Optional fields may always be present in requests, even when not needed. In such case, they will be ignored. Requests received missing a mandatory field will be 904 - Format Error.

The third party host must ignore unknown fields included in the response messages.

When no usage notes are given in the field description, the field should be used as described in IFSF [1].

The “Format”-column can contain following info:

• LL: Variable length field, max 99 bytes as data. The field contains 2 bytes holding the length of the data. Example: 303101 a one byte field with LL = 3031 and the data is 01.
• LLL: Variable length field, max 999 bytes as data. The field contains 3 bytes holding the length of the data. Example: 30303101 a one byte field with LLL = 303031 and the data is 01.
• Date/time field formats, YYMMDDhhmmss (or variations), where:
  • YY : Last 2 digits of the year, 00 through 99
  • MM: Month, 01 through 12.
  • DD: Day, 01 through 31
  • hh: Hour, 00 through 23
  • mm: Minutes, 00 through 59
  • ss: Seconds, 00 through 59

The “Type”-column can contain:

• a : Alphabetic character [a..z,A..Z]
• n : Numeric BCD-digit. [0..9]
• ans: alphabetic, numeric and special characters
• an : alphabetic and numeric.
• s : Special characters.
• b : Binary
• p: pad character, space
• x: “C” for credit, “D” for debit and shall always be associated with a numerical amount data element.

The “Size”-column can contain:

• Variable length fields have a size that looks like “..nn”, where nn is the maximum number of characters or bytes.
• A fixed length field has “n” as size content, with n the number of characters or bytes.

All fixed length “n” data elements are assumed to be right justified with leading zeroes. All other fixed length data elements are left justified with trailing spaces. In all “b” data elements, blocks of 8 bits are assumed to be left justified with trailing zeroes.

Message protocol

All messages are transferred using TCP/IP sockets.

The message will be encapsulated in a transmission frame as follows:

• The first 4 digits contain the length of the message in ASCII (decimal value, most significant digit first). The length field includes all bytes from the first byte of the message ID up to the last byte of the last field.
• This 4-digit length field is immediately followed by the message ID, also in ASCII (decimal value, most significant digit first).
• An 8 byte message bitmap, which is a binary field (so not ASCII encoded).
• Message fields, which could be ASCII or binary encoded. The fields with format ‘n, ns, an, ans, anp or x’ are ASCII encoded, while the fields with format ‘b’ are binary encoded. The following conventions shall be applied to all data elements:
  • All fixed length numeric data element values shall be right justified with leading zeroes.
  • All fixed length data elements with alphabetic or special characters shall be left justified with trailing blanks.
  • All fixed length binary data elements shall be right justified with leading zeroes.
  • The position of a character or a bit in a data element shall be counted from the left beginning with one (1).(See also section 5.1 Attribute specification in [01])
  • No trailer is included.

Example: An imaginary message which consists only of a message ID “0300” and an empty bitmap (all zeros) will be transmitted as follows:
 

Example: An 1820 message, without MAC, will be transmitted as follows: Message bytes (hex):
303035303138323002300101000000003039313031353238343133383239313030393039313031353238343138333130353130303331

The PayEx response timeout is set to XX seconds. If after xx+1 seconds, no response has been received, the third party host needs to take the appropriate action based on the message type. (E.g. send a reversal)

The third party host has the possibility to perform offline stand-in, thought this needs to be agreed with the indididual card issuers. Otherwise the station might not be reimbursed.

PIN Validation

PayEx perform online PIN validation on payment cards where PayEx is the acquirer, on all other cartds PIN is validated by the third party acuirer.  PayEx will not interpret P-22 Point-Of-Service code to determine if it needs to validate PIN or not on PayEx fuel cards, but 3rd patry aquirers might so it's good practice to use P-22 correctly. 

Fields required for PIN validation are: 

• P-48-14 – PIN encryption Methodology
• P-52 – PIN data
• P-53 – Security related information

Message field details

P-2 PAN

Personal Account Number, identifies the card.Only mandatory for Manual PAN transactions (replacement for Track2Data P35)

P-3 PROCESSING CODE

Code used to describe the effect of a transaction on the customer account and the accounts affected. Fixed 00000000 : Goods and services

P-4 AMOUNT, TRANSACTION

The amount is a numeric value, expressed without a decimal separator. Where a minor unit of currency applies, the relevant minor unit data element indicates the number of decimal places in the relevant amount.  Example : 1 kr = 100

P-7 DATE AND TIME, TRANSMISSION

Date and time of message transmission from the third party host. 

