ARQC

ARQC stands for Authorization Request Cryptogram, a cryptographic value produced by an EMV-enabled payment card during an online authorization request. It is one of the cryptograms defined for EMV applications and is specifically used to support transactions that require online verification by the issuer.

ARQC is computed by the card using its application cryptogram algorithm and a secret key shared with the issuer. The calculation incorporates transaction-specific data such as the amount, terminal data (including country code and capabilities), and an unpredictable number that is unique to the transaction. The resulting eight-byte cryptogram is transmitted by the card in the authorization request to the issuer.

When the issuer receives the authorization request, it validates the ARQC by recomputing the cryptogram with its own copy of the shared keys and the same transaction data. A valid ARQC indicates that the card and the transaction data are authentic. If online authorization is granted, the issuer returns an approval decision along with an authorization response cryptogram (ARPC) that the card and terminal can use to finalize the transaction.

In EMV, ARQC is distinguished from the other cryptograms defined for the system; the remainder are AAC and TC. The ARQC flow supports real-time issuer verification and helps ensure transaction integrity by tying the authorization to dynamic card- and transaction-specific data.

ARQC is widely used in modern chip-based payment cards and networks, contributing to secure online authorization and reducing fraud by binding each transaction to a unique, card-specific cryptogram.