EMV
EMV is the global standard for chip cards and the terminals that read them — named for Europay, Mastercard and Visa and maintained by EMVCo — under which a card's chip generates a unique cryptogram for every transaction, so copied data cannot be replayed as a magnetic stripe could. Its liability-shift rules drove Europe's migration in the 2000s and the US's from 2015; contactless, tokenisation and 3DS 2 are its specifications too.
- Also known as
- EMV chip, Chip and PIN, EMV standard, EMVCo
- Used at
- every chip and contactless card transaction worldwide; over 90% of card-present transactions globally are EMV
- Binding
- the EMV specifications (contact, contactless, tokenisation, 3DS, QR, secure remote commerce) and the schemes' migration mandates and liability shifts; terminals and cards are certified against them
- Typical mechanics
- the chip and terminal exchange data; the chip signs the transaction with a key only the issuer can verify, producing a cryptogram; cardholder verification is by PIN (Europe), signature (US, historically) or the phone's biometric (wallets); the issuer checks the cryptogram at authorisation
- Typical effect
- counterfeit card fraud fell by 70–90% in markets after migration; fraud moved online, which is why card-not-present fraud rose and 3-D Secure mattered more
- Parties
- EMVCo (owned by the six major schemes), issuers, acquirers, terminal and card manufacturers, the certification labs, and merchants who bought new terminals
How EMV works in practice
A card is inserted or tapped. The terminal and the chip negotiate: which applications the card supports, what verification method to use, whether to go online. The chip computes a cryptogram over the transaction data using a key it shares with the issuer; the terminal sends the cryptogram with the authorisation; the issuer verifies it — this transaction, this card, this amount, once — and approves. A skimmer that copied the chip's data could not produce the next cryptogram, so cloning the card is not feasible; the magnetic stripe, which held static data, could be copied at a petrol pump and written onto a blank in minutes.
The migration was driven by liability. The schemes announced that after a date, fraud on a counterfeit card would be borne by whichever party — issuer or merchant — had not adopted EMV: a merchant with a stripe-only terminal accepting a chip card paid for the fraud; an issuer with a stripe-only card accepted at a chip terminal paid likewise. Europe migrated in the 2000s under chip-and-PIN; the US, with its larger installed base and signature habit, set its shift for October 2015 and took years more to complete. Counterfeit fraud fell everywhere it happened; fraud moved to e-commerce, where the chip is absent.
EMVCo's remit grew: contactless, the tokenisation framework behind network tokens, 3-D Secure 2, QR codes, and Secure Remote Commerce (click to pay) are all its specifications — which is why "EMV" appears on every layer of a payments company's technology diligence.
Example
A US retail chain with 1,200 stores delays its EMV terminal upgrade past the October 2015 liability shift because the rollout costs $9m. In the following year counterfeit-card chargebacks it previously could not be charged for — $2.4m — are charged back to it under the shift, as fraudsters target stripe-only merchants. It upgrades in 2016 at $9.5m with contactless included; counterfeit chargebacks fall to $120,000; contactless adoption in 2020 pays for the NFC it bought by accident. Its European subsidiary, chip-and-PIN since 2006, had never understood the delay.
Common mistakes
- Treating EMV as a card technology rather than as a family of specifications across the whole stack. - Delaying a liability-shift deadline and paying for the fraud the shift allocates. - Assuming chip cards ended card fraud; they moved it online. - Terminals certified for contact EMV and not contactless, replaced early. - Confusing EMV (the chip standard) with PCI DSS (the data-security standard); both apply, differently.