P-11 SYSTEM TRACE AUDIT NUMBER

Number assigned by the third party host to assist in identifying a transaction uniquely. Range 000001 till 999999. Every message must have a new STAN, repeats use the same STAN as the original message.
P-12 DATE AND TIME, LOCAL TRANSACTION

Date and time of the transaction when performed on the POS. 

P-14 DATE EXPIRY

Month and year of card expiry. Only mandatory for a manual PAN transaction

P-22 POINT OF SERVICE DATA CODE

A series of codes intended to identify terminal capability, terminal environment and presentation security data.

P-24 FUNCTION CODE

P-25 MESSAGE REASON CODE

P-30 ORIGINAL AMOUNT

The original amount data element is a constructed element of two parts with a total of 24 positions:
a)    Original amount transaction, n 12;
b)    Original amount reconciliation, n 12.
Absence of data shall be indicated by zeroes. These parts shall be used when attempting to perform a partial approval and shall contain the original amounts.

P-32 ACQUIRING INSTITUTION IDENTIFICATION CODE

ISO 3166 - numeric country code of country where the POS transaction took place.

ISO numeric country code
578 - Norway
208 - Sweden
??? - Danmark
??? - Finland

P-33 FORWARDING INSTITUTION IDENTIFICATION CODE

10 digit code identifying the 3rd patry host. Each 3rd party integrated with PayEx will be assigned a unique code that they are to use in all messages where P-33 is specified. 

P-35 TRACK 2 DATA

The information encoded on track 2 of the magnetic stripe as defined in ISO7813, excluding beginning and ending sentinels and longitudinal redundancy check characters as defined therein.

Example: 123456789012345=00112233

P-38 APPROVAL CODE

Code assigned by the authorising institution indicating approval.

P-39 ACTION CODE

See action code page for codes that can be returned by PayEx.  

P-41 Card acceptor terminal identification
Needs to be unique per POS terminal at the merchant site. For Inndoor terminals use the range 1-99 and for outdoor terminals 100-199. PayEx needs to be informed of how many terminals that are installed at the merchant site. 

P-42 Card acceptor identification code

8 digit unique ID provided by PayEx for each merchant. 

P-43 Card acceptor name/location

The name and location of the card acceptor.

P-48 MESSAGE CONTROL DATA ELEMENTS
Used for the control of messages between the POS and the FEP. These are present in field 48 as a variable content data element. It uses a standard bit map to identify the specific data elements present in field 48. The format is LLLVAR with a maximum length of 999. The 8 byte bit map is the first item (element 48-0) in the data element.

P-48-4 BATCH/SEQUENCE NUMBER

This field identifies the transactions associated with a particular settlement period. This number starts at one and increments with each Reconciliation.

P-48-8 CUSTOMER DATA

The customer data is any data entered by the customer or cashier as required by the authorizer to complete the transaction. Transactions requiring customer data may be related to fleet fuelling, cheque authorizations or any other type of retail store management functions. Up to sixteen separate entries are supported. Each entry consists of two elements, the type of customer data entered and the variable length value of the entered data. Successive entries are separated by a back-slash (\). (Note: the LVAR method is not used for these entries.) The entire data element has a maximum length of 250 bytes and is parsed as an LLLVAR field.

P-48-8-2 TYPE OF CUSTOMER DATA

1 - Vehicle Number
3 - Driver ID
4 - Mileage
5 - Driver license number
B - Unit number/fleet ID
D - Customer verification code
G - Alphanumeric entered data

The information encoded on track 2 of the magnetic stripe as defined in ISO7813, excluding beginning and ending sentinels and longitudinal redundancy check characters.P-48-9 TRACK II OF VEHICLE CARD

P-48-14 PIN ENCRYPTION METHODOLOGY

Fixed value ‘33’: ZKA MS/SK PAC H2H
When P-52 is present, this field must also be present. When field P-52 is NOT present, field 48-14 should also NOT be present.

The value supported by PayEx is ‘33’ and refers to 3DES ZKA UKPT. Other values are not supported.

The first digit (3) refers to key management type ‘ZKA UKPT’ and the second digit (3) refers to the cryptographic algorithm ‘3DES with double length key’. A double length key means 2X56 bits effective key length.

P-48-32 VAT PERCENTAGES

List of VAT codes accompanied with their corresponding VAT percentage.

