The first two digits of DE22 carry the PAN entry mode — the mechanism that read the card number. Below is the full list. Anything not in this table is either scheme-private or a value your acquirer defined; check the relevant scheme manual before assuming a meaning.
| Code | PAN entry mode |
|---|---|
00 | Unknown |
01 | Manual key entry |
02 | Magnetic stripe read |
03 | Bar code |
04 | OCR |
05 | Chip (ICC), CVV reliable |
07 | Contactless chip (EMV) |
10 | Credential on file |
80 | Fallback from chip to magnetic stripe |
81 | E-commerce |
90 | Magnetic stripe, full track read |
91 | Contactless magnetic stripe |
95 | Chip, CVV/iCVV unreliable |
The third digit is PIN entry capability — a statement about the terminal, not about whether a PIN was actually entered on this transaction. A terminal can be PIN-capable and still run a signature or no-CVM transaction.
| Digit | PIN entry capability |
|---|---|
0 | Unspecified |
1 | PIN entry capable |
2 | Not PIN entry capable |
8 | Reserved |
9 | Capable but PIN not used this time |
Split it two-and-one. The first two digits index the PAN entry table, the last digit indexes the PIN table. Four examples that cover most of what you will see in a real log:
| DE22 | Reads as |
|---|---|
051 | Chip read, CVV reliable + terminal is PIN capable — a normal contact EMV sale |
071 | Contactless EMV + PIN capable — a normal tap |
810 | E-commerce + PIN capability unspecified — a card-not-present sale |
802 | Chip-to-magstripe fallback + terminal not PIN capable |
Most of the table is background. Four values do real work when you are debugging declines or disputes:
80 — fallback. The chip failed to read and the terminal fell back to the stripe. Issuers commonly treat fallback as elevated risk, and some decline it outright. A sudden rise in 80 across one merchant usually means a dying card reader, not fraud.05 vs 95. Both are chip reads. 05 asserts the card verification value was reliable; 95 says it was not. Treating them as interchangeable hides a real signal.07 vs 91. Both are contactless taps, but 07 is full EMV contactless while 91 is contactless carrying magstripe-rules data. The cryptographic protection differs.81 and 10. Card-not-present. Neither carries a chip cryptogram, so authentication has to come from elsewhere — 3-D Secure, a network token, or a stored-credential indicator.This is the trap that breaks DE22 parsers, and it is not a rounding detail — it changes the width of the field.
| Edition | Format | What it is called, and where the entry mode lives |
|---|---|---|
| ISO 8583:1987 | n-3 | Point of service entry mode — the three digits described above: two for how the PAN was read, one for PIN capability. |
| ISO 8583:1993 | an-12 | Point of service data code — twelve characters split into twelve subfields. The reading method moves into subfield 7; the other eleven describe the terminal, the cardholder presence, the card presence and so on. |
| ISO 8583:2003 | an-12 | Keeps the 1993 definition. |
Which one you are looking at is decided by the first digit of the MTI, not by the field itself. In practice: online card authorisation is usually 1987, so DE22 is three digits — but clearing formats built on 1993, such as Mastercard's IPM, carry the twelve-character version. A parser written for one edition does not fail loudly on the other; it reads three characters where there are twelve and then misaligns every field after it.
If you are working from a public field table that does not say which edition it describes, treat its DE22 row as unverified. This is the field where those tables most often disagree.
DE22 travels in the authorization request (0100 / 0200) and is echoed through the rest of the transaction's life. It is one of the fields an issuer's risk engine reads before it ever looks at the amount, and it is usually the first thing a disputes analyst checks when arguing about liability.
Both of those jobs — writing the risk rules and arguing the liability — tend to happen on someone else's network: a certification lab, a processor's site, a room where the guest wifi will not open this page. The DE22 decoder ships as a local file in the offline edition.