|
Magnetic Tape versus EMV Smart Card Transaction
A magnetic stripe payment card is swiped at the start of the transaction. Once swiped, the contents of the encoded magnetic tracks, including, holders account number, name and issue and expiry date are sent from an integrated MSR reader as key strokes or as a serial data stream.
Capture of magnetic swipe data from a credit card is simple. The magnetic card reader and software to process the transaction are uni-directional. The card contents can be easily read by a card reader and potentially “skimmed” and then copied onto a fraudulent card. As long as the card remains in the fraudsters possession there is always a risk of further attempted fraudulent transactions.
A SMART card has an embedded semi-conductor device which is programmed before issue with account holder’s information. This data is protected by extremely secure encryption methods. It is very difficult for a fraudster to replicate a SMART card.
When a Smart Card is offered as payment for goods or services, it is inserted into a Smart Card reader (where it remains for the duration of the transaction). The card details are then read by the reader, these include the card number and expiry date.
An EMV transaction requires bi-directional commands and data transfer between the card and its reader by an EMV Level 2 certified software application. The data stored on the chip can be changed during a transaction. The card can store its own transaction history and also its floor limits for different merchants. The card can also be deactivated to block its use if it is reported stolen.
In the case of a PIN enabled card, a message is sent to the PIN pad to request a PIN. The PIN is entered by the card holder and securely passed back to the card for verification against the PIN details stored in the smart card.
The card is then checked to see if it has been altered or copied since it was issued. The application on the card is checked to see whether it is valid in the card processing system. Finally the system performs terminal risk management checks, where against the floor limits set up by the system together with the results of a random transaction selection.
After all the above checks have been made, a recommendation is made to the card whether to proceed on-line or off-line. If the card proceeds on-line an encrypted message is sent through the client software to send and receive an authorisation message from the acquiring bank and forwards the response to the card.
On completion of the transaction the system sends a logging message to the retailers acquiring software. The entire process can take as little as 3 seconds.
The need for bi-directional communication between the card, the smart card reader and eventually the acquirer adds substantially to the complexity of implementation of the Electronic Funds Transfer (EFT) transaction program. EMV Level 2 certified application code is needed at each position accepting EMV payment. |