The purpose of this field is to link the VAT codes as used in field P-63 Product data, P-63-8 tax code, to actual VAT percentages. As the incoming link can be multi-country, and PayEx does not have product codes per VAT rate, the VAT rates need to be provided in every transaction.

Individual items are separated with a backslash character.
Only VAT codes used in the product data (P-63) need to be described in this array. Others will be ignored.

P-48-37 VEHICLE IDENTIFICATION ENTRY MODE
Only present when a vehicle number is available (P48-8). Defines how the vehicle number was entered:

0 - Manual entry
1- On the Card
2 - Automatic Licence Plate Recognition

P-48-38 PUMP LINKED INDICATOR

Indicating whether the fuel pump reading is is linked to the payment terminal:
0 – Unspecified
1 – Pump-linked
2 – Pump not linked
 

P-48-39 DELIVERY NOTE NUMBER
Number allocated by the terminal given to the customer as printed on the ticket.

P-49 CURRENCY CODE , TRANSACTION
All transactions are in local currency, as defined during system installation. Actual value is as defined by ISO 4217.

P-52 PIN DATA
ISO 9564-1 format 0 PIN block encrypted with ZKA MK/SK PAC.

P-53 SECURITY RELATED CONTROL INFORMATION

PayEx defines the value of 53-1 and 53-2. Note that a set of different values are defined for both TEST and LIVE, and is unique for every third party (host).

For optimal security it is a good practice to use different random values for the MAC and PAC. However the security impact of having the same random number for PAC and MAC is very limited. Especially because in the MK/SK security scheme an XOR of the Master key with a fixed Control Mask is done, where the Control Mask value is different for PIN and MAC. So even if the MAC session key would be compromised the PIN session key still cannot be determined even when the same random number is used.

Important is to assure that different random numbers are used for every transaction.
 

P-56 ORIGINAL DATA ELEMENTS

Data elements of original transaction which contains the original “message identifier”, original “STAN” and original “date and time – local transaction”. This must be present if the message is preceded by an 1100 Authorisation Request, it can be omitted if the message is as a result of a store and forward transaction.
In Payment advice : Link to previous Authorisation dialog
In reversal advice    : Link to previous Authorisation request or previous Payment request being reversed.
 

P-62 PRODUCT SETS AND MESSAGE DATA

This field contains allowed product sets and message data.

All subfields must be present when bit 62 is set. Field 62 shall not be sent if none of the three subfields need to be sent. If one of the subfields needs to be sent, all three subfields shall be sent.
 

P-63 PRODUCT DATA

This data element provides the detailed information on the products purchased or selected by the customer. The first two fields (63-1, 63-2) appear once per transaction.  The next seven fields can be repeated up to 18 times.

Each product is represented by seven fields: Product Code, Unit of Measure, Quantity, Unit Price, Amount, Taxcode and Additional product code. The variable length fields and the succeeding entry are separated by a back-slash (\).
Unit price and amount may be negative or positive, but the sum of the amounts in the product data must equal the transaction amount.
The values of Quantity and Unit price may have a value that includes both integer and fractional values. The format of these fields consists of a single digit, which specifies the number of fractional digits following the integer, followed by the numeric value.
The value must be numeric. The number of fractional digits has a maximum of 4. The Amount field may have fractional digits. The number of fractional digits is specified by the currency code.

The list of sales items can contain a mixture of normal sales items and refund items. These are included in the online Host message as follows:

Each Sales item consists of the following components:

P-64 MAC

MAC is calculated/verified according to the “IFSF X9.19 Retail CBC MAC (3DES)” (see Appendix D in [2]), using the “Derivation of the MAC session key” (see 5.2.2 Derivation of the MAC session key in [2]).

The input for the MAC calculation/verification will be the SHA-256 of the IFSF message. The message length header and the MAC block itself are not included, however the MAC bit in the bitmap is part of the message and is already set when calculating the MAC.

In pseudo code it is as follows (the sign is used for assignment):
Input :

• The four 8-byte blocks B1 .. B4 from the SHA256
• MAC session key <Kl, Kr> (left and right halfs)

Output :

• 8-byte MAC M

Function X9.19retailMAC:

• M <- 0x0000 0000 0000 0000

For each 8-byte block b in B1 to B4 do:

• M <- M XOR b
• M <- 1DES_encrypt(Kl, M)

Done

• M <- 1DES_decrypt(Kr, M)
• M <- 1DES_encrypt(Kl, M)

End function