# Credit and Debit Cards source: https://developer.mastercard.com/mastercard-gateway/documentation/payment-methods/cards/credit-debit-cards/index.md Credit and debit cards are the most common card payment method. For a list of card schemes supported on the Mastercard Gateway, see the possible values for the `sourceOfFunds.provided.card.brand` field in the API Reference. To identify whether the card used to make a payment is a credit, debit, or charge card, send the [RETRIEVE TRANSACTION](https://developer.mastercard.com/mastercard-gateway/documentation/api-reference/v100/rest/api-ops/index.md#transaction) request and check the funding method (`sourceOfFunds.provided.card.fundingMethod`) returned in the response. You can use the card type details to support your [surcharging](https://developer.mastercard.com/mastercard-gateway/documentation/gateway-features/funding-and-fee-information/surcharging/index.md) decisions. Supported for | Integration methods | Transactions | |---------------------|--------------| | All | All | For limitations on the transactions you can use with specific integration methods, see [Hosted Checkout](https://developer.mastercard.com/mastercard-gateway/documentation/integrations-types/hosted-checkout/index.md), [Hosted Session](https://developer.mastercard.com/mastercard-gateway/documentation/integrations-types/hosted-session/index.md), [Direct Payment](https://developer.mastercard.com/mastercard-gateway/documentation/integrations-types/direct-payment/index.md), and [Hosted Batch](https://developer.mastercard.com/mastercard-gateway/documentation/integrations-types/hosted-batch/index.md). ## About the payment method {#about-the-payment-method} Credit cards offer a line of credit to cardholders, allowing them to make purchases and pay later with interest, while debit cards deduct funds directly from the cardholder's bank account. ## Credit cards {#credit-cards} Credit card transactions form the majority of payment transactions in the e-commerce space. The card details typically include payer name, card number, card expiry, and card security code. During the payment process, 1. Depending on the integration method, either the merchant web site or app collects the card details and sends them to the Mastercard Gateway, or the payer provides the details directly to the gateway through hosted fields or a hosted payment page. 2. Based on the card number, the gateway identifies the card scheme and validates both the card number and the CSC (Card Security Code). 3. If the validation succeeds, the payment proceeds to the acquiring bank. For example, the gateway validates the CSC for the format. On Visa and Mastercard credit cards, the CSC is the three-digit value printed on the signature panel on the back. ![](https://static.developer.mastercard.com/content/mastercard-gateway/uploads/MastercardVisa.png) For American Express, the number is the 4-digit value printed on the front above the credit card account number. ![](https://static.developer.mastercard.com/content/mastercard-gateway/uploads/Amex.png) ## Debit cards {#debit-cards} Debit card payments are handled similarly to credit cards. The debit card details typically include the payer name, card number, card expiry, and CSC. Pay attention to the following card details: * Maestro cards - With Maestro debit cards, all Internet transactions must at least attempt to perform an [EMV 3-D Secure authentication](https://developer.mastercard.com/mastercard-gateway/documentation/security-and-fraud/authentication/3d-secure-auth/index.md) before performing a financial transaction. The gateway processes the transaction if the authentication is attempted and an authentication response other than Authentication Failed is received. If no authentication is attempted, the gateway blocks the transaction. Warning: If your merchant-acquirer link is configured for "Process Maestro Refunds as Payments" functionality, all REFUND transactions with the INTERNET transaction source and INR transaction currency are submitted to the acquirer as payment transactions. * MADA cards - MADA is supported in Saudi Arabia as a co-branded card with Mastercard and Visa, as well as Mada-only single-branded cards. Payments processed with Mada co-branded cards return MADA_MASTERCARD or MADA_VISA in the localBrand field of transaction response, whereas payments processed with Mada-only single-branded cards return MADA_ONLY. All cardholder-initiated transactions using MADA cards require [EMV 3-D Secure authentication](https://developer.mastercard.com/mastercard-gateway/documentation/security-and-fraud/authentication/3d-secure-auth/index.md). * ITMX cards - ITMX is supported as a co-branded card with Mastercard and Visa in Thailand. Payments processed using ITMX debit cards return MASTERCARD_ITMX or VISA_ITMX in the localBrand field in the transaction response. All cardholder-initiated transactions using ITMX cards require [EMV 3-D Secure authentication](https://developer.mastercard.com/mastercard-gateway/documentation/security-and-fraud/authentication/3d-secure-auth/index.md). * EFTPOS cards - EFTPOS is supported as a co-branded card with Mastercard and VISA in Australia. Payments processed using EFTPOS debit cards return EFTPOS in the localBrand field in the transaction response. Warning: You can use other transaction sources than transaction.source = INTERNET, as long as EMV 3-D Secure (EMV 3-D Secure) authentication is not attempted. ### Main supported features {#main-supported-features} When using credit and debit cards as a payment method, you can: * Perform payments using a single-action pay or the two-step authorization and capture transactions. * Make refunds, voids, and disbursements. * Inquire and use various [payment options](https://developer.mastercard.com/mastercard-gateway/documentation/integrations-types/direct-payment/integrate-gateway-features/payment-options-inquiry/index.md) (such as payment plans and dynamic currency conversion). * Add [supplementary data](https://developer.mastercard.com/mastercard-gateway/documentation/gateway-features/data-and-reporting/supp-data/index.md) to your requests to make the payment more user-friendly for the payer or ease its processing in the payment system. ## Required payment details {#required-payment-details} When using credit or debit cards, you need to provide the following payment details to the gateway. Depending on your used integration, the gateway gathers the details through a hosted payment page, from hosted fields within a session, or from a transaction request. At least the following details are needed: * Payment method (card) * Card number * Card expiry month and year * CSC In a transaction request, these details are provided as follows: ### Example {#example} ```json "sourceOfFunds": { "type": "CARD", "provided": { "card": { "number": "1000100010001000", "expiry": { "month": "10", "year": "26" }, "securityCode": "123" } } } ``` ## Prerequisites {#prerequisites} To use credit and debit cards as a payment method: * Your acquirer must be capable of processing debit and credit payments. * Agree with your acquirer which card schemes you are allowed to accept. * Your payment service provider must configure the merchant-acquirer link in your merchant profile accordingly. ## Adding the method to your integration {#adding-the-method-to-your-integration} No additional customizations are required to add credit and debit cards to your integration AFTER implementing your [generic selected integration](https://developer.mastercard.com/mastercard-gateway/documentation/getting-started/choosing-int-method/index.md). For examples of credit or debit card [transaction](https://developer.mastercard.com/mastercard-gateway/documentation/getting-started/order-trans-concepts/transaction/index.md) requests, download the [Postman collection](https://www.postman.com/mastercard/mastercard-developers/collection/4fakvrd/mastercard-gateway-api). ## Testing the method {#testing-the-method} For details on testing your integration with credit and debit cards, see [Test Cards](https://developer.mastercard.com/mastercard-gateway/documentation/test-cards/index.md) and the testing instructions within each applicable integration method.