EMV stands for Europay

Europay International

Europay International was the name of the entity created by the merger of Eurocard International, and Eurocheque International. The merged entity was headquartered in Waterloo, Belgium, on the same premises as EPSS and MasterCard EMEA .Europay International was the owner of the...

, MasterCard

MasterCard

Mastercard Incorporated or MasterCard Worldwide is an American multinational financial services corporation with its headquarters in the MasterCard International Global Headquarters, Purchase, Harrison, New York, United States...

 and VISA

VISA (credit card)

Visa Inc. is an American multinational financial services corporation headquartered on 595 Market Street, Financial District in San Francisco, California, United States, although much of the company's staff is based in Foster City, California. It facilitates electronic funds transfers throughout...

, a global standard for inter-operation of integrated circuit card

Smart card

A smart card, chip card, or integrated circuit card , is any pocket-sized card with embedded integrated circuits. A smart card or microprocessor cards contain volatile memory and microprocessor components. The card is made of plastic, generally polyvinyl chloride, but sometimes acrylonitrile...

s (IC cards or "chip cards") and IC card capable point of sale

Point of sale

Point of sale or checkout is the location where a transaction occurs...

 (POS) terminals and automated teller machine

Automated teller machine

An automated teller machine or automatic teller machine, also known as a Cashpoint , cash machine or sometimes a hole in the wall in British English, is a computerised telecommunications device that provides the clients of a financial institution with access to financial transactions in a public...

s (ATMs), for authenticating credit

Credit card

A credit card is a small plastic card issued to users as a system of payment. It allows its holder to buy goods and services based on the holder's promise to pay for these goods and services...

 and debit card

Debit card

A debit card is a plastic card that provides the cardholder electronic access to his or her bank account/s at a financial institution...

 transactions.

It is a joint effort between Europay, MasterCard and Visa to ensure security and global interoperability so that Visa and MasterCard cards can continue to be accepted everywhere. Europay International SA was absorbed into MasterCard in 2002. JCB

Japan Credit Bureau

Japan Credit Bureau is a credit card company based in Tokyo, Japan. Its English name is .Founded in 1961, JCB established dominance over the Japanese credit card market when it purchased Osaka Credit Bureau in 1968, and its cards are now issued in 20 different countries...

 (formerly Japan Credit Bureau) joined the organization in December 2004, and American Express

American Express

American Express Company or AmEx, is an American multinational financial services corporation headquartered in Three World Financial Center, Manhattan, New York City, New York, United States. Founded in 1850, it is one of the 30 components of the Dow Jones Industrial Average. The company is best...

 joined in February 2009. IC card systems based on EMV are being phased in across the world, under names such as "IC Credit" and "Chip and PIN

Chip and PIN

Chip and PIN is the brandname adopted by the banking industries in the United Kingdom and Ireland for the rollout of the EMV smartcard payment system for credit, debit and ATM cards.- History :...

".

The EMV standards define the interaction at the physical, electrical, data and application levels between IC cards and IC card processing devices for financial transactions. There are standards based on ISO/IEC 7816 for contact cards, and standards based on ISO/IEC 14443 for contactless cards.

The first standard for payment cards was the Carte Bancaire B0' standard deployed in France in 1989. Geldkarte

Geldkarte

Geldkarte is a Stored-value card or electronic cash system used in Germany. It operates as an offline smart card for small payment at things like vending machines and to pay for public transport or parking tickets. The card is pre-paid and funds are loaded onto the card using ATMs or dedicated...

 in Germany also predates EMV. EMV was designed to allow cards and terminals to be backwardly compatible with these standards. France has since migrated all its card and terminal infrastructure to EMV.

The most widely known chip card implementations of EMV standard are:

• VSDC - VISA
• M/Chip - MasterCard
• AEIPS - American Express
• J Smart - JCB

Visa and MasterCard have also developed standards for using EMV cards in devices to support card-not-present transactions over the telephone and Internet. MasterCard has the Chip Authentication Program

Chip Authentication Program

thumb|right|250px|A GemAlto EZIO CAP Device Whitelabeled as Barclays PINSentryThe Chip Authentication Program is a MasterCard initiative and technical specification for using EMV banking smartcards for authenticating users and transactions in online and telephone banking. It was also adopted by...

 (CAP) for secure e-commerce. Its implementation is known as EMV-CAP and supports a number of modes. Visa has the Dynamic Password Authentication (DPA) scheme, which is their implementation of CAP using different default values.

In February 2010 computer scientists from Cambridge University demonstrated that an implementation of EMV PIN entry is vulnerable to a man-in-the-middle attack; however, the way PINs are processed depends on the capabilities of the card and the terminal, showing that attacks against card security are possible depending on the implementation.

In May 2010, a press release from Gemalto

Gemalto

Gemalto is an international digital security company, providing secure personal devices such as smart cards and tokens in addition to software applications and managed services. The company was formed in June 2006 by the combination of two companies Axalto and Gemplus International...

