PCI Watch

Tracking changes across the Payment Card Industry

EMV® Best Practices for Contactless Acceptance at Point of Sale

v1.1
ContactlessQR Code Acceptance Device

EMV® Best Practices For Contactless Acceptance at Point of Sale Version 1.1 December 2019 1

EMV Best Practices For Contactless Acceptance at Point of Sale v1.1

Legal Notice

This document summarizes EMVCo’s present plans for evaluation services and related policies and is subject to change by EMVCo at any time. This document does not create any binding obligations upon EMVCo or any third party regarding the subject matter of this document, which obligations will exist, if at all, only to the extent set forth in separate written agreements executed by EMVCo or such third parties. In the absence of such a written agreement, no product provider, test laboratory or any other third party should rely on this document, and EMVCo shall not be liable for any such reliance. No product provider, test laboratory or other third party may refer to a product, service or facility as EMVCo approved, in form or in substance, nor otherwise state or imply that EMVCo (or any agent of EMVCo) has in whole or part approved a product provider, test laboratory or other third party or its products, services, or facilities, except to the extent and subject to the terms, conditions and restrictions expressly set forth in a written agreement with EMVCo, or in an approval letter, compliance certificate or similar document issued by EMVCo. All other references to EMVCo approval are strictly prohibited by EMVCo. Under no circumstances should EMVCo approvals, when granted, be construed to imply any endorsement or warranty regarding the security, functionality, quality, or performance of any particular product or service, and no party shall state or imply anything to the contrary. EMVCo specifically disclaims any and all representations and warranties with respect to products that have received evaluations or approvals, and to the evaluation process generally, including, without limitation, any implied warranties of merchantability, fitness for purpose or non-infringement. All warranties, rights and remedies relating to products and services that have undergone evaluation by EMVCo are provided solely by the parties selling or otherwise providing such products or services, and not by EMVCo, and EMVCo will have no liability whatsoever in connection with such products and services. This document is provided "AS IS" without warranties of any kind, and EMVCo neither assumes nor accepts any liability for any errors or omissions contained in this document. EMVCO DISCLAIMS ALL REPRESENTATIONS AND WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NONINFRINGEMENT, AS TO THIS DOCUMENT. EMVCo makes no representations or warranties with respect to intellectual property rights of any third parties in or in relation to this document. EMVCo undertakes no responsibility to determine whether any implementation of this document may violate, infringe, or otherwise exercise the patent, copyright, trademark, trade secret, know-how, or other intellectual property rights of third parties, and thus any person who implements any part of this document should consult an intellectual property attorney before any such implementation. Without limiting the foregoing, this document may provide for the use of public key encryption and other technology, which may be the subject matter of patents in several countries. Any party seeking to implement this document is solely responsible for determining whether its activities require a license to any such technology, including for patents on public key encryption technology. EMVCo shall not be liable under any theory for any party's infringement of any intellectual property rights in connection with this document.

v1. 1. 1. 4. 4. 4.

v1.1 1

Introduction

This EMVCo document is intended to provide Product Providers, Merchants, and Acquirers with a set of best practices for contactless acceptance of cards or payment devices at Point of Sale. This document also assists Product Providers in designing Contactless Acceptance Devices that meet industry standard.

1.1 Audience This document is intended for:

  • Product Providers developing and integrating Contactless Acceptance Devices
  • Acquirers deploying those Contactless Acceptance Devices
  • Merchants installing those Contactless Acceptance Devices 1.2

Scope

The best practices outlined in this document are recommended guidelines that Product Providers, Acquirers and Merchants may use for all Contactless Acceptance Devices that accept EMVCo Contactless Level 1 products (cards, mobile handsets, fobs, etc). These recommended guidelines are designed for Contactless Level 1 acceptance only and does not cover Contact or Contactless Application considerations. