Jump to content

EMV

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by SporkBot (talk | contribs) at 04:02, 11 May 2015 (Repair duplicate template arguments). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

File:American Express EMV card.jpg
An American Express charge card with EMV chip

EMV, which stands for Europay, MasterCard, and Visa, is a global standard for inter-operation of integrated circuit cards (IC cards or "chip cards") and IC card capable point of sale (POS) terminals and automated teller machines (ATMs), for authenticating credit and debit card transactions.

EMV is a joint effort initially conceived by Europay, MasterCard and Visa to ensure the security and global interoperability of chip-based payment cards. Europay International SA was absorbed into MasterCard in 2002. The standard is now defined and managed by the public corporation EMVCo LLC. JCB (formerly Japan Credit Bureau) joined the organization in December 2004, and American Express joined in February 2009. China UnionPay was announced as member in May 2013,[1] and Discover joined the corporation in September 2013.[2] The EMVCo members MasterCard, Visa, JCB, American Express, China UnionPay, and Discover have an equal 1/6 interest in the standards body.[3] IC card systems based on the EMV specification are being phased in across the world, under names such as "IC Credit" and "Chip and PIN".

The EMV standards define the interaction at the physical, electrical, data and application levels between IC cards and IC card processing devices for financial transactions. There are standards based on ISO/IEC 7816 for contact cards, and standards based on ISO/IEC 14443 for contactless cards (PayPass, PayWave, ExpressPay).

The first standard for payment cards was the Carte Bancaire M4 from Bull-CP8 deployed in France in 1986 followed by the B4B0' (compatible with the M4) deployed in 1989. Geldkarte in Germany also predates EMV. EMV was designed to allow cards and terminals to be backwardly compatible with these standards. France has since migrated all its card and terminal infrastructure to EMV.

The most widely known chip card implementations of EMV standard are:

  • VSDC – Visa
  • M/Chip – MasterCard
  • AEIPS – American Express
  • J Smart – JCB
  • D-PAS – Discover/Diners Club International.

Visa and MasterCard have also developed standards for using EMV cards in devices to support card-not-present transactions over the telephone and Internet. MasterCard has the Chip Authentication Program (CAP) for secure e-commerce. Its implementation is known as EMV-CAP and supports a number of modes. Visa has the Dynamic Passcode Authentication (DPA) scheme, which is their implementation of CAP using different default values.

In February 2010, computer scientists from Cambridge University demonstrated that an implementation of EMV PIN entry is vulnerable to a man-in-the-middle attack; however, the way PINs are processed depends on the capabilities of the card and the terminal.

Differences and benefits of EMV

The purpose and goal of the EMV standard is to specify interoperability between EMV-compliant IC cards and EMV-compliant credit card payment terminals throughout the world. There are two major benefits to moving to smart-card-based credit card payment systems: improved security (with associated fraud reduction), and the possibility for finer control of "offline" credit-card transaction approvals. One of the original goals of EMV was to allow for multiple applications to be held on a card: for a credit and debit card application or an e-purse. With current processing regulations in the USA, new issue debit cards contain two applications -- a card association (Visa, MasterCard etc.) application, and a common debit application. The common debit application ID is somewhat of a misnomer as each "common" debit application actually uses the resident card association application.

EMV chip card transactions improve security against fraud compared to magnetic stripe card transactions that rely on the holder's signature and visual inspection of the card to check for features such as hologram. The use of a PIN and cryptographic algorithms such as Triple-DES, RSA and SHA provide authentication of the card to the processing terminal and the card issuer's host system. The processing time is comparable to online transactions, in which communications delay accounts for the majority of the time, while cryptographic operations take comparatively little time. The supposed increased protection from fraud has allowed banks and credit card issuers to push through a 'liability shift' such that merchants are now liable (as from 1 January 2005 in the EU region) for any fraud that results from transactions on systems that are not EMV capable.[4]

Although not the only possible method, the majority of implementations of EMV cards and terminals confirm the identity of the cardholder by requiring the entry of a personal identification number (PIN) rather than signing a paper receipt. Whether or not PIN authentication takes place depends upon the capabilities of the terminal and programming of the card. For more details of this (specifically, the system being implemented in the UK) see Chip and PIN.