 (a global EMV card producer) indicated that United Nations Federal Credit Union

United Nations Federal Credit Union

United Nations Federal Credit Union is a federal credit union headquartered in Long Island City, New York, chartered and regulated under the authority of the National Credit Union Administration .-Key data:...

 in New York would become the first EMV card issuer in the US, offering an EMV Visa credit card to its customers.

Differences and benefits of EMV

The purpose and goal of the EMV standard is to specify interoperability between EMV compliant IC cards and EMV compliant credit card payment terminals throughout the world. There are two major benefits to moving to smart card based credit card payment systems: improved security (with associated fraud reduction), and the possibility for finer control of "offline" credit card transaction approvals. One of the original goals of EMV was to allow for multiple applications to be held on a card: for instance, a credit and debit card application or an e-purse.

EMV chip card transactions improve security against fraud compared to magnetic stripe card transactions that rely on the holder's signature and visual inspection of the card to check for features such as hologram. The use of a PIN and cryptographic algorithms such as DES

Data Encryption Standard

The Data Encryption Standard is a block cipher that uses shared secret encryption. It was selected by the National Bureau of Standards as an official Federal Information Processing Standard for the United States in 1976 and which has subsequently enjoyed widespread use internationally. It is...

, Triple-DES, RSA and SHA

Secure Hash Algorithm

The Secure Hash Algorithm is one of a number of cryptographic hash functions published by the National Institute of Standards and Technology as a U.S. Federal Information Processing Standard :...

 provide authentication of the card to the processing terminal and the card issuer's host system. The processing time is comparable to online transactions, in which communications delay accounts for the majority of the time, while cryptographic operations take comparatively little time. The supposed increased protection from fraud has allowed banks and credit card issuers to push through a 'liability shift' such that merchants are now liable (as from 1 January 2005 in the EU region) for any fraud that results from transactions on systems that are not EMV capable. For transactions in which an EMV card is used, the cardholder is assumed to be liable unless they can unquestionably prove they were not present for the transaction, did not authorize the transaction, and did not inadvertently assist the transaction through PIN disclosure.

Although not the only possible method, the majority of implementations of EMV cards and terminals confirm the identity of the cardholder by requiring the entry of a PIN (Personal Identification Number

Personal identification number

A personal identification number is a secret numeric password shared between a user and a system that can be used to authenticate the user to the system. Typically, the user is required to provide a non-confidential user identifier or token and a confidential PIN to gain access to the system...

) rather than signing a paper receipt. Whether or not PIN authentication takes place depends upon the capabilities of the terminal and programming of the card. For more details of this (specifically, the system being implemented in the UK

United Kingdom

The United Kingdom of Great Britain and Northern IrelandIn the United Kingdom and Dependencies, other languages have been officially recognised as legitimate autochthonous languages under the European Charter for Regional or Minority Languages...

) see Chip and PIN

Chip and PIN

Chip and PIN is the brandname adopted by the banking industries in the United Kingdom and Ireland for the rollout of the EMV smartcard payment system for credit, debit and ATM cards.- History :...

.

EMV commands

ISO/IEC 7816-3 defines the transmission protocol between chip cards and readers. Using this protocol, data is exchanged in application protocol data units (APDUs). This comprises sending a command to a card, the card processing it, and sending a response. EMV uses the following commands:

• application block
• application unblock
• card block
• external authenticate (7816-4)
• generate application cryptogram
• get data (7816-4)
• get processing options
• internal authenticate (7816-4)
• PIN change / unblock
• read record (7816-4)
• select (7816-4)
• verify (7816-4)

Commands followed by "7816-4" are defined in ISO/IEC 7816-4 and are interindustry commands used for many chip card applications such as GSM SIM

Subscriber Identity Module

A subscriber identity module or subscriber identification module is an integrated circuit that securely stores the International Mobile Subscriber Identity and the related key used to identify and authenticate subscriber on mobile telephony devices .A SIM is held on a removable SIM card, which...

 cards.

EMV transaction flow

An EMV transaction has the following steps:

• Application selection
• Initiate application processing
• Read application data
• Processing restrictions
• Offline data authentication
• Cardholder verification
• Terminal risk management
• Terminal action analysis
• First card action analysis
• Online transaction authorisation (only carried out if required by the result of the previous steps; mandatory in ATMs)
• Second card action analysis
• Issuer script processing

Application selection

ISO/IEC 7816 defines a process for application selection. The intent of application selection was to allow cards to contain completely different applications, for example GSM and EMV. EMV however took application selection to be a way of identifying the type of product, so that all product issuers (Visa, MasterCard etc.) have to have their own application. The way application selection is prescribed in EMV is a frequent source of interoperability problems between cards and terminals. Book 1 of the EMV standard devotes 15 pages to describing the application selection process.

