It could be in the software layer too. Modern smartcards have 'applets' that can run custom code. The cards themselves trend to be quite generic. This can even

It could be in the software layer too. Modern smartcards have 'applets' that can run custom code. The cards themselves trend to be quite generic. This can even be in high level languages like Java or basic. So if the code was there it's not the fault of the card manufacturer but the applet developer.