EMV Transaction

An EMV transaction is a card payment carried out under the EMV specifications, the global standard for chip-based cards. Instead of reading static data from a magnetic stripe, the payment terminal communicates with the EMV chip on the card, which runs a small application, checks the cardholder's verification and generates a cryptogram unique to that transaction. Because the cryptogram changes every time, copying data from one transaction does not allow a criminal to create a working counterfeit card. EMV transactions can be made by inserting the card, in which case they are also called a chip transaction, or by tapping it under EMV contactless specifications.

The standard is managed by EMVCo, a body owned by the major international card networks. The name comes from Europay, Mastercard and Visa, the companies that first developed it in the 1990s. EMV is now used in most countries for card-present payments, and mobile wallets use EMV-based tokens and cryptograms as well.

1. Application selection. The terminal reads the list of payment applications on the chip and chooses one, for example a debit or credit application, or lets the cardholder choose.
2. Reading data. The terminal reads card data, such as the account number, expiry date and the card's processing rules.
3. Offline data authentication. Where supported, the terminal checks a digital signature on the card data using public key certificates issued by the card scheme, confirming that the card is genuine.
4. Processing restrictions. The terminal checks whether the card is valid for the type of transaction and location.
5. Cardholder verification. The terminal and card agree a cardholder verification method, such as PIN, signature, consumer device verification on a phone, or no verification for low-value contactless payments.
6. Risk management. The terminal and card decide whether the transaction can be approved offline or must go online to the issuer.
7. Cryptogram generation. The chip generates an application cryptogram, usually an authorisation request cryptogram (ARQC) that is sent to the issuer with the authorisation request.
8. Issuer authentication. The issuer validates the cryptogram using its keys, makes an approval decision and may return data that the card uses to confirm the response.
9. Completion. The chip produces a final cryptogram recording the outcome, and the transaction is completed.

The dynamic cryptogram is the main security feature. Counterfeit fraud, where criminals copy magnetic stripe data from a skimmed card onto a blank card, fell sharply in countries that adopted EMV. Offline PIN verification by the chip also reduced lost and stolen card fraud in markets that used chip and PIN. Card keys are stored in the chip's secure element and cannot easily be extracted. However, EMV does not protect online or telephone purchases, where the chip is not used, so fraud tended to move to card-not-present transactions after EMV adoption.

Card networks introduced liability shift rules to encourage adoption. Under these rules, when a counterfeit fraud occurs, the party that has not adopted EMV, either the issuer that issued a stripe-only card or the merchant that used a non-chip terminal, bears the loss. Europe and other regions adopted EMV earlier, and the United States introduced a liability shift for most card-present payments in October 2015, which drove a rapid roll-out of chip cards and terminals. Liability rules also affect fallback transactions, where a chip card is processed by magnetic stripe because the chip cannot be read.

EMV allows some transactions to be approved without contacting the issuer, which is useful in places with poor connectivity, such as on aircraft, on transport and at unattended terminals. Approval depends on limits and rules on the card and terminal, and the transaction is sent for clearing later. Such offline authorization carries more risk, and its use has declined in many countries as connectivity has improved, although transit systems still rely on fast offline-capable processing.

Mobile wallets such as those on phones and watches emulate EMV cards, using device-specific tokens instead of the real card number and generating cryptograms in a secure element or through cloud-based keys. EMVCo also publishes specifications for 3-D Secure, payment tokenisation and QR code payments, extending the EMV framework to online and mobile commerce. Terminal certification under EMV levels ensures that devices behave consistently with cards from any network.