An application identifier (AID) is used to address an application in the card. An AID consists of a registered application provider identifier (RID) of five bytes, which is issued by the ISO/IEC 7816-5 registration authority. This is followed by a proprietary application identifier extension (PIX) which enables the application provider to differentiate between the different applications offered. The AID is printed on all EMV cardholder receipts.

Card scheme	RID	Product	PIX	AID
Visa	A000000003	Visa credit or debit	1010	A0000000031010
		Visa Electron Visa Electron Visa Electron is a debit card available across most of the world, with the exception of Canada, Australia, Ireland and the United States. The card was introduced by VISA in the 1980s and is a sister card to the Visa Debit card...	2010	A0000000032010
		V PAY V PAY V PAY is a type of debit card issued by Visa Europe. It provides a fully chip & PIN based card that may be co-branded with various national debit card schemes, such as the German Girocard or Italy's PagoBancomat. V PAY is designed to provide a SEPA-compliant card that enables usage across the whole...	2020	A0000000032020
		Plus	8010	A0000000038010
MasterCard MasterCard Mastercard Incorporated or MasterCard Worldwide is an American multinational financial services corporation with its headquarters in the MasterCard International Global Headquarters, Purchase, Harrison, New York, United States...	A000000004	MasterCard credit or debit	1010	A0000000041010
		MasterCard MasterCard Mastercard Incorporated or MasterCard Worldwide is an American multinational financial services corporation with its headquarters in the MasterCard International Global Headquarters, Purchase, Harrison, New York, United States...	9999	A0000000049999
		Maestro (debit card) Maestro (debit card) Maestro is a multi-national debit card service owned by MasterCard, and was founded in 1990. Maestro cards are obtained from associate banks and can be linked to the card holder's current account, or they can be prepaid cards...	3060	A0000000043060
		Cirrus (interbank network) Cirrus (interbank network) Cirrus is a worldwide interbank network operated by MasterCard Worldwide, and was founded in 1986. It links MasterCard, Maestro, Diners Club credit, debit and prepaid cards to a network of over 1,000,000 ATMs in 93 countries....	6000	A0000000046000
UK Domestic Maestro - Switch (debit card) Switch (debit card) Switch is a debit card in the United Kingdom. It is a sister to the Solo debit card.Switch was launched in 1988 by Midland Bank, National Westminster Bank and the Royal Bank of Scotland as a multifunction cheque guarantee and cash card. The brand was merged with Maestro, an international debit card...	A000000005	Maestro UK	0001	A0000000050001
		Solo	0002	A0000000050002
American Express American Express American Express Company or AmEx, is an American multinational financial services corporation headquartered in Three World Financial Center, Manhattan, New York City, New York, United States. Founded in 1850, it is one of the 30 components of the Dow Jones Industrial Average. The company is best...	A000000025	American Express	01	A00000002501
Discover Discover Card The Discover Card is a major credit card, issued primarily in the United States. It was originally introduced by Sears in 1985, and was part of Dean Witter, and then Morgan Stanley, until 2007, when Discover Financial Services became an independent company. Novus, a major processing center, used to...	A000000152	Discover	3010	A000000001523010
Interac Interac Interac Association is a Canadian organization linking enterprises that have proprietary networks so that they may communicate with each other for the purpose of exchanging electronic financial transactions. The Association was founded in 1984 as a cooperative venture between five financial...  (Canada)	A000000277	Debit card	1010	A0000002771010
JCB Japan Credit Bureau Japan Credit Bureau is a credit card company based in Tokyo, Japan. Its English name is .Founded in 1961, JCB established dominance over the Japanese credit card market when it purchased Osaka Credit Bureau in 1968, and its cards are now issued in 20 different countries...	A000000065	Japan Credit Bureau	10	A00000006510
LINK (UK) LINK (UK) LINK is a shared interbank network of automated teller machines operating in the United Kingdom. The network counts 37 member institutions, of which many are various banks and building societies issuing LINK ATM cards, and the remainder are independent ATM operators who do not issue cards...  ATM network	A000000029	ATM card	1010	A0000000291010
Dankort Dankort right|thumb|200px|The Dankort logoThe Dankort is a Danish debit card and is the national credit card of Denmark. Today it is usually combined with a VISA card so it can be used abroad.- History :...  (Denmark)	A000000121	Debit card	1010	A0000001211010
CoGeBan (Italy)	A000000141	PagoBANCOMAT	0001	A0000001410001
Banrisul (Brazil)	A000000154	Banricompras Debito	4442	A0000001544442
ZKA (Germany)	A000000359	Girocard Girocard Girocard is an interbank network and debit card service connecting virtually all German ATMs and banks. It is based on standards and agreements developed by Central Credit Committee....	1010028001	A0000003591010028001
CB card Groupement des Cartes Bancaires CB Groupement des Cartes Bancaires CB , also known as simply CB, is France's national interbank network, with over 46,000 ATMs and over 1 million EFTPOS acceptance points....  (France)	A000000042	CB card	1010	A0000000421010

Initiate application processing

The terminal sends the get processing options command to the card. When issuing this command, the terminal supplies the card with any data elements requested by the card in the processing options data objects list (PDOL). The PDOL (a list of tags and lengths of data elements) is optionally provided by the card to the terminal during application selection. The card responds with the application interchange profile (AIP), a list of functions to be performed in processing the transaction. The card also provides the application file locator (AFL), a list of files and records that the terminal needs to read from the card.

