text:
EMV
From Wikipedia, the free encyclopedia
Jump to: navigation, search
For the amusement ride vehicle, see enhanced motion vehicle. For the Mexican school known as "EMV", see Escuela Mexicana del Valle.
A credit card issued by Japan Airlines and Visa, showing the square, gold-plated contact pads for connecting to the chip.
EMV is a payment method based upon a technical standard for smart payment cards and for payment terminals and automated teller machines that can accept them. EMV cards are smart cards (also called chip cards or IC cards) that store their data on integrated circuits in addition to magnetic stripes (for backward compatibility). These include cards that must be physically inserted (or "dipped") into a reader and contactless cards that can be read over a short distance using radio-frequency identification (RFID) technology. Payment cards that comply with the EMV standard are often called Chip and PIN or Chip and Signature cards, depending on the authentication methods employed by the card issuer.
EMV stands for Europay, MasterCard, and Visa, the three companies that originally created the standard. The standard is now managed by EMVCo, a consortium with control split equally among Visa, MasterCard, JCB, American Express, China UnionPay, and Discover.[1]
There are standards based on ISO/IEC 7816 for contact cards, and standards based on ISO/IEC 14443 for contactless cards (MasterCard Contactless, PayWave, ExpressPay).
The most widely known chip card implementations of the EMV standard are
VIS – Visa
MasterCard chip – MasterCard
AEIPS – American Express
UICS – China Union Pay
J Smart – JCB
D-PAS – Discover/Diners Club International.
Rupay - NPCI
Visa and MasterCard have also developed standards for using EMV cards in devices to support card not present transactions over the telephone and Internet. MasterCard has the Chip Authentication Program (CAP) for secure e-commerce. Its implementation is known as EMV-CAP and supports a number of modes. Visa has the Dynamic Passcode Authentication (DPA) scheme, which is their implementation of CAP using different default values.
In February 2010, computer scientists from Cambridge University demonstrated that an implementation of EMV PIN entry is vulnerable to a man-in-the-middle attack; however, the way PINs are processed depends on the capabilities of the card and the terminal and in this demonstration it was only implementations where the PIN was validated offline that were vulnerable.
Contents
[hide]
1 History
2 Differences and benefits of EMV
3 Chip and PIN versus chip and signature
4 Online, phone, and mail order transactions
5 Commands
6 Transaction flow
6.1 Application selection
6.2 Initiate application processing
6.3 Read application data
6.4 Processing restrictions
6.5 Offline data authentication (ODA)
6.6 Cardholder verification
6.7 Terminal risk management
6.8 Terminal action analysis
6.9 First card action analysis
6.10 Online transaction authorization
6.11 Second card action analysis
6.12 Issuer script processing
7 Control of the EMV standard
8 List of EMV documents and standards
8.1 Versions
9 Vulnerabilities
9.1 Opportunities to harvest PINs and clone magnetic stripes
9.1.1 Successful attacks
9.1.2 Demonstration of PIN harvesting and stripe cloning
9.2 2010: Hidden hardware disables PIN checking on stolen card
9.3 2011: CVM downgrade allows arbitrary PIN harvest
10 Implementation
10.1 Africa
10.1.1 South Africa
10.2 Asian/Pacific countries
10.2.1 Australia
10.2.2 Malaysia
10.2.3 New Zealand
10.3 Europe
10.3.1 United Kingdom
10.4 Latin America and the Caribbean
10.4.1 Brazil
10.4.2 Colombia
10.4.3 Mexico
10.4.4 Venezuela
10.5 Middle East
10.6 North America
10.6.1 Canada
10.6.2 United States
11 See also
12 References
13 External links
History[edit]
Until the introduction of Chip & PIN, all face-to-face credit or debit card transactions involved the use of a magnetic stripe or mechanical imprint to read and record account data, and a signature for purposes of identity verification. The customer hands his or her card to the cashier at the point of sale, who either passes the card through a magnetic reader or makes an imprint from the raised text of the card. In the former case, the system verifies account details and prints a slip for the customer to sign. In the case of a mechanical imprint, the transaction details are filled in, a list of stolen numbers is consulted, and the customer signs the imprinted slip. In both cases the cashier must verify that the customer's signature matches that on the back of the card to authenticate the transaction.
Using the signature on the card as a verification method has a number of security flaws, the most obvious being the relative ease with which cards may go missing before their legitimate owners can sign them. Another involves the erasure and replacement of legitimate signature, and yet another involves the forgery of the correct signature on the card.[2] More recently,[clarification needed] technology has become available on the black market for both reading and writing the magnetic stripes, making cards easy to clone and use without the owner's knowledge.
The first standard for smart payment cards was the Carte Bancaire M4 from Bull-CP8 deployed in France in 1986, followed by the B4B0' (compatible with the M4) deployed in 1989. Geldkarte in Germany also predates EMV. EMV was designed to allow cards and terminals to be backwardly compatible with these standards. France has since migrated all its card and terminal infrastructure to EMV.
The EMV standard was initially written in 1993 and 1994.[3] JCB joined the consortium in February 2009, China UnionPay in May 2013,[4] and Discover in September 2013.[5]
Differences and benefits of EMV[edit]
There are two major benefits to moving to smart-card-based credit card payment systems: improved security (with associated fraud reduction), and the possibility for finer control of "offline" credit-card transaction approvals. One of the original goals of EMV was to provide for multiple applications on a card: for a credit and debit card application or an e-purse. With current processing regulations in the United States, new issue debit cards contain two applications — a card association (Visa, MasterCard etc.) application, and a common debit application. The common debit application ID is somewhat of a misnomer as each "common" debit application actually uses the resident card association application.
EMV chip card transactions improve security against fraud compared to magnetic stripe card transactions that rely on the holder's signature and visual inspection of the card to check for features such as hologram. The use of a PIN and cryptographic algorithms such as Triple DES, RSA and SHA provide authentication of the card to the processing terminal and the card issuer's host system. The processing time is comparable to online transactions, in which communications delay accounts for the majority of the time, while cryptographic operations at the terminal take comparatively little time. The supposed increased protection from fraud has allowed banks and credit card issuers to push through a "liability shift", such that merchants are now liable (as of 1 January 2005 in the EU region and 1 October 2015 in the US) for any fraud that results from transactions on systems that are not EMV-capable.[6][7]
Although not the only possible method, the majority of implementations of EMV cards and terminals confirm the identity of the cardholder by requiring the entry of a personal identification number (PIN) rather than signing a paper receipt. Whether or not PIN authentication takes place depends upon the capabilities of the terminal and programming of the card. For more details of this (specifically, the system being implemented in the UK) see Chip and PIN, below.
Under the previous system, a customer typically had to hand their card to a sales clerk to pay for a transaction. When credit cards were first introduced, merchants used mechanical (rather than magnetic) portable card imprinters that required carbon paper to make an imprint. They did not communicate electronically with the card issuer, and the card never left the customer's sight. The merchant had to verify transactions over a certain currency limit by telephoning the card issuer. During the 1970s in the United States, many merchants subscribed to a regularly-updated list of stolen or otherwise invalid credit cards numbers. This list was commonly printed in booklet form on newsprint, in numerical order, much like a slender phone book, yet without any data aside from the list of invalid numbers. Checkout cashiers were expected to thumb through this booklet each and every time a credit card was presented for payment of any amount, prior to approving the transaction, which incurred a short delay. This pause generally did not endear the credit card user to those waiting in line behind them.[citation needed]
