Cardholder Verification Method (CVM)

A cardholder verification method (CVM) is the step in a card payment that checks whether the person presenting the card is the person the card was issued to. Common methods are an offline or online personal identification number (PIN), a handwritten signature, a fingerprint or face scan on the customer's phone, and "no CVM" for low-value purchases. The method used for a given payment is agreed between the card and the terminal at the time of the transaction.

CVM is a term from the EMV chip specifications maintained by EMVCo, and it applies mainly to card-present payments. It is separate from card authentication (proving the card itself is genuine) and from online customer authentication such as 3-D Secure, although the ideas overlap. The card networks set which methods are accepted in each region and when each one shifts fraud liability.

Think of a hotel key card and a front desk. The key card proves you have a key; it does not prove you are the guest. For that, the desk clerk might ask for your name, check your face against your passport, or, for something trivial like borrowing an umbrella, not ask at all. A CVM is the "are you really the guest?" question at the till.

The card and the shop's terminal hold a short conversation before the payment goes through. The card says which checks it is willing to accept, in order of preference, and the terminal says which ones it can perform. They settle on the first one both can do. That might be typing a PIN, signing a slip, unlocking your phone with your thumb, or nothing at all for a cup of coffee.

• Offline PIN. The chip checks the PIN itself, without contacting the issuing bank. It is common in Europe and on terminals that are not always online.
• Online PIN. The PIN is encrypted at the terminal and sent with the authorization request for the issuer to verify. Debit cards in many markets use it, and ATMs always use a PIN.
• Signature. The cardholder signs, and in theory the cashier compares it with the card. It offers little real protection, and the major US networks made signatures optional for chip and contactless transactions from 2018.
• Consumer device CVM (CDCVM). The customer verifies on their own phone or watch, using a fingerprint, face scan or device passcode, before tapping. This is how wallet payments with a digital wallet usually verify the holder.
• No CVM. No check is made. Networks and regulators allow this below set limits, mainly for contactless payments, unattended terminals such as parking meters, and some transit fares.

An EMV card carries a CVM list, set by the issuer during card personalization. Each entry names a method and the conditions under which it applies, for example "online PIN if the terminal supports it", "signature if the amount is under a set value", or "no CVM for unattended terminals". The terminal also has a list of the methods it can perform. During the transaction, the terminal works down the card's list and picks the first rule whose conditions are met and which it supports. The outcome is recorded in the transaction data, so the issuer can see which method was used when it decides whether to approve.

Contactless payments follow a separate path. The terminal compares the amount with a contactless CVM limit. Below the limit, no check is needed; above it, the terminal asks for a PIN or CDCVM. For phone-based payments, the wallet itself reports that the customer has already verified on the device, which is why a phone tap can often exceed the plain card limit.

Contactless no-CVM limits vary by country and are set by the networks, often after pressure from regulators or banks. In the UK the limit was raised to £100 in October 2021. In the European Economic Area, the strong customer authentication (SCA) rules under PSD2 allow contactless payments without SCA up to €50 a time, with cumulative caps (€150 or five consecutive payments) after which the cardholder must verify. Card issuers can set lower limits on their own cards.

The CVM choice also drives liability. If a counterfeit or lost card is used at a terminal that could not perform the stronger method on the card, the networks' rules generally shift the loss away from the party that had the better technology. This liability shift was the main lever used to move merchants to chip-and-PIN terminals and away from card skimming-prone magnetic stripes.

PIN-based methods are strong because the PIN is never printed on the card and, for online PIN, is checked by the issuer. Signatures are weak because few cashiers inspect them, which is why most markets have retired them. CDCVM is strong in practice, since the phone's biometric and the network tokenization of wallet cards protect the real card number. No-CVM payments trade security for speed: lost cards can be used for small purchases until blocked, and the cumulative counters exist to cap that exposure. None of these methods help with card-not-present fraud, where online authentication tools take over.

• EMVCo
• European Banking Authority