Read application data

Smart card

Smart card

A smart card, chip card, or integrated circuit card , is any pocket-sized card with embedded integrated circuits. A smart card or microprocessor cards contain volatile memory and microprocessor components. The card is made of plastic, generally polyvinyl chloride, but sometimes acrylonitrile...

s store data in files. The AFL contains the files that contain EMV data. These all need to be read using the read record command. EMV does not specify which files data is stored in, so all the files need to be read. Data in these files is stored in BER

Basic Encoding Rules

The Basic Encoding Rules is one of the encoding formats defined as part of the ASN.1 standard specified by the ITU in X.690.-Description:...

 TLV

Type-length-value

Within data communication protocols, optional information may be encoded as a type-length-value or TLV element inside of the protocol. TLV is also known as tag-length value....

 format. EMV defines tag values for all data used in card processing.

Processing restrictions

The purpose of the processing restrictions is to see if the card should be used. Three data elements read in the previous step are checked.

• Application version number
• Application usage control (This shows whether the card is only for domestic use etc.)
• Application effective/expiration dates checking

If any of these checks fail, the card is not necessarily declined. The terminal sets the appropriate bit in the terminal verification results

Terminal verification results

Terminal verification results is an EMV data object. The TVR is a series of bits set by the terminal reading an EMV card, based on logical tests . This data object is used in the terminal's decision whether to accept, decline or go on-line for a payment transaction. The format of the TVR is as...

 (TVR), the components of which form the basis of an accept/decline decision later in the transaction flow. This feature allows, for example, card issuers to permit their cardholders to continue to use expired cards after their expiry date, but for all transactions made with an expired card to be performed on-line.

Offline data authentication

Offline data authentication is a cryptographic check to validate the card using public-key cryptography

Public-key cryptography

Public-key cryptography refers to a cryptographic system requiring two separate keys, one to lock or encrypt the plaintext, and one to unlock or decrypt the cyphertext. Neither key will do both functions. One of these keys is published or public and the other is kept private...

. There are three different processes that can be undertaken depending on the card:

• Static data authentication (SDA) ensures data read from the card has been signed by the card issuer. This prevents modification of data, but does not prevent cloning.
• Dynamic data authentication (DDA) provides protection against modification of data and cloning.
• Combined DDA/generate application cryptogram (CDA) combines DDA with the generation of a card's application cryptogram to assure card validity. Support of CDA in devices may be needed, as this process has been implemented in specific markets. This process is not mandatory in terminals and can only be carried out where both card and terminal support it.

Cardholder verification

Cardholder verification is used to evaluate whether the person presenting the card is the legitimate cardholder. There are many cardholder verification methods (CVMs) supported in EMV. They are:

• Signature
• Offline plaintext PIN
• Offline enciphered PIN
• Offline plaintext PIN and signature
• Offline enciphered PIN and signature
• Online PIN
• No CVM required
• Fail CVM processing

The terminal uses a CVM list read from the card to determine the type of verification to be performed. The CVM list establishes a priority of CVMs to be used relative to the capabilities of the terminal. Different terminals support different CVMs. ATMs generally support online PIN. POS terminals vary in their support of CVM depending on their type and in which country they are located.

Terminal risk management

Terminal risk management is only performed in devices where there is a decision to be made whether a transaction should be authorised on-line or offline. If transactions are always carried out on-line (e.g. ATMs) or always off-line, this step can be missed.
Terminal risk management checks the transaction amount against a floor limit (above which transactions should be processed on-line). It is also possible to have a 1 in n online counter, and a check against a hot card list (which is only necessary for off-line transaction). If the result of any of these tests are positive, the terminal sets the appropriate bit in the terminal verification results

Terminal verification results

Terminal verification results is an EMV data object. The TVR is a series of bits set by the terminal reading an EMV card, based on logical tests . This data object is used in the terminal's decision whether to accept, decline or go on-line for a payment transaction. The format of the TVR is as...

 (TVR).

Terminal action analysis

The results of previous processing steps are used to determine whether a transaction should be approved offline, sent online for
authorization, or declined offline. This is done using a combination of Terminal action codes

Terminal action codes

Terminal action codes s are EMV data objects. EMV terminals store three terminal action codes:*Denial*Online*DefaultEach TAC contains a series of bits, set by the card issuer, which correspond to the bits in the Terminal verification results . This data object is used in the terminal's decision...

