GPO returns 6A 80 / 69 85 on a real Visa card — what's wrong?

[a7asoft]

GPO returns 6A 80 / 69 85 on a real Visa card — what's wrong?

I wired up ContactlessReader from :android:reader and tapped a real Visa Credit / Debit card. The PPSE select succeeds, the SELECT AID succeeds, but GET PROCESSING OPTIONS (GPO) fails with status word 6A 80 ("Wrong data") or 69 85 ("Conditions not satisfied"). The same code worked on my synthetic test fixtures.

What am I missing for real-card support?

[a7asoft]

Short answer: real Visa cards require a PDOL-aware GPO, and the TTQ "Online cryptogram required" bit must be cleared for read-only flows. Both landed in v0.3.0 (PR #57 for PDOL, PR #59 for the TTQ default change). If you're on v0.2.x or older, upgrade.

Why it fails

Synthetic fixtures usually accept an empty GPO command (80 A8 00 00 02 83 00 00) — real Visa qVSDC kernel-3 cards reject it because:

1. The card's SELECT AID FCI response carries tag 9F38 (PDOL) — a list of terminal data the card wants in the GPO command. Sending an empty PDOL response triggers 6A 80.
2. The card requires a valid TTQ (Terminal Transaction Qualifiers, tag 9F66). The legacy TTQ value 36 00 80 00 has the "Online cryptogram required" bit set, which makes some kernels return 69 85 to a read-only reader.

What v0.3.0 does

• Reads 9F38 from the SELECT AID FCI response.
• Builds a structurally-valid PDOL response from TerminalConfig.default() (TTQ, country 0840, currency 0840, date, transaction type 00, unpredictable number).
• Wraps in 83 [Lc] [response] and sends it as the GPO command body.
• TTQ default lowered to 36 00 00 00 so the "Online cryptogram required" bit is cleared.

Upgrade path (Android)

// Old
ContactlessReader.fromTag(tag).read()

// v0.3.0 — same call, now PDOL-aware by default
ContactlessReader.fromTag(tag).read()

// Override TTQ if a specific issuer kernel needs the legacy bit set
val cfg = TerminalConfig.default().copy(
    terminalTransactionQualifiers = byteArrayOf(0x36, 0x00, 0x80.toByte(), 0x00)
)
ContactlessReader.fromTag(tag).read(cfg)

Upgrade path (iOS)

TerminalConfig.default mirrors the Android values; the EmvReader().read(config:) overload accepts a custom one if needed.

Two more real-card gotchas v0.3.0 fixed

• Format-2 GPO with no AFL. Some Visa qVSDC kernel-3 cards (Chase observed) deliver application data inline in the GPO response (template 77) instead of pointing to records via AFL. v0.3.0 accepts this and exposes the inline TLV via Gpo.inlineTlv.
• PAN / expiry only inside Track 2. On some debit cards, standalone tags 5A (PAN) and 5F 24 (expiry) are absent — the data lives only inside Track 2 (tag 57). v0.3.0 falls back to Track 2's embedded PAN and expiry.

If you upgrade to v0.3.0 and still hit 6A 80, capture the SELECT AID FCI response (tag 9F38 contents) and post the hex here — different issuers ship different PDOL shapes and we can verify the response builder.

Out of scope reminder

This library is read-only by design. It does not generate ARQC, perform online authorization, or run kernel certification (C-2 / C-3). If your 6A 80 is from GENERATE AC rather than GPO, this library cannot help — you need a payment processor.