3 ms·
EMV based systems aren’t necessarily authentification based / don’t always phone home depending on the card issuer.
by thatfrenchguy 3y ago
EMV based systems aren’t necessarily authentification based / don’t always phone home depending on the card issuer.
- deleted 3y ago[deleted]
- dfox 3y agoIt depends on both issuer, acquirer and the particular merchant. Second step of the EMV transaction (after the terminal verifies that the card was issued by known issuer) involves the card and terminal comparing their authentication and authorization policies, which might very well result in no-op being acceptable to both. The system is not designed to be secure against fraud, but to assign liability for the fraud to particular party in cryptographically verifiable way. So as a merchant (think public transport) you can very well accept cards offline without any kind of CHV step, but the possible fraud is your problem.