 (TACs) which are held in the terminal and Issuer action codes

Issuer action codes

Issuer action codes s are EMV data objects. EMV cards store three issuer action codes:*Denial*Online*DefaultEach IAC contains a series of bits, set by the card issuer, which correspond to the bits in the Terminal verification results . This data object is used in the terminal's decision whether to...

 (IACs) which are read from the card.

An online only device such as an ATM always attempts to go on-line with the authorization request, unless declined off-line due to Issuer action codes

Issuer action codes

Issuer action codes s are EMV data objects. EMV cards store three issuer action codes:*Denial*Online*DefaultEach IAC contains a series of bits, set by the card issuer, which correspond to the bits in the Terminal verification results . This data object is used in the terminal's decision whether to...

—Denial settings. During IAC—Denial and TAC—Denial processing, for an online only device, the only relevant Terminal verification results

Terminal verification results

Terminal verification results is an EMV data object. The TVR is a series of bits set by the terminal reading an EMV card, based on logical tests . This data object is used in the terminal's decision whether to accept, decline or go on-line for a payment transaction. The format of the TVR is as...

 bit is “Service not allowed”.

When an online only device performs IAC—Online and TAC—Online processing the only relevant TVR bit is “Transaction value exceeds the floor limit”. Because the floor limit is set to zero, the transaction should always go online and all other values in TAC—Online or IAC—Online are
irrelevant.

Online only devices do not need to perform IAC-default processing.

First card action analysis

One of the data objects read from the card in the Read application data stage is CDOL1 (Card Data object List). This object is a list of tags that the card wants to be sent to it to make a decision on whether to approve or decline a transaction (including transaction amount, but many other data objects too). The terminal sends this data and requests a cryptogram using the generate application cryptogram command. Depending on the terminals decision (offline, online, decline) the terminal requests one of the following cryptograms from the card:

• Transaction certificate (TC)—Offline approval
• Authorization Request Cryptogram (ARQC)—Online authorization
• Application Authentication Cryptogram (AAC)—Offline decline

This step gives the card the opportunity to accept the terminal's action analysis or to decline a transaction or force a transaction on-line. The card cannot return a TC when an ARQC has been asked for, but can return an ARQC when a TC has been asked for.

Online transaction authorisation

Transactions go online when a ARQC has been requested. The ARQC is sent in the authorisation message. The card generates the ARQC. Its format depends on the card application. EMV does not specify the contents of the ARQC. The ARQC created by the card application is a digital signature

Digital signature

A digital signature or digital signature scheme is a mathematical scheme for demonstrating the authenticity of a digital message or document. A valid digital signature gives a recipient reason to believe that the message was created by a known sender, and that it was not altered in transit...

 of the transaction details which can be checked in real time by the card issuer. This provides a strong cryptographic check that the card is genuine. The issuer responds to an authorisation request with a response code (accepting or declining the transaction), an authorisation response cryptogram (ARPC) and optionally an issuer script (a string of commands to be sent to the card).

Second card action analysis

CDOL2 (Card data object list) contains a list of tags that the card wants to be sent following online transaction authorisation (response code ARPC etc.). Even if for any reason the terminal could not go online (e.g. communication failure), the terminal should send this data to the card again using the generate authorisation cryptogram command. This lets the card know the issuer's response. The card application may then reset offline usage limits.

Issuer script processing

If a card issuer wants to update a card post issuance it can send commands to the card using issuer script processing. Issuer scripts are encrypted between the card and the issuer, so are meaningless to the terminal. Issuer script can be used to block cards, or change card parameters.

Control of the EMV standard

The first version of EMV standard was published in 1995. Now the standard is defined and managed by the public corporation EMVCo LLC.The current members of EMVCo are JCB International, American Express, MasterCard Worldwide, and Visa, Inc. Each of these organizations owns one quarter of EMVCo and has representatives in the EMVCo organization and EMVCo working groups.

Recognition of compliance with the EMV standard (i.e. device certification) is issued by EMVCo following submission of results of testing performed by an accredited testing house.

EMV Compliance testing has two levels: EMV Level 1, which covers physical, electrical and transport level interfaces, and EMV Level 2, which covers payment application selection and credit financial transaction processing.

After passing common EMVCo tests, the software must be certified by payment brands to comply with proprietary EMV implementations such as VISA VSDC, American Express AEIPS, MasterCard MChip, JCB JSmart, or EMV-compliant implementations of non-EMVCo members such as LINK in the UK, or Interac in Canada.

The EMVCo standards have been integrated into the broader electronic payment security standards being developed by the Secure POS Vendor Alliance, with a specific effort to develop a common interpretation of EMVCo's place relative to, and interactions with, other existing security standards, such as PCI-DSS.