Later, equipment electronically contacted the card issuer, using information from the magnetic stripe to verify the card and authorize the transaction. This was much faster than before, but required the transaction to occur in a fixed location. Consequently, if the transaction did not take place near a terminal (in a restaurant, for example) the clerk or waiter had to take the card away from the customer and to the card machine. It was easily possible at any time for a dishonest employee to swipe the card surreptitiously through a cheap machine that instantly recorded the information on the card and stripe; in fact, even at the terminal, a thief could bend down in front of the customer and swipe the card on a hidden reader. This made illegal cloning of cards relatively easy, and a more common occurrence than before.
Since the introduction of payment card Chip and PIN, however, cloning of the chip is not feasible; only the magnetic stripe can be copied, and a copied card cannot be used by itself on a terminal requiring a PIN. The introduction of Chip and PIN coincided with wireless data transmission technology becoming inexpensive and widespread. In addition to mobile-phone-based magnetic readers like those from Square, merchant personnel can now bring wireless PIN pads to the customer, so the card is never out of the cardholder's sight. Thus, both chip-and-PIN and wireless technologies can be used to reduce the risks of unauthorized swiping and card cloning.
Chip and PIN versus chip and signature[edit]
This section is missing information about accessibility problems. Please expand the section to include this information. Further details may exist on the talk page. (February 2017)
Chip and PIN is one of the two verification methods that EMV enabled cards can employ. Rather than physically signing a receipt for identification purposes, the user just enters a personal identification number (PIN), typically of 4 – 6 digits in length. This number must correspond to the information stored on the chip. Chip and PIN technology makes it much harder for fraudsters to use a found card, so if someone steals a card, they can't make fraudulent purchases unless they know the PIN.
Chip and Signature, on the other hand, differentiates itself from Chip and PIN by verifying a consumers identity with a signature.[8]
As of 2015, Chip and Signature cards are more common in the USA, Mexico, parts of South America (such as Argentina, Colombia, Peru, and Venezuela) and some Asian countries (such as Taiwan, Hong Kong, Thailand, South Korea, Singapore, and Indonesia), whereas Chip and PIN cards are more common in most European countries (e.g., the UK, Ireland, France, Finland and the Netherlands) as well as in Brazil, India, Sri Lanka, Canada, Australia and New Zealand.[9][10]
Online, phone, and mail order transactions[edit]
While EMV technology has helped reduce crime at the point of sale, fraudulent transactions have shifted to more vulnerable telephone, Internet, and mail order transactions — known in the industry as card-not-present or CNP transactions. As of May 2009[update] CNP transactions made up at least 50% of all credit card fraud.[11] Because of physical distance, it is not possible for the merchant to present a keypad to the customer in these cases, so alternatives have been devised, including
Software approaches for online transactions that involve interaction with the card-issuing bank or network's web site, such as Verified by Visa and MasterCard SecureCode (implementations of Visa's 3-D Secure protocol).
Creating a one-time virtual card backed to a physical card with a given maximum amount.
Additional hardware with keypad and screen that can produce a one-time password, such as the Chip Authentication Program.
Keypad and screen integrated into the card to produce a one-time password. Since 2008, Visa has been running pilot projects using the Emue card,[12] where the generated number replaces the code printed on the back of standard cards.[13]
Commands[edit]
ISO/IEC 7816-3 defines the transmission protocol between chip cards and readers. Using this protocol, data is exchanged in application protocol data units (APDUs). This comprises sending a command to a card, the card processing it, and sending a response. EMV uses the following commands:
application block
application unblock
card block
external authenticate (7816-4)
generate application cryptogram
get data (7816-4)
get processing options
internal authenticate (7816-4)
PIN change / unblock
read record (7816-4)
select (7816-4)
verify (7816-4).
Commands followed by "7816-4" are defined in ISO/IEC 7816-4 and are interindustry commands used for many chip card applications such as GSM SIM cards.
Transaction flow[edit]
An EMV transaction has the following steps:[14]
Application selection
Initiate application processing
Read application data
Processing restrictions
Offline data authentication
Cardholder verification
Terminal risk management
Terminal action analysis
First card action analysis
Online transaction authorization (only carried out if required by the result of the previous steps; mandatory in ATMs)
Second card action analysis
Issuer script processing.
Application selection[edit]
ISO/IEC 7816 defines a process for application selection. The intent of application selection was to let cards contain completely different applications—for example GSM and EMV. However, EMV developers implemented application selection as a way of identifying the type of product, so that all product issuers (Visa, MasterCard, etc.) must have their own application. The way application selection is prescribed in EMV is a frequent source of interoperability problems between cards and terminals. Book 1[15] of the EMV standard devotes 15 pages to describing the application selection process.
An application identifier (AID) is used to address an application in the card. An AID consists of a registered application provider identifier (RID) of five bytes, which is issued by the ISO/IEC 7816-5 registration authority. This is followed by a proprietary application identifier extension (PIX), which enables the application provider to differentiate among the different applications offered. The AID is printed on all EMV cardholder receipts.
List of applications:
Card scheme
RID
Product
PIX
AID
Danmønt (Denmark) A000000001 Cash card 1010 A0000000011010
Visa A000000003 Visa credit or debit 1010 A0000000031010
Visa Electron 2010 A0000000032010
V Pay 2020 A0000000032020
Plus 8010 A0000000038010
MasterCard A000000004 MasterCard credit or debit 1010 A0000000041010
MasterCard[16] 9999 A0000000049999
Maestro (debit card) 3060 A0000000043060
Cirrus (interbank network) ATM card only 6000 A0000000046000
MasterCard A000000005 Maestro UK (formerly branded as Switch) 0001 A0000000050001
American Express A000000025 American Express 01 A00000002501
LINK (UK) ATM network A000000029 ATM card 1010 A0000000291010
CB (France) A000000042 CB (Credit or Debit card) 1010 A0000000421010
CB (Debit card only) 2010 A0000000422010
JCB A000000065 Japan Credit Bureau 1010 A0000000651010
Dankort (Denmark) A000000121 Debit card 1010 A0000001211010
Dankort (Debit card) 4711 A0000001214711
Consorzio BANCOMAT (Italy) A000000141 BANCOMAT/PagoBANCOMAT 0001 A0000001410001
Diners Club/Discover A000000152 Diners Club/Discover 3010 A0000001523010
Banrisul (Brazil) A000000154 Banricompras Debito 4442 A0000001544442
SPAN2 (Saudi Arabia) A000000228 SPAN 1010 A00000022820101010
Interac (Canada) A000000277 Debit card 1010 A0000002771010
Discover A000000324 ZIP 1010 A0000003241010
UnionPay A000000333 Debit 010101 A000000333010101
Credit 010102 A000000333010102
Quasi Credit 010103 A000000333010103
Electronic Cash 010106 A000000333010106
ZKA (Germany) A000000359 Girocard 1010028001 A0000003591010028001
EAPS BANCOMAT (Italy) A000000359 PagoBANCOMAT 10100380 A00000035910100380
Verve (Nigeria) A000000371 Verve 0001 A0000003710001
The Exchange Network ATM Network A000000439 ATM card 1010 A0000004391010
RuPay (India) A000000524 RuPay 1010 A0000005241010
MIR (Russia) A000000658 MIR Debit 2010 A0000006582010
MIR Credit 1010 A0000006581010
Edenred A000000436 Ticket Restaurant (Belgium) 0100 A0000004360100
eftpos (Australia) A000000384 Savings (debit card) 10 A00000038410
Cheque (debit card) 20 A00000038420
GIM-UEMOA (8 West African countries
Benin
Burkina Faso