Commands

ISO/IEC 7816-3 defines the transmission protocol between chip cards and readers. Using this protocol, data is exchanged in application protocol data units (APDUs). This comprises sending a command to a card, the card processing it, and sending a response. EMV uses the following commands:

  • application block
  • application unblock
  • card block
  • external authenticate (7816-4)
  • generate application cryptogram
  • get data (7816-4)
  • get processing options
  • internal authenticate (7816-4)
  • PIN change / unblock
  • read record (7816-4)
  • select (7816-4)
  • verify (7816-4).

Commands followed by "7816-4" are defined in ISO/IEC 7816-4 and are interindustry commands used for many chip card applications such as GSM SIM cards.

Transaction flow

An EMV transaction has the following steps:[5]

Application selection

ISO/IEC 7816 defines a process for application selection. The intent of application selection was to allow cards to contain completely different applications, for example GSM and EMV. EMV however took application selection to be a way of identifying the type of product, so that all product issuers (Visa, MasterCard, etc.) have to have their own application. The way application selection as prescribed in EMV is a frequent source of interoperability problems between cards and terminals. Book 1 of the EMV standard devotes 15 pages to describing the application selection process.

An application identifier (AID) is used to address an application in the card. An AID consists of a registered application provider identifier (RID) of five bytes, which is issued by the ISO/IEC 7816-5 registration authority. This is followed by a proprietary application identifier extension (PIX), which enables the application provider to differentiate among the different applications offered. The AID is printed on all EMV cardholder receipts.

Initiate application processing

The terminal sends the get processing options command to the card. When issuing this command, the terminal supplies the card with any data elements requested by the card in the processing options data objects list (PDOL). The PDOL (a list of tags and lengths of data elements) is optionally provided by the card to the terminal during application selection. The card responds with the application interchange profile (AIP), a list of functions to be performed in processing the transaction. The card also provides the application file locator (AFL), a list of files and records that the terminal needs to read from the card.

Read application data

Smart cards store data in files. The AFL contains the files that contain EMV data. These all need to be read using the read record command. EMV does not specify which files data is stored in, so all the files need to be read. Data in these files is stored in BER TLV format. EMV defines tag values for all data used in card processing.

Processing restrictions

The purpose of the processing restrictions is to see if the card should be used. Three data elements read in the previous step are checked.

  • Application version number
  • Application usage control (This shows whether the card is only for domestic use, etc.)
  • Application effective/expiration dates checking.

If any of these checks fails, the card is not necessarily declined. The terminal sets the appropriate bit in the terminal verification results (TVR), the components of which form the basis of an accept/decline decision later in the transaction flow. This feature allows, for example, card issuers to permit their cardholders to continue to use expired cards after their expiry date, but for all transactions made with an expired card to be performed on-line.

Offline data authentication

Offline data authentication is a cryptographic check to validate the card using public-key cryptography. There are three different processes that can be undertaken depending on the card:

  • Static data authentication (SDA) ensures data read from the card has been signed by the card issuer. This prevents modification of data, but does not prevent cloning.
  • Dynamic data authentication (DDA) provides protection against modification of data and cloning.
  • Combined DDA/generate application cryptogram (CDA) combines DDA with the generation of a card's application cryptogram to assure card validity. Support of CDA in devices may be needed, as this process has been implemented in specific markets. This process is not mandatory in terminals and can only be carried out where both card and terminal support it.

Cardholder verification

Cardholder verification is used to evaluate whether the person presenting the card is the legitimate cardholder. There are many cardholder verification methods (CVMs) supported in EMV. They are:

  • Signature
  • Offline plaintext PIN
  • Offline enciphered PIN
  • Offline plaintext PIN and signature
  • Offline enciphered PIN and signature
  • Online PIN
  • No CVM required
  • Fail CVM processing.

The terminal uses a CVM list read from the card to determine the type of verification to be performed. The CVM list establishes a priority of CVMs to be used relative to the capabilities of the terminal. Different terminals support different CVMs. ATMs generally support online PIN. POS terminals vary in their support of CVM depending on their type and in which country they are located.

