cryptogram together, neither would work for a different purchase.
This pairing of tokenization with dynamic cryptograms is why mobile wallet transactions have extremely low fraud rates compared to traditional card payments. Your real card number is never exposed to the merchant or the terminal.
Online Purchases and 3-D Secure
The original EMV cryptogram was designed for in-person payments where a physical chip is present. Online shopping created a gap: there’s no chip reader on a website. The industry’s answer is 3-D Secure, a protocol that brings cryptogram-style authentication to card-not-present transactions.
When you check out on a site that supports 3-D Secure, your bank may prompt you to verify your identity through a push notification, fingerprint scan, or one-time passcode. Once you authenticate, the system generates a cryptographic value similar to an in-store cryptogram. That value travels with the transaction to the bank, proving you actively participated in the purchase rather than someone typing in a stolen card number. EMVCo’s Secure Remote Commerce specifications support the use of dynamic data, including cryptograms, to strengthen payment security across merchant websites and mobile apps, though adoption varies by merchant and region.
Where the Protection Stops
Cryptograms have sharply reduced counterfeit card fraud at physical terminals, but the problem has largely moved online. Federal Reserve data from 2023 shows card-not-present fraud rates continued climbing across both credit and debit networks, and U.S. rates exceeded those in comparable markets such as Australia and the European Economic Area.
At physical terminals, a technique called shimming targets chip cards specifically. A shimmer is a paper-thin device inserted into a card reader that intercepts data from the chip when you insert your card. Unlike older magnetic-stripe skimmers, shimmers are very hard to detect without disassembling the terminal. The intercepted data can be used to create counterfeit magnetic-stripe cards, but it cannot reproduce the dynamic cryptogram itself, which limits what a thief can do with it.
Researchers have also identified theoretical weaknesses in how some terminals generate the Unpredictable Number. Published research from ETH Zurich notes that pre-play attacks remain possible in certain scenarios, even when the terminal’s random number generator works correctly, by substituting a terminal-generated nonce with one captured from an earlier session with the victim’s card. These attacks are sophisticated and uncommon, but they show that no security system is completely immune to creative exploitation.
What You Actually Owe If Fraud Happens
Federal law caps what you owe when someone uses your card without permission, but the rules differ sharply between debit and credit cards.
Debit Cards
The Electronic Fund Transfer Act sets a tiered structure based on how quickly you report the problem:
- Within two business days of learning your card was lost or stolen, your liability caps at $50, or the amount of unauthorized transfers before you notified the bank, whichever is less.
- After two business days but within 60 days of your statement being sent, liability rises to $500.
- After 60 days, the bank is not required to reimburse you for unauthorized transfers that appeared on a statement you didn’t review, and your exposure for those charges becomes unlimited.
The bank carries the burden of proving that a transfer was actually authorized, or that you failed to report within the required timeframes. If the bank didn’t provide the required disclosures about your liability rights, it cannot hold you liable at all.
Credit Cards
Credit cards offer stronger protection. Under the Truth in Lending Act, your liability for unauthorized credit card charges cannot exceed $50, with no escalating tiers based on reporting speed. Once you notify the issuer, you owe nothing for charges made after that point. Most major card networks go further than the statute requires, offering voluntary zero-liability policies that eliminate even the $50 exposure for cardholders who haven’t been grossly negligent. Between cryptogram-based fraud prevention and these legal caps, the financial risk of card fraud falls overwhelmingly on banks and merchants rather than on you.