Côte d'Ivoire
Guinea Bissau
Mali
Niger
Senegal
Togo)
A000000337 RETRAIT 01 000001 A000000337301000
STANDARD 01 000002 A000000337101000
CLASSIC 01 000003 A000000337102000
PREPAYE ONLINE 01 000004 A000000337101001
PREPAYE POSSIBILE OFFILINE 01 000005 A000000337102001
PORTE MONNAIE ELECTRONIQUE 01 000006 A000000337601001
Initiate application processing[edit]
The terminal sends the get processing options command to the card. When issuing this command, the terminal supplies the card with any data elements requested by the card in the processing options data objects list (PDOL). The PDOL (a list of tags and lengths of data elements) is optionally provided by the card to the terminal during application selection. The card responds with the application interchange profile (AIP), a list of functions to perform in processing the transaction. The card also provides the application file locator (AFL), a list of files and records that the terminal needs to read from the card.
Read application data[edit]
Smart cards store data in files. The AFL contains the files that contain EMV data. These all must be read using the read record command. EMV does not specify which files data is stored in, so all the files must be read. Data in these files is stored in BER TLV format. EMV defines tag values for all data used in card processing.
Processing restrictions[edit]
The purpose of the processing restrictions is to see if the card should be used. Three data elements read in the previous step are checked.
Application version number
Application usage control (This shows whether the card is only for domestic use, etc.)
Application effective/expiration dates checking.
If any of these checks fails, the card is not necessarily declined. The terminal sets the appropriate bit in the terminal verification results (TVR), the components of which form the basis of an accept/decline decision later in the transaction flow. This feature lets, for example, card issuers permit cardholders to keep using expired cards after their expiry date, but for all transactions with an expired card to be performed on-line.
Offline data authentication (ODA)[edit]
Offline data authentication is a cryptographic check to validate the card using public-key cryptography. There are three different processes that can be undertaken depending on the card:
Static data authentication (SDA) ensures data read from the card has been signed by the card issuer. This prevents modification of data, but does not prevent cloning.
Dynamic data authentication (DDA) provides protection against modification of data and cloning.
Combined DDA/generate application cryptogram (CDA) combines DDA with the generation of a card's application cryptogram to assure card validity. Support of CDA in devices may be needed, as this process has been implemented in specific markets. This process is not mandatory in terminals and can only be carried out where both card and terminal support it.
Cardholder verification[edit]
Cardholder verification is used to evaluate whether the person presenting the card is the legitimate cardholder. There are many cardholder verification methods (CVMs) supported in EMV. They are
Signature
Offline plaintext PIN
Offline enciphered PIN
Offline plaintext PIN and signature
Offline enciphered PIN and signature
Online PIN
No CVM required
Fail CVM processing
The terminal uses a CVM list read from the card to determine the type of verification to perform. The CVM list establishes a priority of CVMs to use relative to the capabilities of the terminal. Different terminals support different CVMs. ATMs generally support online PIN. POS terminals vary in their CVM support depending on type and country.
Terminal risk management[edit]
Terminal risk management is only performed in devices where there is a decision to be made whether a transaction should be authorised on-line or offline. If transactions are always carried out on-line (e.g., ATMs) or always off-line, this step can be skipped. Terminal risk management checks the transaction amount against an offline ceiling limit (above which transactions should be processed on-line). It is also possible to have a 1 in an online counter, and a check against a hot card list (which is only necessary for off-line transactions). If the result of any of these tests is positive, the terminal sets the appropriate bit in the terminal verification results (TVR).
Terminal action analysis[edit]
The results of previous processing steps are used to determine whether a transaction should be approved offline, sent online for authorization, or declined offline. This is done using a combination of data objects known as terminal action codes (TACs) held in the terminal and issuer action codes (IACs) read from the card. The TAC is logically OR'd with the IAC, to give the transaction acquirer a level of control over the transaction outcome.
Both types of action code take the values Denial, Online, and Default. Each action code contains a series of bits which correspond to the bits in the Terminal verification results (TVR), and are used in the terminal's decision whether to accept, decline or go on-line for a payment transaction. The TAC is set by the card acquirer; in practice card schemes advise the TAC settings that should be used for a particular terminal type depending on its capabilities. The IAC is set by the card issuer; some card issuers may decide that expired cards should be rejected, by setting the appropriate bit in the Denial IAC. Other issuers may want the transaction to proceed on-line so that they can in some cases allow these transactions to be carried out.
An online-only device such as an ATM always attempts to go on-line with the authorization request, unless declined off-line due to Issuer action codes—Denial settings. During IAC—Denial and TAC—Denial processing, for an online only device, the only relevant Terminal verification results bit is "Service not allowed".
When an online-only device performs IAC—Online and TAC—Online processing the only relevant TVR bit is "Transaction value exceeds the floor limit". Because the floor limit is set to zero, the transaction should always go online and all other values in TAC—Online or IAC—Online are irrelevant.
Online-only devices do not need to perform IAC-default processing.
First card action analysis[edit]
One of the data objects read from the card in the Read application data stage is CDOL1 (Card Data object List). This object is a list of tags that the card wants to be sent to it to make a decision on whether to approve or decline a transaction (including transaction amount, but many other data objects too). The terminal sends this data and requests a cryptogram using the generate application cryptogram command. Depending on the terminal′s decision (offline, online, decline), the terminal requests one of the following cryptograms from the card:
Transaction certificate (TC)—Offline approval
Authorization Request Cryptogram (ARQC)—Online authorization
Application Authentication Cryptogram (AAC)—Offline decline.
This step gives the card the opportunity to accept the terminal's action analysis or to decline a transaction or force a transaction on-line. The card cannot return a TC when an ARQC has been asked for, but can return an ARQC when a TC has been asked for.
Online transaction authorization[edit]
Transactions go online when an ARQC has been requested. The ARQC is sent in the authorisation message. The card generates the ARQC. Its format depends on the card application. EMV does not specify the contents of the ARQC. The ARQC created by the card application is a digital signature of the transaction details, which the card issuer can check in real time. This provides a strong cryptographic check that the card is genuine. The issuer responds to an authorisation request with a response code (accepting or declining the transaction), an authorisation response cryptogram (ARPC) and optionally an issuer script (a string of commands to be sent to the card).
Second card action analysis[edit]
CDOL2 (Card data object list) contains a list of tags that the card wants to be sent after online transaction authorisation (response code, ARPC, etc.). Even if for any reason the terminal could not go online (e.g., communication failure), the terminal should send this data to the card again using the generate authorisation cryptogram command. This lets the card know the issuer's response. The card application may then reset offline usage limits.
Issuer script processing[edit]