Chip and PIN vs. Chip and signature

According to issuer preference, some EMV cards are "chip and PIN" cards that require the customer to supply a four-to-six-digit personal identification number (PIN) when making a purchase at PIN-capable terminals. The chips in these cards feature "PIN" ranked first in the list of possible cardholder verification methods (CVM), but with signature allowed as a fall-back option (or even no verification at unattended terminals).

Other EMV cards are either signature-only or prefer signature over PIN in their CVM list (i.e., signature at the POS, but PIN at unattended terminals or ATMs). These are often called "chip and signature" cards.[6]

Signature-only cards will not work at points of sale that allow no CVM other than PIN, such as some unattended ticket kiosks in Europe,[6] whereas signature-preferring cards might work. Attended POS which are staffed by merchant personnel are required by the credit card agreement to accept magnetic stripe cards as well as chip and signature cards.[6] Chip-and-PIN cards have not been adopted in the US as of June 2014 for a variety of reasons, including lack of PIN management features in ATMs.[6]

Terminal risk management

Terminal risk management is only performed in devices where there is a decision to be made whether a transaction should be authorised on-line or offline. If transactions are always carried out on-line (e.g., ATMs) or always off-line, this step can be missed. Terminal risk management checks the transaction amount against an offline ceiling limit (above which transactions should be processed on-line). It is also possible to have a 1 in an online counter, and a check against a hot card list (which is only necessary for off-line transactions). If the result of any of these tests is positive, the terminal sets the appropriate bit in the terminal verification results (TVR).

Terminal action analysis

The results of previous processing steps are used to determine whether a transaction should be approved offline, sent online for authorization, or declined offline. This is done using a combination of Terminal action codes (TACs) held in the terminal and Issuer action codes (IACs) read from the card.

An online-only device such as an ATM always attempts to go on-line with the authorization request, unless declined off-line due to Issuer action codes—Denial settings. During IAC—Denial and TAC—Denial processing, for an online only device, the only relevant Terminal verification results bit is "Service not allowed".

When an online-only device performs IAC—Online and TAC—Online processing the only relevant TVR bit is "Transaction value exceeds the floor limit". Because the floor limit is set to zero, the transaction should always go online and all other values in TAC—Online or IAC—Online are irrelevant.

Online-only devices do not need to perform IAC-default processing.

First card action analysis

One of the data objects read from the card in the Read application data stage is CDOL1 (Card Data object List). This object is a list of tags that the card wants to be sent to it to make a decision on whether to approve or decline a transaction (including transaction amount, but many other data objects too). The terminal sends this data and requests a cryptogram using the generate application cryptogram command. Depending on the terminal′s decision (offline, online, decline), the terminal requests one of the following cryptograms from the card:

  • Transaction certificate (TC)—Offline approval
  • Authorization Request Cryptogram (ARQC)—Online authorization
  • Application Authentication Cryptogram (AAC)—Offline decline.

This step gives the card the opportunity to accept the terminal's action analysis or to decline a transaction or force a transaction on-line. The card cannot return a TC when an ARQC has been asked for, but can return an ARQC when a TC has been asked for.

Online transaction authorization

Transactions go online when an ARQC has been requested. The ARQC is sent in the authorisation message. The card generates the ARQC. Its format depends on the card application. EMV does not specify the contents of the ARQC. The ARQC created by the card application is a digital signature of the transaction details which can be checked in real time by the card issuer. This provides a strong cryptographic check that the card is genuine. The issuer responds to an authorisation request with a response code (accepting or declining the transaction), an authorisation response cryptogram (ARPC) and optionally an issuer script (a string of commands to be sent to the card).

Second card action analysis

CDOL2 (Card data object list) contains a list of tags that the card wants to be sent after online transaction authorisation (response code ARPC, etc.). Even if for any reason the terminal could not go online (e.g., communication failure), the terminal should send this data to the card again using the generate authorisation cryptogram command. This lets the card know the issuer's response. The card application may then reset offline usage limits.

