ISO/IEC 7816
ISO/IEC 7816 is the international standard for contact smart cards — the ones you insert rather than tap. It defines everything from the physical position of the gold contacts to the command structure used to talk to the chip, and that command structure outlived the contact interface it was designed for.
| Scope | Contact integrated circuit cards |
| Part 1 | Physical characteristics |
| Part 2 | Dimensions and location of the contacts |
| Part 3 | Electrical signals and transmission protocols |
| Part 4 | Organization, security, and commands for interchange |
| Protocols | T=0 (byte-oriented) and T=1 (block-oriented) |
| Command unit | APDU — application protocol data unit |
| Used by | EMV payment cards, SIM cards, national eID cards |
How a contact card communicates
Power and data both travel through the contact pads. Once the card is inserted and powered, the reader and card exchange APDUs.
A command APDU carries a four-byte header — class, instruction, and two parameter bytes — plus optional data. The card replies with a response APDU containing optional data and two mandatory status bytes that say whether the command succeeded and, if not, why.
Part 3 defines two ways to move those messages. T=0 is byte-oriented and acknowledges each byte individually, which is simple but chatty. T=1 is block-oriented, frames data with error detection, and supports chaining, which makes it more efficient for larger exchanges.
Why ISO/IEC 7816 matters beyond contact cards
The interesting part of this standard is how much of it survived the move to contactless.
Part 4 — the APDU command structure, the file organization, the security architecture — is not tied to physical contacts at all. Contactless cards under ISO/IEC 14443 carry APDUs over the radio interface, using the same command vocabulary. An ePassport chip is talked to in APDUs. So is a contactless payment card.
That is why a dual-interface card runs identical applications over either interface, and why an MRZ reader paired with an NFC radio can address a passport chip using a command set designed for cards you plug in. For identity document verification, the practical upshot is that the two standards are complementary layers rather than competitors.
ISO/IEC 7816 vs ISO/IEC 14443
| ISO/IEC 7816 | ISO/IEC 14443 | |
|---|---|---|
| Interface | Physical gold contacts | 13.56 MHz radio field |
| Power | Through the contacts | Induced from the reader field |
| Range | Insertion required | ~4 cm |
| Command layer | APDUs, defined in Part 4 | APDUs, borrowed from 7816-4 |
| Wear | Contacts degrade over time | No physical contact |
| Typical use | SIMs, chip-and-PIN insertion | Passports, tap-to-pay, transit |
What ISO/IEC 7816 can’t do
It defines mechanics, not trust. The standard says how to send a command and how the card structures a reply. Whether the card is authentic is decided by the application layer.
Compliance says nothing about security. A memory card and a cryptographic microprocessor card can both be 7816-compliant while offering wildly different guarantees.
Contact is a liability in high-throughput use. Pads wear, dirt interferes, and insertion is slow, which is why contactless has displaced it almost everywhere the choice exists.
It has no bearing on the printed document. Everything on the card’s surface — the photograph, the printed data, the security features — sits entirely outside this standard’s scope.
Frequently asked questions
What is an APDU?
An application protocol data unit — the message format used between a smart card reader and a smart card. Command APDUs carry a four-byte header plus optional data; response APDUs return optional data and two status bytes indicating the result.
What is the difference between T=0 and T=1?
Both are transmission protocols in ISO/IEC 7816-3. T=0 is byte-oriented and acknowledges each byte individually, making it simple but verbose. T=1 is block-oriented, frames data with error detection, and supports chaining, which is more efficient for larger transfers.
Do contactless cards use ISO/IEC 7816?
They use its command layer. The physical and radio layers come from ISO/IEC 14443, but the APDU structure defined in 7816-4 is carried over the contactless interface, so the conversation is the same.
Is ISO/IEC 7816 still relevant?
Very. SIM cards, many national eID cards, and the contact interface of most payment cards all use it, and its command structure underpins contactless applications as well.