If a card issuer wants to update a card post issuance it can send commands to the card using issuer script processing. Issuer scripts are encrypted between the card and the issuer, so are meaningless to the terminal. Issuer script can be used to block cards, or change card parameters.
Control of the EMV standard[edit]
The first version of EMV standard was published in 1995. Now the standard is defined and managed by the privately owned corporation EMVCo LLC. The current members of EMVCo are JCB International, American Express, MasterCard, China UnionPay, Discover Financial and Visa Inc. Each of these organizations owns an equal share of EMVCo and has representatives in the EMVCo organization and EMVCo working groups.
Recognition of compliance with the EMV standard (i.e., device certification) is issued by EMVCo following submission of results of testing performed by an accredited testing house.
EMV Compliance testing has two levels: EMV Level 1, which covers physical, electrical and transport level interfaces, and EMV Level 2, which covers payment application selection and credit financial transaction processing.
After passing common EMVCo tests, the software must be certified by payment brands to comply with proprietary EMV implementations such as Visa VSDC, American Express AEIPS, MasterCard MChip, JCB JSmart, or EMV-compliant implementations of non-EMVCo members such as LINK in the UK, or Interac in Canada.
The EMVCo standards have been integrated into the broader electronic payment security standards being developed by the Secure POS Vendor Alliance, with a specific effort to develop a common interpretation of EMVCo's place relative to, and interactions with, other existing security standards, such as Payment Card Industry Data Security Standard (PCI-DSS).[17]
List of EMV documents and standards[edit]
Since version 4.0, the official EMV standard documents that define all the components in an EMV payment system are published as four "books" and some additional documents:
Book 1: Application Independent ICC to Terminal Interface Requirements[15]
Book 2: Security and Key Management[18]
Book 3: Application Specification[19]
Book 4: Cardholder, Attendant, and Acquirer Interface Requirements[20]
Common Payment Application Specification[21]
EMV Card Personalisation Specification[22]
Versions[edit]
First EMV standard came into view in 1995 as EMV 2.0. This was upgraded to EMV 3.0 in 1996 (sometimes referred to as EMV '96) with later amendments to EMV 3.1.1 in 1998. This was further amended to version 4.0 in December 2000 (sometimes referred to as EMV 2000).
Version 4.0 became effective in June 2004
Version 4.1 became effective in June 2007
Version 4.2 is in effect since June 2008
Version 4.3 is in effect since November 2011.[23]
Vulnerabilities[edit]
Opportunities to harvest PINs and clone magnetic stripes[edit]
In addition to the track-two data on the magnetic stripe, EMV cards generally have identical data encoded on the chip, which is read as part of the normal EMV transaction process. If an EMV reader is compromised to the extent that the conversation between the card and the terminal is intercepted, then the attacker may be able to recover both the track-two data and the PIN, allowing construction of a magnetic stripe card, which, while not usable in a Chip and PIN terminal, can be used, for example, in terminal devices that permit fallback to magstripe processing for foreign customers without chip cards, and defective cards. This attack is possible only where (a) the offline PIN is presented in plaintext by the PIN entry device to the card, where (b) magstripe fallback is permitted by the card issuer and (c) where geographic and behavioural checking may not be carried out by the card issuer.
It was claimed[weasel words] that changes specified to the protocol (specifying different card verification values between the chip and magnetic stripe – the iCVV) rendered this attack ineffective. APACS (the UK Payments Association) stated that such measures would be in place from January 2008, although tests on cards in February 2008 indicated this may have been delayed.[24]
Successful attacks[edit]
Conversation capturing is the form of attack that was reported to have taken place against Shell terminals in May 2006, when they were forced to disable all EMV authentication in their filling stations after more than £1 million was stolen from customers.[25]
In October 2008 it was reported that hundreds of EMV card readers for use in Britain, Ireland, the Netherlands, Denmark, and Belgium had been expertly tampered with in China during or shortly after manufacture. For 9 months details and PINs of credit and debit cards were sent over mobile phone networks to criminals in Lahore, Pakistan. United States National Counterintelligence Executive Joel Brenner said, "Previously only a nation state's intelligence agency would have been capable of pulling off this type of operation. It's scary." Data were typically used a couple of months after the card transactions to make it harder for investigators to pin down the vulnerability. After the fraud was discovered it was found that tampered-with terminals could be identified as the additional circuitry increased their weight by about 100 g. Tens of millions of pounds sterling are believed to have been stolen.[26] This vulnerability spurred efforts to implement better control of electronic POS devices over their entire life cycle, a practice endorsed by electronic payment security standards like those being developed by the Secure POS Vendor Alliance (SPVA).[27]
Demonstration of PIN harvesting and stripe cloning[edit]
Cambridge University researchers Steven Murdoch and Saar Drimer demonstrated in a February 2008 BBC Newsnight programme one example attack, to illustrate that Chip and PIN is not secure enough to justify passing the liability to prove fraud from the banks onto customers.[28][29] The Cambridge University exploit allowed the experimenters to obtain both card data to create a magnetic stripe and the PIN.
APACS, the UK payments association, disagreed with the majority of the report, saying "The types of attack on PIN entry devices detailed in this report are difficult to undertake and not currently economically viable for a fraudster to carry out."[30] They also said that changes to the protocol (specifying different card verification values between the chip and magnetic stripe – the iCVV) would make this attack ineffective from January 2008. The fraud reported in October 2008 to have operated for 9 months (see above) was probably in operation at the time, but was not discovered for many months.
In August 2016, NCR (payment technology company) computer security researchers showed how credit card thieves can rewrite the code of a magnetic strip to make it appear like a chipless card, which allows for counterfeiting.
2010: Hidden hardware disables PIN checking on stolen card[edit]
Wikinews has related news: Chip and PIN 'not fit for purpose', says Cambridge researcher
On 11 February 2010 Murdoch and Drimer's team at Cambridge University announced that they had found "a flaw in chip and PIN so serious they think it shows that the whole system needs a re-write" that was "so simple that it shocked them".[31][32] A stolen card is connected to an electronic circuit and to a fake card that is inserted into the terminal ("man-in-the-middle attack"). Any four digits are typed in and accepted as a valid PIN.
A team from the BBC's Newsnight programme visited a Cambridge University cafeteria (with permission) with the system, and were able to pay using their own cards (a thief would use stolen cards) connected to the circuit, inserting a fake card and typing in "0000" as the PIN. The transactions were registered as normal, and were not picked up by banks' security systems. A member of the research team said, "Even small-scale criminal systems have better equipment than we have. The amount of technical sophistication needed to carry out this attack is really quite low." The announcement of the vulnerability said, "The expertise that is required is not high (undergraduate level electronics) ... We dispute the assertion by the banking industry that criminals are not sophisticated enough, because they have already demonstrated a far higher level of skill than is necessary for this attack in their miniaturized PIN entry device skimmers." It is not known if this vulnerability has been exploited.
EMVCo disagreed and published a response saying that, while such an attack might be theoretically possible, it would be extremely difficult and expensive to carry out successfully, that current compensating controls are likely to detect or limit the fraud, and that the possible financial gain from the attack is minimal while the risk of a declined transaction or exposure of the fraudster is significant.[33]
