System trace audit number (STAN) is a six-digit number that the originator of a card message assigns to identify that message, carried in ISO 8583 data element 11. Every terminal, gateway or host keeps a counter running from 000001 to 999999 before wrapping, so a STAN is unique only together with the sender's identity and a time window, usually a business day. Receivers echo it to match replies, reversals quote it to cancel the right authorization, and hosts use it to spot retransmissions. It differs from the retrieval reference number in element 37, which identifies the transaction across its lifecycle and often embeds the STAN. Receipts often print it as trace for dispute lookups.
What is STAN in payments
What is system trace audit number usage in practice? Every terminal, gateway or host that originates ISO 8583 messages keeps a counter and stamps the next value into field 11. It runs from 000001 to 999999 and then wraps. The value is unique only in combination with the sender's identity and a time window, typically a business day, so the same STAN can legitimately appear on two different terminals at the same moment.
The receiver echoes the STAN in its response. That is how a terminal matches an authorization reply to the request it sent, even when several messages are in flight on one connection.
STAN vs RRN
The retrieval reference number sits in data element 37 and is 12 characters long. Many acquirers build it from the date, hour and STAN, for example a Julian-date prefix followed by the six-digit trace number. The RRN is the reference that follows the transaction into clearing, chargeback retrieval requests and merchant reports.
In short: the STAN answers "which message is this", and it may change as a transaction passes through different hosts, each assigning its own. The RRN answers "which transaction is this" and stays stable end to end. Neither replaces the acquirer reference number, which is created at clearing.
Reversals and duplicate detection
When a terminal gets no response to an authorization, it sends a reversal. The reversal message quotes the original STAN, date and time (in field 90, original data elements) so the host can find and cancel exactly that authorization. Hosts also use the STAN to catch duplicates: a second request with the same STAN, terminal ID and timestamp is a retransmission, not a new sale.
A numeric example
A busy fuel station terminal processes 1,200 messages a day, counting authorizations, reversals and batch uploads. At that rate, the counter wraps roughly every 830 days, so uniqueness within a day is never an issue. A central gateway handling 2 million messages a day would wrap twice a day, which is why large hosts pair the STAN with the terminal ID and transmission timestamp rather than relying on it alone.
Where the STAN shows up for merchants
Receipts from many terminals print the STAN as "trace" or "STAN". When a cardholder disputes a charge in a shop, quoting the STAN, terminal identification number and date lets the acquirer locate the authorization log quickly.