List of EMV documents and standards

Since version 4.0, the official EMV standard documents, that define all the components in an EMV payment system, are published as four "books" and some additional documents:

• Book 1 - Application Independent ICC to Terminal Interface Requirements
• Book 2 - Security and Key Management
• Book 3 - Application Specification
• Book 4 - Cardholder, Attendant, and Acquirer Interface Requirements
• Common Payment Application Specification
• EMV Card Personalisation Specification

Versions

First EMV standard came into view in 1995 as EMV 2.0. This was upgraded to EMV 3.0 in 1996 (sometimes referred to as EMV '96) with later amendments to EMV 3.1.1 in 1998. This was further amended to version 4.0 in December 2000 (sometimes referred to as EMV 2000).

• Version 4.0 became effective in June 2004
• Version 4.1 became effective in June 2007
• Version 4.2 is in effect since June 2008

Vulnerabilities

The vulnerabilities described below are vulnerabilities of card payments, and not EMV per se. EMV has many security options and has been designed to allow for changes in cryptographic techniques and key lengths without a change to the standard. The cards schemes (VISA, MasterCard, Amex) enforce some options while others are left to the card issuers and terminal deployers to decide on, based on their own risk assessments. Claims that EMV or even chip and pin have been broken refer to implementations and not a general weakness in the standard.

Examples

• The Guardian, 5 September 2005, "Fraudsters show how to beat chip and pin"
• BBC News Online
  BBC News Online
  BBC News Online is the website of BBC News, the division of the BBC responsible for newsgathering and production. The website is the most popular news website in the United Kingdom and forms a major part of BBC Online ....
  
  , Poor print exposing Pin numbers 25 Aug 2005
• The Guardian
  The Guardian
  The Guardian, formerly known as The Manchester Guardian , is a British national daily newspaper in the Berliner format...
  
  , 27 October 2004, "Safety in numbers? Not likely"
• Chip and SPIN ! (critical website)
• The Inquirer: Does he take PINs with his chips? (critical editorial)
• Attack methods against Chip & PIN (EMV) (academic research site)
• New Law Journal: statistical and legal analysis of claimed card fraud, 16 October 2009

Decreased security for PINs

A PIN alone obtained by an unauthorised person is not enough for fraudulent card use. A card alone without PIN can be used in a merchant's terminal which allows authorisation by magnetic strip or chip without entering the PIN—such terminals are increasingly rare in countries using EMV—but not in an ATM until 2010. A PIN can, however, be used in conjunction with a cloned magnetic strip or a card which is stolen or misused. Consequently criminals attempt to obtain both card and PIN. A card can be used in a PIN terminal without entering a valid PIN using malicious special hardware announced by researchers in February 2010; The method relies on man-in-the-middle (MITM) equipment intercepting the PIN submission from the terminal and simply returning 90 00 (no error) - however, in cards that return a different response if the PIN has not been successfully submitted, this acts as a PIN bypass transaction and a high value purchase will thus have a high probability of being rejected by the issuer. Unfortunately, this itself is dependent on the security level of the transaction; only a dynamic transaction (like DDA) is assured to result in different data being sent to the issuer (technically, a card can also be programmed to provide different SDA data if a PIN submission was not successful) in any case, if the transaction is offline (and not using SDA), the transaction may only continue if the MITM equipment fakes a response since a card will refuse to give an offline response without a PIN. Thus if the terminal performs signature verification, the transaction will completely fail at that point unless the attacker has obtained the issuer's private signing keys (unlikely as they would then be able to arbitrarily manufacture fraudulent cards) - it is not known if this vulnerability has been exploited by criminals.

Direct observation

It is always possible to find a PIN by watching it being typed in ("shoulder surfing

Shoulder surfing (computer security)

In computer security, shoulder surfing refers to using direct observation techniques, such as looking over someone's shoulder, to get information...

"). Before Chip and PIN this could happen at an ATM in a bank or other relatively secure area, or in a shop accepting PIN codes without reading a chip. The use of PINs by all merchants accepting cards has increased the opportunities to observe PINs; the environment is more open and public, and more care is needed to shield the PIN when typing it in to a legitimate terminal. PINs obtained in this way are only of use if the card is then stolen, or misused (e.g., by a family member).

Indirect observation

Security cameras at the cash register intended to deter shoplifters and thieves may compromise the security of Chip and PIN by recording customers entering PINs if recordings are not dealt with securely. Again, fraudulent use is possible only in conjunction with a stolen card or cloned magnetic stripe.

Hidden pinhole camera

Pinhole camera

A pinhole camera is a simple camera without a lens and with a single small aperture – effectively a light-proof box with a small hole in one side. Light from a scene passes through this single point and projects an inverted image on the opposite side of the box...

 on cash machines are sometimes used by criminals to harvest PINs, usually in conjunction with card theft. For example, there have been instances where a customer is told by a "friendly bystander" that they have dropped £5 after they have inserted the card and entered the PIN; when they bend down to pick it up, the card is stolen from the machine's slot and used with the PIN obtained by pinhole camera or binocular observation from a distance.