When approached for comment, several banks (Co-operative Bank, Barclays and HSBC) each said that this was an industry-wide issue, and referred the Newsnight[34] team to the banking trade association for further comment. According to Phil Jones of the Consumers' Association, Chip and PIN has helped to bring down instances of card crime, but many cases remain unexplained "What we do know is that we do have cases that are brought forward from individuals which seem quite persuasive."
Because submission of the PIN is suppressed, this is the exact equivalent of a merchant performing a PIN bypass transaction. Such transactions can't succeed offline, as a card never generates an offline authorisation without a successful PIN entry. As a result of this, the transaction ARQC must be submitted online to the issuer, who knows that the ARQC was generated without a successful PIN submission (since this information is included in the encrypted ARQC) and hence would be likely to decline the transaction if it were for a high value, out of character, or otherwise outside of the typical risk management parameters set by the issuer.
Originally, bank customers had to prove that they had not been negligent with their PIN before getting redress, but UK regulations in force from 1 November 2009 placed the onus firmly on the banks to prove that a customer has been negligent in any dispute, with the customer given 13 months to make a claim.[35] Murdoch said that "[the banks] should look back at previous transactions where the customer said their PIN had not been used and the bank record showed it has, and consider refunding these customers because it could be they are victim of this type of fraud."
2011: CVM downgrade allows arbitrary PIN harvest[edit]
At the CanSecWest conference in March 2011, Andrea Barisani and Daniele Bianco presented research uncovering a vulnerability in EMV that would allow arbitrary PIN harvesting despite the cardholder verification configuration of the card, even when the supported CVMs data is signed.[36]
The PIN harvesting can be performed with a chip skimmer. In essence, a CVM list that has been modified to downgrade the CVM to Offline PIN is still honoured by POS terminals, despite its signature being invalid.[37]
Implementation[edit]
In many countries of the world, debit card and/or credit card payment networks have implemented liability shifts. Normally, the card issuer is liable for fraudulent transactions. However, after a liability shift is implemented, if the ATM or merchant's point of sale terminal does not support EMV, the ATM owner or merchant is liable for the fraudulent transaction.
Chip and PIN systems can cause problems for travellers from countries that do not issue Chip and PIN cards as some retailers may refuse to accept their chipless cards.[38] While most terminals still accept a magnetic strip card, and the major credit card brands require vendors to accept them,[39] some staff may refuse to take the card, under the belief that they are held liable for any fraud if the card cannot verify a PIN. Non-chip-and-PIN cards may also not work in some unattended vending machines at, for example, train stations, or self-service check-out tills at supermarkets.[40]
Africa[edit]
MasterCard's liability shift among countries within this region took place on 1 January 2006.[41] By 1 October 2010, a liability shift had occurred for all point of sale transactions.[42]
Visa's liability shift for points of sale took place on 1 January 2006. For ATMs, the liability shift took place on 1 January 2008.[43]
South Africa[edit]
MasterCard's liability shift took place on 1 January 2005.[41]
Asian/Pacific countries[edit]
MasterCard's liability shift among countries within this region took place on 1 January 2006.[41] By 1 October 2010, a liability shift had occurred for all point of sale transactions, except for domestic transactions in China and Japan.[42]
Visa's liability shift for points of sale took place on 1 October 2010.[43] For ATMs, the liability shift date took place on 1 October 2015, except in China, India, Japan, and Thailand, where the liability shift will be 1 October 2017.[44] Domestic ATM transactions in China are not currently not subject to a liability shift deadline.
Australia[edit]
MasterCard required that all point of sale terminals be EMV capable by April 2013. For ATMs, the liability shift took place in April 2012. ATMs must be EMV compliant by the end of 2015[45]
Visa's liability shift for ATMs took place 1 April 2013.[43]
Malaysia[edit]
Malaysia is the first country in the world to completely migrate to EMV-compliant smart cards two years after its implementation in 2005.[46]
New Zealand[edit]
MasterCard required all point of sale terminals to be EMV compliant by 1 July 2011. For ATMs, the liability shift took place in April 2012. ATMs are required to be EMV compliant by the end of 2015.[45]
Visa's liability shift for ATMs was 1 April 2013.[43]
Europe[edit]
MasterCard's liability shift took place on 1 January 2005.[41]
Visa's liability shift for points of sale took place on 1 January 2006. For ATMs, the liability shift took place on 1 January 2008.[43]
France has cut card fraud by more than 80% since its introduction in 1992 (see Carte Bleue).
United Kingdom[edit]
Chip and PIN UK logo
Chip and PIN was trialled in Northampton, England from May 2003,[47] and as a result was rolled out nationwide in the United Kingdom on 14 February 2006[48] with advertisements in the press and national television touting the "Safety in Numbers" slogan. During the first stages of deployment, if a fraudulent magnetic swipe card transaction was deemed to have occurred, the retailer was refunded by the issuing bank, as was the case prior to the introduction of Chip and PIN. On January 1, 2005, the liability for such transactions was shifted to the retailer; this acted as an incentive for retailers to upgrade their point of sale (PoS) systems, and most major high-street chains upgraded on time for the EMV deadline. Many smaller businesses were initially reluctant to upgrade their equipment, as it required a completely new PoS system—a significant investment.
New cards featuring both magnetic strips and chips are now issued by all major banks. The replacement of pre-Chip and PIN cards was a major issue, as banks simply stated that consumers would receive their new cards "when their old card expires" — despite many people having had cards with expiry dates as late as 2007. The card issuer Switch lost a major contract with HBOS to Visa, as they were not ready to issue the new cards as early as the bank wanted.
The Chip and PIN implementation was criticised as designed to reduce the liability of banks in cases of claimed card fraud by requiring the customer to prove that they had acted "with reasonable care" to protect their PIN and card, rather than on the bank having to prove that the signature matched. Before Chip and PIN, if a customer's signature was forged, the banks were legally liable and had to reimburse the customer. Until 1 November 2009 there was no such law protecting consumers from fraudulent use of their Chip and PIN transactions, only the voluntary Banking Code. While this code stated that the burden of proof is on the bank to prove negligence or fraud rather than the cardholder having to prove innocence,[49] there were many reports that banks refused to reimburse victims of fraudulent card use, claiming that their systems could not fail under the circumstances reported, despite several documented successful large-scale attacks.
The Payment Services Regulations 2009 came into force on 1 November 2009[50] and shifted the onus onto the banks to prove, rather than assume, that the cardholder is at fault.[35] The Financial Services Authority (FSA) said "It is for the bank, building society or credit card company to show that the transaction was made by you, and there was no breakdown in procedures or technical difficulty" before refusing liability.
Latin America and the Caribbean[edit]
MasterCard's liability shift among countries within this region took place on 1 January 2005.[41]
Visa's liability shift for points of sale took place on 1 October 2012, for any countries in this region that had not already implemented a liability shift. For ATMs, the liability shift took place on 1 October 2014, for any countries in this region that had not already implemented a liability shift.[43]
Brazil[edit]
MasterCard's liability shift took place on 1 March 2008.[41]
