EMV

EMV

EMVEMVApplicationGlobal chip payment card standard.Click to view → (Europay, Mastercard, and Visa) is the global standard for chip-based payment card transactions, replacing the legacy magnetic stripe infrastructure with cryptographically secured smart card technology. Managed by EMVCo, the EMV specifications define the physical, electrical, and application-level interfaces for contact and contactless payment cards, terminals, and mobile payment systems.

How an EMV Transaction Works

An EMV contact transaction follows a structured flow:

1. Application Selection: The terminal reads the card's AID list and selects the appropriate payment application (Visa, Mastercard, etc.)
2. Read Application Data: The terminal retrieves card records containing cardholder name, PAN, expiry date, and issuer certificates
3. Offline Data Authentication: The terminal verifies the card's authenticity using SDA (Static Data Authentication), DDA (Dynamic Data Authentication), or CDA (Combined DDA/AC Generation)
4. Cardholder Verification: PIN entry, signature, or no CVM depending on risk parameters
5. Risk Management: Terminal and card evaluate floor limits, velocity checks, and offline counters
6. Transaction Authorization: The card generates an Application Cryptogram (ARQC for online, TC for offline approval, AAC for decline) using 3DES or AES
7. Issuer Authentication: For online transactions, the issuer validates the ARQC and returns an authorization response

EMV Contactless

EMV contactless (tap-to-pay) uses ISO 14443 at 13.56 MHz for RF communication. The transaction flow is condensed for speed — the terminal performs application selection and reads card data in a single command sequence, and cardholder verification is typically waived for transactions below the contactless CVM limit (varies by country, commonly $50-$100). The qVSDC (Visa), PayPass (Mastercard), and ExpressPay (American Express) specifications define the brand-specific contactless protocols.

EMV Security Mechanisms

EMV Chip Types

EMV-compliant cards are built on JavaCard or MULTOS platforms with a Secure Element certified to EAL 4+ under Common Criteria. Modern issuance exclusively uses dual-interface modules supporting both contact and contactless on a single chip.