Issuer script processing

If a card issuer wants to update a card post issuance it can send commands to the card using issuer script processing. Issuer scripts are encrypted between the card and the issuer, so are meaningless to the terminal. Issuer script can be used to block cards, or change card parameters.

Control of the EMV standard

The first version of EMV standard was published in 1995. Now the standard is defined and managed by the privately owned corporation EMVCo LLC. The current members of EMVCo are JCB International, American Express, MasterCard Worldwide, China UnionPay, Discover Financial Services and Visa, Inc. Each of these organizations owns an equal share of EMVCo and has representatives in the EMVCo organization and EMVCo working groups.

Recognition of compliance with the EMV standard (i.e., device certification) is issued by EMVCo following submission of results of testing performed by an accredited testing house.

EMV Compliance testing has two levels: EMV Level 1, which covers physical, electrical and transport level interfaces, and EMV Level 2, which covers payment application selection and credit financial transaction processing.

After passing common EMVCo tests, the software must be certified by payment brands to comply with proprietary EMV implementations such as Visa VSDC, American Express AEIPS, MasterCard MChip, JCB JSmart, or EMV-compliant implementations of non-EMVCo members such as LINK in the UK, or Interac in Canada.

The EMVCo standards have been integrated into the broader electronic payment security standards being developed by the Secure POS Vendor Alliance, with a specific effort to develop a common interpretation of EMVCo's place relative to, and interactions with, other existing security standards, such as PCI-DSS.[7]

List of EMV documents and standards

Since version 4.0, the official EMV standard documents that define all the components in an EMV payment system are published as four "books" and some additional documents:

Versions

First EMV standard came into view in 1995 as EMV 2.0. This was upgraded to EMV 3.0 in 1996 (sometimes referred to as EMV '96) with later amendments to EMV 3.1.1 in 1998. This was further amended to version 4.0 in December 2000 (sometimes referred to as EMV 2000).

  • Version 4.0 became effective in June 2004
  • Version 4.1 became effective in June 2007
  • Version 4.2 is in effect since June 2008
  • Version 4.3 is in effect since November 2011.[8]

Vulnerabilities

Opportunities to harvest PINs and clone magnetic stripes

In addition to the track-two data on the magnetic stripe, EMV cards generally have identical data encoded on the chip, which is read as part of the normal EMV transaction process. If an EMV reader is compromised to the extent that the conversation between the card and the terminal is intercepted, then the attacker may be able to recover both the track-two data and the PIN, allowing construction of a magnetic stripe card, which, while not usable in a chip and PIN terminal, can be used, for example, in terminal devices that permit fallback to magstripe processing for foreign customers without chip cards, and defective cards. This attack is possible only where (a) the offline PIN is presented in plaintext by the PIN entry device to the card, where (b) magstripe fallback is permitted by the card issuer and (c) where geographic and behavioural checking may not be carried out by the card issuer. It was claimed[weasel words] that changes specified to the protocol (specifying different card verification values between the Chip and Magnetic Stripe – the iCVV) rendered this attack ineffective. APACS (the UK payments association) stated that such measures would be in place from January 2008, although tests on cards in February 2008 indicated this may have been delayed.[9]

Successful attacks

Conversation capturing is the form of attack that was reported to have taken place against Shell terminals in May 2006, when they were forced to disable all EMV authentication in their petrol stations after more than £1 million was stolen from customers.[10]

In October 2008 it was reported that hundreds of EMV card readers for use in Britain, Ireland, the Netherlands, Denmark, and Belgium had been expertly tampered with in China during or shortly after manufacture so that details and PINs of credit and debit cards were sent during the 9 months before over mobile phone networks to criminals in Lahore, Pakistan. US National Counterintelligence Executive Joel Brenner said, "Previously only a nation state's intelligence service would have been capable of pulling off this type of operation. It's scary." Data were typically used a couple of months after the card transactions to make it harder for investigators to pin down the vulnerability. After the fraud was discovered it was found that tampered-with terminals could be identified as the additional circuitry increased their weight by about 100 g. Tens of millions of pounds sterling are believed to have been stolen.[11] This vulnerability spurred efforts to implement better control of electronic POS devices over their entire life cycle, a practice endorsed by electronic payment security standards like those being developed by the Secure POS Vendor Alliance (SPVA).[12]

Demonstration of PIN harvesting and stripe cloning

Cambridge University researchers Steven Murdoch and Saar Drimer demonstrated in a February 2008 BBC Newsnight programme one example attack, to illustrate that Chip and PIN is not secure enough to justify passing the liability to prove fraud from the banks onto customers.[13][14] The Cambridge University exploit allowed the experimenters to obtain both card data to create a magnetic stripe and the PIN.