Visa's liability shift for points of sale took place on 1 April 2011. For ATMs, the liability shift took place on 1 October 2012.[43]
Colombia[edit]
MasterCard's liability shift took place on 1 October 2008.[41]
Mexico[edit]
Discover implemented a liability shift on 1 October 2015. For pay at the pump at gas stations, the liability shift is 1 October 2017.[51]
Visa's liability shift for points of sale took place on 1 April 2011. For ATMs, the liability shift took place on 1 October 2012.[43]
Venezuela[edit]
MasterCard's liability shift took place on 1 July 2009.[41]
Middle East[edit]
MasterCard's liability shift among countries within this region took place on 1 January 2006.[41] By 1 October 2010, a liability shift had occurred for all point of sale transactions.[42]
Visa's liability shift for points of sale took place on 1 January 2006. For ATMs, the liability shift took place on 1 January 2008.[43]
North America[edit]
Canada[edit]
American Express implemented a liability shift on 31 October 2012.[52]
Discover implemented a liability shift on 1 October 2015 for all transactions except pay-at-the-pump at gas stations; those transactions shifted on 1 October 2017.[51]
Interac (Canada's debit card network) stopped processing non-EMV transactions at ATMs on 31 December 2012, and mandated EMV transactions at point-of-sale terminals on 30 September 2016, with a liability shift taking place on 31 December 2015.[53][not in citation given]
MasterCard implemented domestic transaction liability shift on 31 March 2011, and international liability shift on 15 April 2011. For pay at the pump at gas stations, the liability shift was implemented 31 December 2012.[52]
Visa implemented domestic transaction liability shift on 31 March 2011, and international liability shift on 31 October 2010. For pay at the pump at gas stations, the liability shift was implemented 31 December 2012.[52]
Over a 5-year period post-EMV migration, domestic card-card present fraudulent transactions significantly reduced in Canada. According to Helcim's reports, card-present domestic debit card fraud reduced 89.49% and credit card fraud 68.37%.[54]
United States[edit]
After widespread identity theft due to weak security in the Point-of-Sale terminals at Target, Home Depot, and other major retailers, Visa, MasterCard and Discover[55] in March 2012 – and American Express[56] in June 2012 – announced their EMV migration plans for the United States.[57] Since the announcement, multiple banks and card issuers have announced cards with EMV chip-and-signature technology, including American Express, Bank of America, Citibank, Wells Fargo,[58] JPMorgan Chase, U.S. Bank, and several credit unions.[59]
In 2010, a number of companies began issuing pre-paid debit cards that incorporate Chip and PIN and allow Americans to load cash as euros or pound sterling.[60] United Nations Federal Credit Union was the first United States issuer to offer Chip and PIN credit cards.[61] In May 2010, a press release from Gemalto (a global EMV card producer) indicated that United Nations Federal Credit Union in New York would become the first EMV card issuer in the United States, offering an EMV Visa credit card to its customers.[62] JPMorgan was the first major bank to introduce a card with EMV technology, namely its Palladium card, in mid-2012.[59]
As of April 2016, 70% of U.S. consumers have EMV cards and as of December 2016 roughly 50% of merchants are EMV compliant.[63][64] However, deployment has been slow and inconsistent across vendors across rollout. Even merchants with EMV hardware may not be able to process chip transactions due to software or compliance deficiencies.[65] Bloomberg has also cited issues with software deployment, including changes to audio prompts for Verifone machines which can take several months to release and deploy software out. Industry experts, however, expect more standardization in the United States for software deployment and standards. Visa and Mastercard have both implemented standards to speed up chip transactions with a goal of reducing the time for these to be under three seconds. These systems are labelled as Visa Quick Chip and Mastercard M/Chip Fast.[66]
American Express implemented liability shift for point of sale terminals on 1 October 2015.[67] For pay at the pump, at gas stations, the liability shift is 1 October 2020.
Discover implemented liability shift on 1 October 2015. For pay at the pump, at gas stations, the liability shift is 1 October 2020.[51]
Maestro implemented liability shift of 19 April 2013, for international cards used in the United States.[68]
MasterCard implemented liability shift for point of sale terminals on 1 October 2015.[67] For pay at the pump, at gas stations, the liability shift formally is on 1 October 2020.[69] For ATMs, the liability shift date was on 1 October 2016.[70][71]
Visa implemented liability shift for point of sale terminals on 1 October 2015. For pay at the pump, at gas stations, the liability shift formally is on 1 October 2020.[69][72] For ATMs, the liability shift date was on 1 October 2017.[44]
See also[edit]
Contactless payment
Supply chain attack
Two-factor authentication
MM code
References[edit]
Jump up ^ "EMVCo Members". EMVCo. Retrieved 10 May 2015.
Jump up ^ Fiat, Amos; Shamir, Adi (August 1986). "How to prove yourself: Practical solutions to identification and signature problems" (PDF). Conference on the Theory and Application of Cryptographic Techniques: 186–194. Archived from the original on |archive-url= requires |archive-date= (help).
Jump up ^ Kitten, Tracy (7 March 2011). "EMV Roots Go Deep in Europe: Global Shifts, New Headaches for U.S. Issuers". BankInfoSecurity. Retrieved 2015-06-07.
Jump up ^ "China UnionPay joins EMVCo" (Press release). Finextra Research. 20 May 2013. Retrieved 10 May 2015.
Jump up ^ "Discover Joins EMVCo to Help Advance Global EMV Standards". Discover Network News. 3 September 2013. Retrieved 10 May 2015.
Jump up ^ "Shift of liability for fraudulent transactions". The UK Cards Association. Retrieved 10 May 2015.
Jump up ^ "Understanding the 2015 U.S. Fraud Liability Shifts" (PDF). www.emv-connection.com. EMV Migration Forum. Retrieved 15 November 2015.
Jump up ^ "Chip-and-PIN vs. Chip-and-Signature". Card Hub. Retrieved 2016-04-21.
Jump up ^ "Chip-and-PIN vs. Chip-and-Signature", CardHub.com, retrieved 31 July 2012.
Jump up ^ "EMV Update: Discussion with the Federal Reserve" (PDF). Visa. Retrieved 2 January 2017.
Jump up ^ "BBC NEWS – Technology – Credit card code to combat fraud". bbc.co.uk.
Jump up ^ "... a revolution in authentication". emue.com.
Jump up ^ "Visa tests cards with built in PIN machine". IT PRO.
Jump up ^ "How EMV (Chip & PIN) Works – Transaction Flow Chart". Creditcall Ltd. Retrieved 10 May 2015.
^ Jump up to: a b "Book 1: Application Independent ICC to Terminal Interface Requirements" (PDF). 4.3. EMVCo. November 2011. Retrieved December 13, 2016.
Jump up ^ "MasterCard Product & Services - Documentation". Retrieved 17 April 2017.
Jump up ^ "SPVA Launch Presentation". Secure POS Vendor Alliance. 2009. Archived from the original on 21 January 2016.
Jump up ^ "Book 2: Security and Key Management" (PDF). 4.3. EMVCo. November 2011. Retrieved December 13, 2016.
Jump up ^ "Book 3: Application Specification" (PDF). 4.3. EMVCo. November 2011. Retrieved December 13, 2016.
Jump up ^ "Book 4: Cardholder, Attendant, and Acquirer Interface Requirements" (PDF). 4.3. EMVCo. November 2011. Retrieved December 13, 2016.
Jump up ^ "EMV CPA 1.0" (PDF). EMVCo. March 2008. Retrieved December 13, 2016.
Jump up ^ "EMV CPS 1.1" (PDF). EMVCo. July 2007. Retrieved December 13, 2016.
Jump up ^ "Integrated Circuit Card Specifications for Payment Systems". EMVCo. Retrieved 26 March 2012.
Jump up ^ Saar Drimer; Steven J. Murdoch; Ross Anderson. "PIN Entry Device (PED) vulnerabilities". University of Cambridge Computer Laboratory. Retrieved 10 May 2015.
Jump up ^ "Petrol firm suspends chip-and-pin". BBC News. 6 May 2006. Retrieved 13 March 2015.
Jump up ^ "Organized crime tampers with European card swipe devices". The Register. 10 October 2008.
Jump up ^ "Technical Working Groups, Secure POS Vendor Alliance". 2009. Archived from the original on 15 April 2010.
Jump up ^ "Is Chip and Pin really secure?". BBC News. 26 February 2008. Retrieved 2 May 2010.
Jump up ^ "Chip and pin". 6 February 2007. Archived from the original on 5 July 2007.
Jump up ^ John Leyden (27 February 2008). "Paper clip attack skewers Chip and PIN". The Channel. Retrieved 10 May 2015.
Jump up ^ Steven J. Murdoch; Saar Drimer; Ross Anderson; Mike Bond. "EMV PIN verification "wedge" vulnerability". Computer Laboratory, University of Cambridge. Retrieved 2010-02-12.
