EMV

EMV
663highland · Public domain · source
Name	EMV
Developer	Europay International, Mastercard, Visa Inc.
Introduced	1994
Type	Smart card payment standard

EMV is a global technical standard for interoperable chip-based payment cards and acceptance devices that transformed card payments across retail, banking, and transit sectors. It was originally developed by Europay International, Mastercard, and Visa Inc. to reduce counterfeit fraud and enable secure transactions between issuers, acquirers, and merchants. The specification underpins interactions among cardholders using contact, contactless, and mobile implementations at point-of-sale, automated teller machines, and unattended terminals.

Overview

EMV defines an integrated framework linking chip cards, terminals, and processing networks from entities such as American Express, Discover Card, JCB, Visa Inc., and Mastercard. The standard specifies how a card's embedded integrated circuit communicates with devices produced by vendors like Ingenico, Verifone, and NCR Corporation to execute payment applications, authentication, and authorization flows. EMV interoperates with payments infrastructure overseen by organizations such as the European Central Bank, Federal Reserve System, and national schemes like UK Finance or Bank of America. It complements initiatives by standards bodies including the International Organization for Standardization, the International Electrotechnical Commission, and the Payment Card Industry Security Standards Council.

Technical Specifications

The EMV technical specifications encompass physical, electrical, data, and application-level protocols standardized alongside documents from ISO/IEC 7816 and ISO/IEC 14443. Card types include contact chips and contactless chips compliant with NFC Forum profiles and radio-frequency systems used by providers like Sony Corporation for mobile wallets. EMV prescribes application identifiers, tag-length-value (TLV) data structures, and cryptographic primitives such as symmetric keys and asymmetric schemes leveraging algorithms endorsed by National Institute of Standards and Technology and implemented in hardware security modules from firms like Thales Group and Gemalto. Key processes include offline data authentication, dynamic data authentication, and cardholder verification methods (CVMs) including online PIN and signature verification recognized by networks such as SWIFT and Visa Inc.. Terminal risk management rules and transaction sequencing determine when a transaction requires online authorization from issuers like Citigroup or JPMorgan Chase.

Card and Terminal Implementation

Issuer banks including Santander, HSBC, and Deutsche Bank produce EMV cards embedding secure elements manufactured by semiconductor firms such as Infineon Technologies and NXP Semiconductors. Card personalization involves lifecycle management with issuers, personalization bureaus, and postal schemes like Royal Mail or USPS for distribution. Terminals built by Ingenico, Verifone, and point-of-sale integrators used by retailers like Walmart, Target Corporation, and Carrefour implement EMV kernels and application selection logic. Mobile implementations integrate EMV specifications into wallets provided by Apple Inc., Google LLC, and Samsung Electronics using tokenization services from payment processors including Stripe and Adyen. Transit operators such as Transport for London and New York MTA deploy contactless EMV for fare collection with back-end clearing through entities like Mastercard and Visa Inc. processors.

Security and Fraud Prevention

EMV reduces counterfeit card fraud by enabling dynamic authentication and cryptographic validation with issuers and acquirers such as Worldpay and Global Payments. Offline data authentication techniques—static data authentication, dynamic data authentication—protect against cloning attempts documented in security research from groups at Cambridge University, Carnegie Mellon University, and firms like Kaspersky Lab. Cardholder verification, including PIN entry and biometric verification supported by vendors such as Synaptics and Apple Inc., mitigates unauthorized use highlighted in investigations by regulators like the Financial Conduct Authority and Consumer Financial Protection Bureau. Despite improvements, fraud has shifted to card-not-present channels managed by e-commerce platforms like Amazon (company), eBay, and fraud prevention services such as Riskified and Forter; EMV prompted migrations in risk modeling and liability frameworks overseen by networks and schemes.

Certification and Compliance

EMV certification processes are administered by certification bodies, testing laboratories, and scheme administrators including EMVCo, Visa Inc., Mastercard, and regional certification laboratories accredited by PCI Security Standards Council. Terminal and card vendors undergo conformance testing for kernel implementations, EMV Level 1 (physical and electrical) and Level 2 (kernel and application) validations, and type-approval in jurisdictions enforced by central banks such as the Reserve Bank of India and Bank of Canada. Compliance programs tie into transaction liability shifts, merchant rules, and acquirer obligations enforced by networks and regulators including European Banking Authority and national supervisory authorities.

Adoption and Global Impact

EMV rollout accelerated across Europe with national deployments in countries like France, Germany, and Spain, and later in markets including Canada, Australia, and the United States. Adoption affected merchant terminals at chains such as McDonald's, Starbucks, and IKEA, and reshaped issuer strategies at global banks like Goldman Sachs and UBS. The shift altered fraud patterns, prompting policy and technology responses from international institutions such as the World Bank and International Monetary Fund. EMV's technical legacy informs modern payment innovations in digital wallets, tokenization programs by Mastercard and Visa Inc., and emerging contactless fare systems used by transit agencies worldwide.

Category:Payment systems