The MM/YY code printed or embossed on a credit card indicates its expiration date in month/year format. Two digits for the month, two for the year, separated by a slash or a space depending on the issuer. The card remains usable until the last day of the indicated month. Beyond that, the interbank network systematically rejects any authorization request.
Regulatory status of MM/YY in the PCI DSS 4.0 standard
The expiration date is not just a practical marker for the cardholder. For merchants and payment service providers, it constitutes an element of cardholder data (CHD) as soon as it is stored together with the card number (PAN), according to the PCI DSS 4.0 standard now fully in effect.
In practical terms, any entity that retains the expiration date associated with the PAN must justify this storage, restrict access to it, and apply the protection controls mandated by the standard. An e-commerce site that records the PAN + MM/YY pair without compliant encryption exposes itself to PCI non-compliance, with financial penalties and the potential loss of the right to accept card payments.
We observe that most consumer articles address MM/YY solely from the perspective of the payment form. They overlook this regulatory dimension, even though it directly concerns any developer integrating a payment module and any technical manager of a merchant site. For a daily use explanation of MM YY on a credit card, the topic remains accessible, but the technical layer deserves to be known.
MM/YY and strong authentication: what DSP2 changes
During an online payment, the MM/YY field is part of the triptych transmitted to the provider: card number, expiration date, and visual cryptogram (CVV). This trio is no longer sufficient to validate a transaction since the implementation of the European Payment Services Directive (DSP2).
Strong customer authentication (SCA) requires at least two distinct factors from three categories: knowledge (code, password), possession (phone, physical card), and inherence (biometrics). The MM/YY falls under possession, just like the CVV. By themselves, they cover only one factor.
The 3D Secure protocol, in its current version, specifically intervenes to add this second factor. The issuing bank’s server triggers an additional verification (push notification, SMS code, fingerprint) before validating the authorization. The MM/YY remains necessary to initiate the flow, but it no longer has autonomous authentication power.
Exemptions to strong authentication
Some transactions are exempt from SCA, particularly fixed-amount recurring payments after an initial strong authentication, or low-value transactions. In these cases, the MM/YY retains a more direct validation role, as the system relies on the card’s static data without requesting a second factor again.
EUDI Wallet and the future of the MM/YY code on credit cards
The eIDAS 2.0 regulation, adopted at the European level, provides for the deployment of the European Digital Identity Wallet (EUDI Wallet). This system will ultimately allow the cardholder to be authenticated without transmitting the data printed on the physical medium.
In this scenario, the MM/YY would lose part of its current function. The payer’s identity would be verified by the digital wallet, no longer by manually entering the expiration date and cryptogram. The role of the MM/YY would then be limited to managing the card’s lifecycle (renewal, deactivation), without further serving as a transactional security data.
We recommend that technical teams monitor the progress of the EUDI framework, as it will change how payment modules collect and process card data.
Expired card and security: an underestimated risk
A card whose MM/YY has expired can no longer be used for a standard payment. The interbank network rejects it. However, some data from the expired card remains exploitable by fraudsters if the PAN and CVV were compromised before expiration.
The reasons are technical:
- The card number (PAN) does not always change upon renewal. With several issuers, the new card retains the same PAN with an updated MM/YY and CVV.
- An attacker with the PAN can attempt to guess the new expiration date through brute force, as the combinations are limited (a few dozen plausible months multiplied by a few years).
- On sites that are not compliant with SCA or that benefit from exemptions, this combination may be sufficient to initiate a fraudulent transaction.
The most reliable countermeasure remains to request a PAN change upon renewal if you suspect prior compromise. Automatic renewal does not guarantee a new card number.
MM/YY display formats according to networks
The format of the expiration date varies slightly depending on the issuer and the network:
- Visa and Mastercard generally display MM/YY on two lines or on one, preceded by the mention “VALID THRU” or “EXPIRES END”.
- American Express sometimes uses the MM/YYYY format (four digits for the year) in certain markets, which can create confusion when entering in a form that expects two digits.
- Virtual cards, which are becoming increasingly common, follow the same format but display it only in the banking app, without a physical medium.
Online payment forms sometimes accept MM/YY, sometimes MM/YYYY, or sometimes two separate fields. A format error (entering four digits for the year in a field that expects two) results in an immediate rejection of the transaction, often mistakenly interpreted as a ceiling issue or a blocked card.
The MM/YY code remains, despite its apparent simplicity, a technical link whose scope exceeds the mere payment form. Between its status as regulated data under PCI DSS 4.0, its role in the strong authentication flow, and the developments related to the EUDI wallet, its function is set to refocus on managing the card’s lifecycle rather than securing transactions.