Counterfeit PIN pads are sometimes used to log PINs and stripe details in systems which swipe the magnetic stripe, allowing a fraudster to clone the card and know the PIN for use in ATMs that allow magnetic stripe authorisation. This would not work in countries (including the UK) where all ATMs require authorisation by chip rather than magnetic stripe or where the ATM informs the issuer the transaction is being attempted by magnetic stripe due to having a chip reader and not detecting a chip.

Opportunities to harvest PINs and clone magnetic stripes

In addition to the track-two data on the magnetic stripe, EMV cards generally have identical data encoded on the chip which is read as part of the normal EMV transaction process. If an EMV reader is compromised to the extent that the conversation between the card and the terminal is intercepted, then the attacker may be able to recover both the track-two data and the PIN, allowing construction of a magnetic stripe card

Magnetic stripe card

A magnetic stripe card is a type of card capable of storing data by modifying the magnetism of tiny iron-based magnetic particles on a band of magnetic material on the card...

 which, while not usable in a chip and PIN terminal, can be used, for example, in terminal devices which permit fallback to magstripe processing for foreign customers without chip cards, and defective cards. This attack is possible only where (a) the offline PIN is presented in plaintext by the PIN entry device to the card, where (b) magstripe fallback is permitted by the card issuer and (c) where geographic and behavioural checking may not be carried out by the card issuer.

It was claimed that changes specified to the protocol (specifying different card verification values between the Chip and Magnetic Stripe – the iCVV) rendered this attack ineffective. APACS (the UK payments association) stated that such measures would be in place from January 2008, although tests on cards in February 2008 indicated this may have been delayed. However, there was a very large scale and successful attack which went on for 9 months in 2008 (see below).

Within the UK and Ireland, plaintext offline PIN is the standard mode of operation and cards which support encrypted offline PIN are rare, despite being common in other countries. Permitting magstripe fallback transactions to take place is a risk known to card issuers; it is usually permitted when fraud levels are low, in order to increase profits and avoid antagonising cardholders by allowing transactions which could not otherwise have taken place. When magstripe fallback fraud levels grow, this processing option is disallowed.

Geographic and behavioural fraud analysis tools are in use by many card issuers to track and decline transactions considered suspicious—for example, an EMV card-present transaction at a UK ATM, followed hours later by a magstripe fallback transaction in the Far East.

Successful attacks
Conversation-capturing is the form of attack which was reported to have taken place against Shell

Royal Dutch Shell

Royal Dutch Shell plc , commonly known as Shell, is a global oil and gas company headquartered in The Hague, Netherlands and with its registered office in London, United Kingdom. It is the fifth-largest company in the world according to a composite measure by Forbes magazine and one of the six...

 terminals in May 2006, when they were forced to disable all EMV authentication in their petrol stations after more than £1 million was stolen from customers.

In October 2008 it was reported that hundreds of Chip and PIN readers for use in Britain, Ireland, the Netherlands, Denmark, and Belgium had been expertly tampered with in China during or shortly after manufacture so that details and PINs of credit and debit cards were sent during the 9 months before over mobile phone

Mobile phone

A mobile phone is a device which can make and receive telephone calls over a radio link whilst moving around a wide geographic area. It does so by connecting to a cellular network provided by a mobile network operator...

 networks to criminals in Lahore

Lahore

Lahore is the capital of the Pakistani province of Punjab and the second largest city in the country. With a rich and fabulous history dating back to over a thousand years ago, Lahore is no doubt Pakistan's cultural capital. One of the most densely populated cities in the world, Lahore remains a...

, Pakistan

Pakistan

Pakistan , officially the Islamic Republic of Pakistan is a sovereign state in South Asia. It has a coastline along the Arabian Sea and the Gulf of Oman in the south and is bordered by Afghanistan and Iran in the west, India in the east and China in the far northeast. In the north, Tajikistan...

. US National Counterintelligence Executive Joel Brenner said "Previously only a nation state's intelligence service would have been capable of pulling off this type of operation. It's scary". Data were typically used a couple of months after the card transactions to make it harder for investigators to pin down the vulnerability. After the fraud was discovered it was found that tampered-with terminals could be identified as the additional circuitry increased their weight by about 100 g. Tens of millions of pounds sterling are believed to have been stolen. This vulnerability spurred efforts to implement better control of electronic POS devices over their entire life cycle, a practice endorsed by electronic payment security standards like those being developed by the SPVA.

Demonstration of PIN harvesting and stripe cloning
Cambridge University researchers Steven Murdoch

Steven Murdoch

Steven J. Murdoch is a security researcher at the University of Cambridge Computer Laboratory. His research covers privacy-enhancing technology, Internet censorship, and anonymous communication, in particular Tor. He is also known for discovering several vulnerabilities in the EMV bank chipcard...

 and Saar Drimer demonstrated in a February 2008 BBC Newsnight

Newsnight

Newsnight is a BBC Television current affairs programme noted for its in-depth analysis and often robust cross-examination of senior politicians. Jeremy Paxman has been its main presenter for over two decades....

 programme one example attack, to illustrate that Chip and PIN is not secure enough to justify passing the liability to prove fraud from the banks onto customers. The Cambridge University exploit allowed the experimenters to obtain both card data to create a magnetic stripe and the PIN.