Jump up ^ Susan Watts (11 February 2010). "New flaws in chip and pin system revealed". BBC News. Retrieved 2010-02-12.
Jump up ^ "Response from EMVCo to the Cambridge University Report on Chip and PIN vulnerabilities ('Chip and PIN is Broken' – February 2010)" (PDF). EMVCo. Retrieved 2010-03-26.
Jump up ^ Susan, Watts. "New flaws in chip and pin system revealed (11 February 2010)". Newsnight. BBC. Retrieved 9 December 2015.
^ Jump up to: a b Richard Evans (15 October 2009). "Card fraud: banks now have to prove your guilt". The Telegraph. Retrieved 10 May 2015.
Jump up ^ Andrea Barisani; Daniele Bianco; Adam Laurie; Zac Franken (2011). "Chip & PIN is definitely broken" (PDF). Aperture Labs. Retrieved 10 May 2015.
Jump up ^ Adam Laurie; Zac Franken; Andrea Barisani; Daniele Bianco. "EMV – Chip & Pin CVM Downgrade Attack". Aperture Labs and Inverse Path. Retrieved 10 May 2015.
Jump up ^ "US credit cards outdated, less useful abroad, as 'Chip and PIN' cards catch on". creditcards.com. [permanent dead link]
Jump up ^ "Visa Australia". visa-asia.com.
Jump up ^ Higgins, Michelle (29 September 2009). "For Americans, Plastic Buys Less Abroad". Retrieved 17 April 2017 – via NYTimes.com.
^ Jump up to: a b c d e f g h i "Chargeback Guide" (PDF). MasterCard Worldwide. 3 November 2010. Retrieved May 10, 2015.
^ Jump up to: a b c "Operating Regulations" (PDF). Visa International. Archived from the original (PDF) on 3 March 2013.
^ Jump up to: a b c d e f g h i "The Journey To Dynamic Data". Visa.
^ Jump up to: a b "Visa Expands U.S. Roadmap for EMV Chip Adoption to Include ATM and a Common Debit Solution" (Press release). Foster City, Calif.: Visa. 4 February 2013. Retrieved 10 May 2015.
^ Jump up to: a b "MasterCard Announces Five Year Plan to Change the Face of the Payments Industry in Australia". Mastercard Australia. Archived from the original on 2013-01-28.
Jump up ^ "US learns from Malaysia, 10 years later". The Rakyat Post.
Jump up ^ "Anti-fraud credit cards on trial". BBC Business News. 2003-04-11. Retrieved 2015-05-27.
Jump up ^ The UK Cards Association. "The chip and PIN guide" (PDF). Retrieved 2015-05-27.
Jump up ^ "Is chip and PIN safe?". This is Money. 2004-11-03. Retrieved 2015-05-27.
Jump up ^ Foundation, Internet Memory. "[ARCHIVED CONTENT] UK Government Web Archive – The National Archives". Archived from the original on 12 November 2008. Retrieved 17 April 2017.
^ Jump up to: a b c "Discover to enforce EMV liability shift by 2015" (Press release). Finextra Research. 12 November 2012. Retrieved 10 May 2015.
^ Jump up to: a b c "Chip Liability Shift". globalpayments. Archived from the original on 30 July 2013.
Jump up ^ "Interac - For Merchants". Retrieved 17 April 2017.
Jump up ^ "Infographic - Lessons from the Canadian EMV Migration - The Official Helcim™ Blog". Retrieved 17 April 2017.
Jump up ^ "Discover Implements EMV Mandate for U.S., Canada and Mexico". Archived from the original on 10 May 2012.
Jump up ^ "American Express Announces U.S. EMV Roadmap to Advance Contact, Contactless and Mobile Payments" (Press release). New York: American Express. 29 June 2012. Retrieved 10 May 2015.
Jump up ^ "EMV's Uncertain Fate in the US". Protean Payment. Archived from the original on 29 September 2013. Retrieved 22 September 2012.
Jump up ^ Camhi, Jonathan (3 August 2012). "Wells Fargo Introduces New EMV Card for Consumers". Bank Systems & Technology. Retrieved 10 May 2015.
^ Jump up to: a b Paul Riegler (25 July 2013). "Chip-and-Pin and Chip-and-Signature Credit Card Primer for 2013". Frequent Business Traveler. Retrieved 10 May 2015.
Jump up ^ "Travelex Offers America's First Chip & PIN Enabled Prepaid Foreign Currency Card". Business Wire. Business Wire. 1 December 2010. Retrieved 6 February 2014.
Jump up ^ "UNFCU to be first issuer in the US to offer credit cards with a high security chip". United Nations Federal Credit Union.
Jump up ^ Ray Wizbowski (13 May 2010). "United Nations Federal Credit Union Selects Gemalto for First U.S. Issued Globally Compliant Payment Card" (Press release). Austin, Texas: Gemalto. Retrieved 10 May 2015.
Jump up ^ Goldman, Sharon. "Is the rocky road to EMV retail adoption getting smoother?". Retrieved 17 April 2017.
Jump up ^ "EMV Credit Cards Poll".
Jump up ^ "Retailers have chip card readers -- why aren't they using them?". Retrieved 2017-11-22.
Jump up ^ "The Plan to Make Chip Credit Cards Less Annoying". Bloomberg.com. 2017-07-17. Retrieved 2017-08-05.
^ Jump up to: a b Cathy Medich (July 2012). "EMV Migration – Driven by Payment Brand Milestones". Retrieved 10 May 2015.
Jump up ^ David Heun (10 September 2012). "MasterCard Brings EMV Chip-Card Liability Policy to U.S. ATMs". SourceMedia. Archived from the original on 22 February 2014. Retrieved 10 May 2015.
^ Jump up to: a b "EMV Fuel Liability Delay Pumps Card Fraud Concerns". Credit Union Times. Retrieved 4 December 2016.
Jump up ^ Beth Kitchener (10 September 2012). "MasterCard Extends U.S. EMV Migration Roadmap to ATM Channel" (Press release). Purchase, N.Y.: Mastercard. Retrieved 10 May 2015.
Jump up ^ "EMV For U.S. Acquirers: Seven Guiding Principles for EMV Readiness" (PDF). Retrieved 17 April 2017.
Jump up ^ "Visa Announces U.S. Participation in Global Point-of-Sale Counterfeit Liability Shift" (PDF) (Press release). Visa. 9 August 2011. Retrieved 10 May 2015.
External links[edit]
EMVCo, the organization responsible for developing and maintaining the standard
Chip and SPIN, discussion of some security aspects of EMV, from members of the University of Cambridge Security Group
Cryptography of EMV cards, an explanation of EMV card cryptography
EMV Accepted Here, a crowdsourced database tracking EMV adoption by merchants
EMV Explained, an agency dedicated to EMV adoption by merchants
[hide]
v
t
e
Credit, charge and debit cards
Major cards
American Express
Diners Club
MasterCard
Debit MasterCard
Maestro
Visa
Visa Debit
Visa Electron
Regional and
specialty cards
Bancomat
BC Card
BCA Card
Carte Bleue
China UnionPay
Dankort
Discover
EFTPOS
Electronic Payment Services (EPS)
Girocard
Interac
Isracard
JCB
Mir
MEPS
NETS
RuPay
UATP
V Pay
Verve
Defunct cards
Access
Bankcard
Carte Blanche
Choice
enRoute
Eurocard
Everything
Laser
Rail Travel Card
Revolution Card
Solo
Switch
Accounts
Payment card number
Card enclosure
Credit card balance transfer
Credit limit
Installment credit
Revolving account
Deposit account
Current/checking account
Savings account
ATM card
Debt
Cash advance
Charge-off
Maxed out
Interest
Grace period
Introductory rate
Universal default
Payment
Card not present transaction
Chargeback
Controlled payment number
Dispute
Interchange fee
Interchange fee
Surcharge
Security
Card security code
Chargeback fraud
Credit card fraud
Credit card hijacking
Enculturation
Technology
Cash machine
Chip and PIN
Contactless payment
Credit card terminal
EMV
Interbank network
Magnetic stripe card
Smart card
Retrieved from "https://en.wikipedia.org/w/index.php?title=EMV&oldid=814895120"
Categories:
EMV
Hidden categories:
Pages with archiveurl citation errors
All articles with dead external links
Articles with dead external links from December 2016
Articles with permanently dead external links
Use dmy dates from July 2013
Wikipedia articles needing clarification from December 2014
All articles with unsourced statements
Articles with unsourced statements from November 2015
Articles to be expanded from February 2017
Articles containing potentially dated statements from May 2009
All articles containing potentially dated statements
All articles with specifically marked weasel-worded phrases
Articles with specifically marked weasel-worded phrases from January 2012
All articles with failed verification
Articles with failed verification from June 2017
Navigation menu
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
Namespaces
Article
Talk
Variants
Views
Read
Edit
View history
More
Search
Navigation
Main page
Contents
Featured content
Current events
Random article
Donate to Wikipedia
Wikipedia store
Interaction
Help
About Wikipedia
Community portal
Recent changes
Contact page
Tools
What links here
Related changes
Upload file
Special pages
Permanent link
Page information
Wikidata item
Cite this page
Print/export
Create a book
Download as PDF
Printable version
Languages
Català
Čeština
Cymraeg
Deutsch
Español
Français
Italiano
Lietuvių
Nederlands
Русский
Simple English
Svenska
Українська
中文
Edit links
This page was last edited on 11 December 2017, at 15:25.
Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.
Privacy policy
About Wikipedia
Disclaimers
Contact Wikipedia
Developers
Cookie statement
Mobile view
Enable previews