APACS, the UK payments association, disagreed with the majority of the report, saying: "The types of attack on PIN entry devices detailed in this report are difficult to undertake and not currently economically viable for a fraudster to carry out."[15] They also said that changes to the protocol (specifying different card verification values between the Chip and Magnetic Stripe – the iCVV) would make this attack ineffective from January 2008. The fraud reported in October 2008 to have operated for 9 months (see above) was probably in operation at the time, but was not discovered for many months.

2010: Hidden hardware disables PIN checking on stolen card

Wikinews has related news:

On 11 February 2010 Murdoch and Drimer's team at Cambridge University announced that they had found "a flaw in chip and PIN so serious they think it shows that the whole system needs a re-write" that was "so simple that it shocked them".[16][17] A stolen card is connected to an electronic circuit and to a fake card that is inserted into the terminal ("man-in-the-middle attack"). Any 4 digits are typed in and accepted as a valid PIN. A team from the BBC's Newsnight programme visited a Cambridge University cafeteria (with permission) with the system, and were able to pay using their own cards (a thief would use stolen cards) connected to the circuit, inserting a fake card and typing in "0000" as the PIN. The transactions were registered as normal, and were not picked up by banks' security systems. A member of the research team said, "Even small-scale criminal systems have better equipment than we have. The amount of technical sophistication needed to carry out this attack is really quite low." The announcement of the vulnerability said, "The expertise that is required is not high (undergraduate level electronics) ... We dispute the assertion by the banking industry that criminals are not sophisticated enough, because they have already demonstrated a far higher level of skill than is necessary for this attack in their miniaturized PIN entry device skimmers." It is not known if this vulnerability has been exploited.

EMVCo disagreed and published a response saying that, while such an attack might be theoretically possible, it would be extremely difficult and expensive to carry out successfully, that current compensating controls are likely to detect or limit the fraud, and that the possible financial gain from the attack is minimal while the risk of a declined transaction or exposure of the fraudster is significant.[18]

When approached for comment, several banks[which?] each said that this was an industry-wide issue, and referred the Newsnight team to the banking trade association for further comment. According to Phil Jones of the Consumers' Association, chip and PIN has helped to bring down instances of card crime, but many cases remain unexplained "What we do know is that we do have cases that are brought forward from individuals which seem quite persuasive."

Because the submission of the PIN is suppressed, this is the exact equivalent of a merchant performing a PIN bypass transaction, such transactions will never succeed offline as a card will never generate an offline authorisation without a successful PIN entry. As a result of this, the transaction ARQC must be submitted online to the issuer who will know that the ARQC was generated without a successful PIN submission (since this information is included in the encrypted ARQC) and hence would be very likely to decline the transaction if it were for a high value, out of character or otherwise outside of the typical risk management parameters set by the issuer.

Originally bank customers had to prove that they had not been negligent with their PIN before getting redress, but UK regulations in force from 1 November 2009 placed the onus firmly on the banks to prove that a customer has been negligent in any dispute, with the customer given 13 months to make a claim.[19] Murdoch said that "[the banks] should look back at previous transactions where the customer said their PIN had not been used and the bank record showed it has, and consider refunding these customers because it could be they are victim of this type of fraud."

