EMV Chip

An EMV chip is the small gold or silver contact plate and microprocessor embedded in a payment card that follows the EMV specifications. When the card is inserted into a terminal or tapped against it, the chip runs a payment application that checks the card is genuine, helps verify the cardholder, and produces a cryptogram, a one-time code tied to that particular transaction. Data copied from one payment therefore cannot be used to make a working counterfeit card.

EMV stands for Europay, Mastercard and Visa, the three companies that developed the first specifications in the 1990s. Today the specifications are managed by EMVCo, owned by six card networks (American Express, Discover, JCB, Mastercard, UnionPay and Visa). The chip makes the card a smart card; it replaced the magnetic stripe as the main way to read a card in person. The same chip application also powers contactless payments.

A magnetic stripe is like a printed photo of your house key: copy the photo and you can cut a new key. An EMV chip is more like a guard who knows a secret and, each time someone knocks, answers with a fresh password that only the bank can check. Overhearing one answer does not help, because the next one will be different.

That is why the chip makes shop and cash-machine fraud harder. A criminal who secretly copies a chip payment ends up with an answer that has already been used, which the bank will reject if it is offered again.

1. Application selection. The payment terminal reads the list of payment applications on the chip (for example a debit and a credit application) and picks one.
2. Card authentication. The terminal checks a digital signature stored on or generated by the chip, using public key certificates from the network and the card issuer, to confirm the card was produced by a real issuer.
3. Cardholder verification. The chip holds a list of accepted methods, such as an online or offline PIN, a signature, or no check for small amounts. The terminal applies the first method both sides support.
4. Risk checks and cryptogram. The chip and terminal run risk rules and the chip generates an authorization request cryptogram from the amount, date, a random number and other data, using a secret key that never leaves the chip.
5. Online authorization. The terminal sends the cryptogram with the transaction through the acquirer and card networks to the issuer, which recalculates and checks it before approving. The issuer's reply can include a response cryptogram and, sometimes, instructions ("issuer scripts") that update settings on the chip, such as resetting a PIN try counter.

Some terminals can also approve low-risk transactions offline, without contacting the issuer, within limits set on the chip; this is common in transport and in-flight sales.

Countries adopted the chip with different verification methods. Most of Europe, Canada and much of Asia paired it with a PIN ("chip and PIN"); the UK completed its national switch in 2006. The United States issued chip cards later and largely with signature or no verification on credit cards, while many debit cards support PIN.

The card networks pushed adoption through "liability shift" rules. After the shift date in a region, if a counterfeit card is used at a terminal that cannot read chips, the fraud cost generally moves from the issuer to the merchant's side, and vice versa if a chip-capable merchant accepts a card the issuer did not chip. In the US the main shift for card-present counterfeit fraud took effect in October 2015, and for automated fuel dispensers in April 2021 after several delays. Disputes under these rules are raised as a chargeback.

Counterfeit card fraud at physical stores fell in markets that adopted the chip, but criminals moved to weaker channels:

• Online payments. The chip offers no protection when the card number is typed into a website, so fraud shifted to card not present (CNP) transactions, which 3-D Secure (3DS) and network tokenization now try to address.
• Stripe fallback. Where terminals still accept a swipe after a failed chip read, copied stripe data from card skimming can still be used.
• Lost and stolen cards. A chip proves the card is real, not that the holder is the owner, which is why PIN and contactless limits matter.
• Social engineering. Scams that trick cardholders into handing over cards, PINs or one-time codes bypass the chip entirely; see social engineering.

Each chip must be loaded with its own keys, certificates and account data before it reaches the customer, a step described under card personalization and done in secure facilities certified to PCI card-production requirements. The chip application and its settings are chosen when the issuer designs a programme during card issuance, and keys and limits can be changed over the card's life through issuer scripts, part of card lifecycle management. Terminals, in turn, need EMVCo approval of their chip-reading hardware and software before card networks will certify them.

• EMVCo
• EMVCo: EMV Contactless