values: mw-page-base noprint

values: mw-head-base noprint

values: firstHeading firstHeading en

values: siteSub noprint

values: jump-to-nav mw-jump

values:
/wiki/Escuela_Mexicana_del_Valle
mw-redirect
Escuela Mexicana del Valle

attrs: role class

values:
note
hatnote navigation-not-searchable

attrs: class style

values:
noprint Inline-Template
margin-left:0.1em; white-space:nowrap;

values:
/wiki/Credit_card_skimming
mw-redirect
Credit card skimming

values: Edit section: Differences and benefits of EMV

values:
/wiki/Secure_Hash_Algorithm
mw-redirect
Secure Hash Algorithm

values: This claim needs references to reliable sources. (November 2015)

values:
noprint Inline-Template Template-Fact
white-space:nowrap;

values: Edit section: Chip and PIN versus chip and signature

values:
plainlinks metadata ambox ambox-notice
presentation

values: Edit section: Online, phone, and mail order transactions

values: plainlinks noexcerpt noprint asof-tag update

values: Smart card application protocol data unit

values:
/wiki/Japan_Credit_Bureau
mw-redirect
Japan Credit Bureau

values:
/wiki/Diners_Club
mw-redirect
Diners Club

values:
/wiki/Saudi_Payments_Network
mw-redirect
Saudi Payments Network

values:
/wiki/Zentraler_Kreditausschuss
mw-redirect
Zentraler Kreditausschuss

values: Verve (Card Scheme) (page does not exist)

values: Edit section: Initiate application processing

values:
/wiki/BER_encoding_rules
mw-redirect
BER encoding rules

values: Edit section: Offline data authentication (ODA)

values:
/wiki/Data_object
mw-redirect
Data object

values:
/wiki/Issuer_action_codes
mw-redirect
Issuer action codes

values: Edit section: First card action analysis

values: Edit section: Online transaction authorization

values: Edit section: Second card action analysis

values: Edit section: Control of the EMV standard

values: Payment Card Industry Data Security Standard

values: Edit section: List of EMV documents and standards

values: Edit section: Opportunities to harvest PINs and clone magnetic stripes

values:
/wiki/Wikipedia:Avoid_weasel_words
mw-redirect
Wikipedia:Avoid weasel words

values: UK Payments Association (page does not exist)

values: Edit section: Demonstration of PIN harvesting and stripe cloning

values: Edit section: 2010: Hidden hardware disables PIN checking on stolen card

values: wikinews:Chip and PIN 'not fit for purpose', says Cambridge researcher

values: Edit section: 2011: CVM downgrade allows arbitrary PIN harvest

values: Green rectangle containing a row of four white asterisks in black squares; the outline of a hand points to and obscures the second asterisk.

values: Payment Services Regulations 2009 (page does not exist)

values: Edit section: Latin America and the Caribbean

values: The material near this tag failed verification of its source citation(s). (June 2017)

values:
/wiki/Two-factor_authentication
mw-redirect
Two-factor authentication

values:
nofollow
external text
http://www.emue.com

values:
nofollow
external text
http://proteanpayment.org/?p=248

values: -moz-column-width: 30em; -webkit-column-width: 30em; column-width: 30em; list-style-type: decimal;

values:
nofollow
external text
http://www.emvco.com

values:
nofollow
http://www.chipandspin.co.uk/
external text

values:
nofollow
http://emvacceptedhere.com/
external text

values:
nofollow
https://freeatmprocessing.com/
external text

values:
/wiki/Cash_machine
mw-redirect
Cash machine

values: nowraplinks collapsible autocollapse navbox-inner

values: Category:Pages with archiveurl citation errors

values: Category:All articles with dead external links

values: Category:Articles with dead external links from December 2016

values: Category:Articles with permanently dead external links

values: Category:Wikipedia articles needing clarification from December 2014

values: Category:All articles with unsourced statements

values: Category:Articles with unsourced statements from November 2015

values: Category:Articles to be expanded from February 2017

values: Category:Articles containing potentially dated statements from May 2009

values: Category:All articles containing potentially dated statements

values: Category:All articles with specifically marked weasel-worded phrases

values: Category:Articles with specifically marked weasel-worded phrases from January 2012

values: Category:All articles with failed verification

values: Category:Articles with failed verification from June 2017

values:
/wiki/EMV
View the content page [ctrl-alt-c]
c

values:
/w/index.php?title=EMV&action=edit
Edit this page [ctrl-alt-e]
e

values: Find background information on current events

values:
/wiki/Special:Random
Load a random article [ctrl-alt-x]
x

values: portal navigation p-navigation p-navigation-label

values: Guidance on how to use and edit Wikipedia

values: About the project, what you can do, where to find things

values: A list of recent changes in the wiki [ctrl-alt-r]

values: portal navigation p-interaction p-interaction-label

values: List of all English Wikipedia pages containing links to this page [ctrl-alt-j]

values: Recent changes in pages linked from this page [ctrl-alt-k]

values:
/wiki/Wikipedia:File_Upload_Wizard
Upload files [ctrl-alt-u]
u

values: A list of all special pages [ctrl-alt-q]

values: Permanent link to this revision of the page

values: Link to connected data repository item [ctrl-alt-g]

values: Printable version of this page [ctrl-alt-p]

values:
uls-settings-trigger
Language settings
0
button
true

values:
https://ca.wikipedia.org/wiki/EMV
EMV – Catalan
ca
ca
interlanguage-link-target

values:
https://cs.wikipedia.org/wiki/EMV
EMV – Czech
cs
cs
interlanguage-link-target

values:
https://cy.wikipedia.org/wiki/EMV
EMV – Welsh
cy
cy
interlanguage-link-target

values:
https://es.wikipedia.org/wiki/EMV
EMV – Spanish
es
es
interlanguage-link-target

values:
https://it.wikipedia.org/wiki/EMV
EMV – Italian
it
it
interlanguage-link-target

values:
https://ru.wikipedia.org/wiki/EMV
EMV – Russian
ru
ru
interlanguage-link-target

values:
https://simple.wikipedia.org/wiki/EMV
EMV – Simple English
simple
simple
interlanguage-link-target

values:
https://uk.wikipedia.org/wiki/EMV
EMV – Ukrainian
uk
uk
interlanguage-link-target

values:
https://zh.wikipedia.org/wiki/EMV
EMV – Chinese
zh
zh
interlanguage-link-target

values:
suggestions
display: none; font-size: 13px;

values: mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-EMV rootpage-EMV skin-vector action-view