2011: CVM downgrade allows arbitrary PIN harvest

At the CanSecWest conference in March 2011, Andrea Barisani and Daniele Bianco presented research uncovering a vulnerability in EMV that would allow arbitrary PIN harvesting despite the Cardholder verification configuration of the card, even when the supported CVMs data is signed.[20]

The PIN harvesting can be performed with a chip skimmer. In essence, a CVM list that has been modified to downgrade the CVM to Offline PIN is still honoured by POS terminals despite its signature being invalid.[21]

Implementation

In many countries of the world, debit card and/or credit card payment networks have implemented liability shifts. Normally, the card issuer is liable for fraudulent transactions. However, after a liability shift is implemented, if the ATM or merchant's point of sale terminal does not support EMV, then the ATM owner or merchant will be liable for the fraudulent transaction.

Africa

  • MasterCard's liability shift among countries within this region took place on 1 January 2006.[22] By 1 October 2010, a liability shift had occurred for all point of sale transactions.[23]
  • Visa's liability shift for points of sale took place on 1 January 2006. For ATMs, the liability shift took place on 1 January 2008.[24]

Asian/Pacific countries

  • MasterCard's liability shift among countries within this region took place on 1 January 2006.[22] By 1 October 2010, a liability shift had occurred for all point of sale transactions, except for domestic transactions in China and Japan.[23]
  • Visa's liability shift for points of sale took place on 1 October 2010.[24] For ATMs, the liability shift date is 1 October 2015, except in China, India, Japan, and Thailand, where the liability shift will be 1 October 2017.[25] Domestic ATM transactions in China are not currently not subject to a liability shift deadline.

Australia

  • MasterCard required all point of sale terminals to be EMV capable by April 2013. For ATMs, the liability shift took place in April 2012. ATMs are required to be EMV compliant by the end of 2015[26]
  • Visa's liability shift for ATMs is 1 April 2013.[24]

Brazil

  • MasterCard's liability shift took place on 1 March 2008.[22]
  • Visa's liability shift for points of sale took place on 1 April 2011. For ATMs, the liability shift took place on 1 October 2012.[24]

Colombia

  • MasterCard's liability shift took place on 1 October 2008.[22]

Canada

  • American Express implemented a liability shift on 31 October 2012.[27]
  • Discover is implementing a liability shift on 1 October 2015. For pay at the pump at gas stations, the liability shift is 1 October 2017.[28]
  • Interac (Canada's debit card network) stopped processing non-EMV transactions at ATMs on 31 December 2012, and will stop processing non-EMV transactions at point of sale terminals after 31 December 2015.[27]
  • MasterCard implemented domestic transaction liability shift on 31 March 2011, and international liability shift on 15 April 2011. For pay at the pump at gas stations, the liability shift was implemented 31 December 2012.[27]
  • Visa implemented domestic transaction liability shift on 31 March 2011, and international liability shift on 31 October 2010. For pay at the pump at gas stations, the liability shift was implemented 31 December 2012.[27]

Europe

  • MasterCard's liability shift took place on 1 January 2005.[22]
  • Visa's liability shift for points of sale took place on 1 January 2006. For ATMs, the liability shift took place on 1 January 2008.[24]

Latin America and the Caribbean

  • MasterCard's liability shift among countries within this region took place on 1 January 2005.[22]
  • Visa's liability shift for points of sale took place on 1 October 2012, for any countries in this region that have not already implemented a liability shift. For ATMs, the liability shift will take place on 1 October 2014, for any countries in this region that have not already implemented a liability shift.[24]

Middle East

  • MasterCard's liability shift among countries within this region took place on 1 January 2006.[22] By 1 October 2010, a liability shift had occurred for all point of sale transactions.[23]
  • Visa's liability shift for points of sale took place on 1 January 2006. For ATMs, the liability shift took place on 1 January 2008.[24]

Mexico

  • Discover is implementing a liability shift on 1 October 2015. For pay at the pump at gas stations, the liability shift is 1 October 2017.[28]
  • Visa's liability shift for points of sale took place on 1 April 2011. For ATMs, the liability shift took place on 1 October 2012.[24]

New Zealand

  • MasterCard required all point of sale terminals to be EMV compliant by 1 July 2011. For ATMs, the liability shift took place in April 2012. ATMs are required to be EMV compliant by the end of 2015.[26]
  • Visa's liability shift for ATMs was 1 April 2013.[24]