APACS, the UK payments association, disagreed with the majority of the report, saying: "The types of attack on PIN entry devices detailed in this report are difficult to undertake and not currently economically viable for a fraudster to carry out." They also said that changes to the protocol (specifying different card verification values between the Chip and Magnetic Stripe – the iCVV) would make this attack ineffective from January 2008. The fraud reported in October 2008 to have operated for 9 months (see above) was probably in operation at the time, but was not discovered for many months.

2010: Hidden hardware disables PIN checking on stolen card

On 11 February 2010 Murdoch and Drimer's team at Cambridge University announced that they had found "a flaw in chip and PIN so serious they think it shows that the whole system needs a re-write" that was "so simple that it shocked them". A stolen card is connected to an electronic circuit and to a fake card which is inserted into the terminal ("man-in-the-middle attack

Man-in-the-middle attack

In cryptography, the man-in-the-middle attack , bucket-brigade attack, or sometimes Janus attack, is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other...

"). Any 4 digits are typed in and accepted as a valid PIN. A team from the BBC's Newsnight

Newsnight

Newsnight is a BBC Television current affairs programme noted for its in-depth analysis and often robust cross-examination of senior politicians. Jeremy Paxman has been its main presenter for over two decades....

 programme visited a Cambridge University cafeteria (with permission) with the system, and were able to pay using their own cards (a thief would use stolen cards) connected to the circuit, inserting a fake card and typing in "0000" as the PIN. The transactions were registered as normal, and were not picked up by banks' security systems. A member of the research team said "Even small-scale criminal systems have better equipment than we have. The amount of technical sophistication needed to carry out this attack is really quite low". The announcement of the vulnerability said "The expertise that is required is not high (undergraduate level electronics) ... We dispute the assertion by the banking industry that criminals are not sophisticated enough, because they have already demonstrated a far higher level of skill than is necessary for this attack in their miniaturized PIN entry device skimmers." It is not known if this vulnerability has been exploited.

EMVCo disagreed and published a response saying that, while such an attack might be theoretically possible, it would be extremely difficult and expensive to carry out successfully, that current compensating controls are likely to detect or limit the fraud, and that the possible financial gain from the attack is minimal while the risk of a declined transaction or exposure of the fraudster is significant.

When approached for comment, several banks each said that this was an industry-wide issue, and referred the Newsnight team to the banking trade association for further comment. According to Phil Jones of the Consumers' Association

Consumers' Association

The Consumers' Association is the umbrella organisation that houses the trading arm Which? Ltd. The Consumers' Association is a charity, registered in England and Wales No 296072. Which? Ltd is its wholly owned trading subsidiary....

, chip and PIN has helped to bring down instances of card crime, but many cases remain unexplained "What we do know is that we do have cases that are brought forward from individuals which seem quite persuasive".

Because the submission of the PIN is suppressed, this is the exact equivalent of a merchant performing a PIN bypass transaction, such transactions will never succeed offline as a card will never generate an offline authorisation without a successful PIN entry. As a result of this, the transaction ARQC must be submitted online to the issuer who will know that the ARQC was generated without a successful PIN submission (since this information is included in the encrypted ARQC) and hence would be very likely to decline the transaction if it were for a high value, out of character or otherwise outside of the typical risk management parameters set by the issuer.

Originally bank customers had to prove that they had not been negligent with their PIN before getting redress, but UK regulations in force from 1 November 2009 placed the onus firmly on the banks to prove that a customer has been negligent in any dispute, with the customer given 13 months to make a claim. Murdoch said that "[the banks] should look back at previous transactions where the customer said their PIN had not been used and the bank record showed it has, and consider refunding these customers because it could be they are victim of this type of fraud".

Drimer and Murdoch published a paper with Ross Anderson on the closely related topic of "Failures of Tamper-Proofing in PIN Entry Devices" in IEEE Security and Privacy, November/December 2009.

External links

• EMVCo, the organisation responsible for developing and maintaining the standard
• Chip and PIN, site run by the Association For Payment Clearing Services (APACS
  APACS
  The UK Payments Administration Ltd is a United Kingdom trade organisation that brings together all payment systems organisations and gives banks, building societies and card issuers a forum where they can work together on non-competitive issues...
  
  ), the UK's central coordinating authority for the implementation of EMV
• Chip and SPIN, discussion of some security aspects of EMV, from members of the University of Cambridge
  University of Cambridge
  The University of Cambridge is a public research university located in Cambridge, United Kingdom. It is the second-oldest university in both the United Kingdom and the English-speaking world , and the seventh-oldest globally...
  
  Security Group
• What is EMV?, a technical guide to EMV transactions, complete with a glossary of terms a flowchart showing the stages of a typical transaction