• Skip to primary navigation
  • Skip to main content
Cardspot

Cardspot

  • Home
  • About Us
  • Services
    • Brand Certification
    • Brand Consultancy
    • Observing Mandates
    • Issuer Consultancy
    • Acquirer Consultancy
    • Key Management
  • Blog
  • Contact Us
  • English
    • Hungarian

The anomaly with biometric cards

Gábor Gazsó · 2020.06.02.

When paying with a bank card at a terminal, the terminal must know how the cardholder should be verified. The verification method could vary card by card, terminal by terminal, depending on what kind of means the payment card and the terminal support.

Cardholder Verification Method

CVM (Cardholder Verification Method) tells how the cardholder should verify him or herself during a payment transaction. There are several methods described in EMV. It may be a PIN in clear text or encrypted form, online or offline, signature, cardholder device, or even biometrics. The card contains a list that specifies the kind of CVM acceptable by the card. Dual interface cards carry a different list of contact and contactless interfaces.

The terminal reads this list and verifies which item is compliant with the capabilities of the terminal. When the terminal has read the list, it goes through the list one by one and verifies the compliance. For every item in the list, the terminal may or may not recognize the verification method. How could it happen that a terminal doesn’t know the verification method? EMV added biometric support to its specifications in 2017. Consequently, terminal kernels developed earlier may not understand this kind of CVM.

Unsupported CVN and failure

If the terminal recognizes the CVM, it may support it or not. For example, a terminal without a fingerprint sensor doesn’t support fingerprint CVM. EMV specification states that the terminal not supporting a CVM should go to the next item in the CVM list.

At the same time, in EMV specification, there are specific rules for the cases when the terminal supports the CVM, and the cardholder verification fails. In such a case, the CVM list item instructs the terminal to abandon the transaction or to read the next element of the CVM list. This regulation of the specification seems to cause kernel implementations to behave differently.

Case with biometrics

Some issuers want to verify the cardholder by biometrics. They support PIN only in case the terminal doesn’t support biometric at all. But if the terminal supports a biometric verification method and fails, the issuer doesn’t want to allow PIN.

In a bulletin issued by EMVCo in March 2020, EMVCo warned issuers that in some cases terminal kernels doesn’t work as required by EMV, because of misunderstanding EMV specification at the time of implementation. As a result, some terminal, not recognizing the biometric verification method, may fail the verification, instead of ignoring the biometric item. So, in case the card supports both biometric and PIN and prefers biometric against PIN, some terminal types may improperly fail the transaction if the biometric method is unknown by the POS. In this case, the terminal doesn’t require the PIN.

In 2019, EMVCo updated the test cases to ensure the proper behaviour of the terminal kernels. Despite this, there may be a couple of devices in production, with an incorrect response. Issuers would better note the fact that their cardholders may face anomaly with their cards even if they configured the card correctly.

Sources:

  • EMV ® 4.3 Book 3
  • EMV ® Specification Bulletin No. 185
  • EMV ® Best Practice for Biometric Proprietary CVM Support

About Gábor Gazsó

The author has more than 20 years of experience with bank card systems and smart card technology by working for issuers, acquirers and service providers.

Let us help you and get in touch with us. Contact Us

Copyright © 2023 · Cardspot Kft.

We collect cookies. Why? Accept
Manage consent

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
CookieDurationDescription
cookielawinfo-checkbox-analytics11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional11 monthsThe cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy11 monthsThe cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytics
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Others
Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.
SAVE & ACCEPT