South Africa

  • MasterCard's liability shift took place on 1 January 2005.[22]

United States

Visa,[29] MasterCard[30] and Discover[31] in March 2012 – and American Express[32] in June 2012 – have announced their EMV migration plans for the US. In spite of these announcements, doubts remain over the willingness of merchants to develop the capability to support EMV.[33] Since the announcement, multiple banks and card issuers have announced cards with EMV chip-and-signature technology, including American Express, Bank of America, Citibank, Wells Fargo,[34] JPMorgan Chase, U.S. Bank, and several credit unions.[35] JPMorgan was the first major bank to introduce a card with EMV technology, namely its Palladium card, in mid-2012.[35]

  • American Express is implementing a liability shift for point of sale terminals in October, 2015.[36] For pay at the pump, at gas stations, the liability shift is October, 2017.
  • Discover is implementing a liability shift on 1 October 2015. For pay at the pump at gas stations, the liability shift is 1 October 2017.[28]
  • Maestro implemented a liability shift of 19 April 2013, for international cards used in the United States.[37]
  • MasterCard is implementing a liability shift for point of sale terminals in October, 2015.[36] For pay at the pump, at gas stations, the liability shift is October, 2017. For ATMs, the liability shift date is in October 2016.[38]
  • Visa is implementing a liability shift for point of sale terminals on 1 October 2015. For pay at the pump, at gas stations, the liability shift is 1 October 2017.[39] For ATMs, the liability shift date is 1 October 2017.[25]

In May 2010, a press release from Gemalto (a global EMV card producer) indicated that United Nations Federal Credit Union in New York would become the first EMV card issuer in the US, offering an EMV Visa credit card to its customers.[40]

Venezuela

  • MasterCard's liability shift took place on 1 July 2009.[22]

See also

References

  1. ^ "China UnionPay joins EMVCo" (Press release). Finextra Research. 20 May 2013. Retrieved 10 May 2015.
  2. ^ "Discover Joins EMVCo to Help Advance Global EMV Standards". Discover Network News. 3 September 2013. Retrieved 10 May 2015.
  3. ^ "EMVCo Members". EMVCo. Retrieved 10 May 2015.
  4. ^ "Shift of liability for fraudulent transactions". The UK Cards Association. Retrieved 10 May 2015.
  5. ^ "How EMV (Chip & PIN) Works - Transaction Flow Chart". Creditcall Ltd. Retrieved 10 May 2015.
  6. ^ a b c d John Kiernan. "Chip-and-PIN vs. Chip-and-Signature". Evolution Finance, Inc. Retrieved 31 July 2012.
  7. ^ "SPVA Launch Presentation". Secure POS Vendor Alliance. 2009.[dead link]
  8. ^ "Integrated Circuit Card Specifications for Payment Systems". EMVCo. Retrieved 26 March 2012.
  9. ^ Saar Drimer; Steven J. Murdoch; Ross Anderson. "PIN Entry Device (PED) vulnerabilities". University of Cambridge Computer Laboratory. Retrieved 10 May 2015.
  10. ^ "Petrol firm suspends chip-and-pin". BBC News. 6 May 2006. Retrieved 13 March 2015.
  11. ^ "Organized crime tampers with European card swipe devices". The Register. 10 October 2008.
  12. ^ "Technical Working Groups, Secure POS Vendor Alliance". 2009.[dead link]
  13. ^ "Is Chip and Pin really secure?". BBC News. 26 February 2008. Retrieved 2 May 2010.
  14. ^ "Chip and pin". 6 February 2007. Archived from the original on 5 July 2007.
  15. ^ John Leyden (27 February 2008). "Paper clip attack skewers Chip and PIN". The Channel. Retrieved 10 May 2015.
  16. ^ Steven J. Murdoch; Saar Drimer; Ross Anderson; Mike Bond. "EMV PIN verification "wedge" vulnerability". Computer Laboratory, University of Cambridge. Retrieved 12 February 2010.
  17. ^ Susan Watts (11 February 2010). "New flaws in chip and pin system revealed". BBC News. Retrieved May 2015. {{cite news}}: Check date values in: |accessdate= (help)
  18. ^ "Response from EMVCo to the Cambridge University Report on Chip and PIN vulnerabilities ('Chip and PIN is Broken' – February 2010)" (PDF). EMVCo. Retrieved 26 March 2010.
  19. ^ Richard Evans (15 October 2009). "Card fraud: banks now have to prove your guilt". The Telegraph. Retrieved 10 May 2015.
  20. ^ Andrea Barisani; Daniele Bianco; Adam Laurie; Zac Franken (2011). "Chip & PIN is definitely broken" (PDF). Aperture Labs. Retrieved 10 May 2015.
  21. ^ Adam Laurie; Zac Franken; Andrea Barisani; Daniele Bianco. "EMV - Chip & Pin CVM Downgrade Attack". Aperture Labs and Inverse Path. Retrieved 10 May 2015.
  22. ^ a b c d e f g h i "Chargeback Guide" (PDF). MasterCard Worldwide. 3 November 2010. Retrieved 10 May 2015.
  23. ^ a b c "Operating Regulations" (PDF). Visa International.[dead link]
  24. ^ a b c d e f g h i "The Journey To Dynamic Data" (PDF). Visa.[dead link]
  25. ^ a b "Visa Expands U.S. Roadmap for EMV Chip Adoption to Include ATM and a Common Debit Solution" (Press release). Foster City, Calif.: Visa. 4 February 2013. Retrieved 10 May 2015.
  26. ^ a b "MasterCard Announces Five Year Plan to Change the Face of the Payments Industry in Australia". Mastercard Australia.[dead link]
  27. ^ a b c d "Chip Liability Shift". globalpayments.[dead link]
  28. ^ a b c "Discover to enforce EMV liability shift by 2015" (Press release). Finextra Research. 12 November 2012. Retrieved 10 May 2015.
  29. ^ "Visa update for EMV Chip implementation in the U.S." Creditcall Ltd. 17 January 2012. Retrieved 10 May 2015.
  30. ^ "MasterCard aligns with Visa's U.S. EMV migration plans by publishing its own EMV implementation roadmap". Creditcall Ltd. 1 February 2012. Retrieved 10 May 2015.
  31. ^ "Discover Implements EMV Mandate for U.S., Canada and Mexico".[dead link]
  32. ^ "American Express Announces U.S. EMV Roadmap to Advance Contact, Contactless and Mobile Payments" (Press release). New York: American Express. 29 June 2012. Retrieved 10 May 2015.
  33. ^ "EMV's Uncertain Fate in the US". Protean Payment. Retrieved 22 September 2012.[dead link]
  34. ^ Camhi, Jonathan (3 August 2012). "Wells Fargo Introduces New EMV Card for Consumers". Bank Systems & Technology. Retrieved 10 May 2015.
  35. ^ a b "Chip-and-Pin and Chip-and-Signature Credit Card Primer for 2013". Frequent Business Traveler. 25 July 2013. Retrieved 10 May 2015.
  36. ^ a b Cathy Medich (July 2012). "EMV Migration – Driven by Payment Brand Milestones". Retrieved 10 May 2015.
  37. ^ David Heun (10 September 2012). "MasterCard Brings EMV Chip-Card Liability Policy to U.S. ATMs". SourceMedia. Retrieved 10 May 2015.
  38. ^ Beth Kitchener (10 September 2012). "MasterCard Extends U.S. EMV Migration Roadmap to ATM Channel" (Press release). Purchase, N.Y.: Mastercard. Retrieved 10 May 2015.
  39. ^ "Visa Announces U.S. Participation in Global Point-of-Sale Counterfeit Liability Shift" (PDF) (Press release). Visa. 9 August 2011. Retrieved 10 May 2015.
  40. ^ Ray Wizbowski (13 May 2010). "United Nations Federal Credit Union Selects Gemalto for First U.S. Issued Globally Compliant Payment Card" (Press release). Austin, Texas: Gemalto. Retrieved 10 May 2015.
Retrieved from "https://en.wikipedia.org/w/index.php?title=EMV&oldid=661791822"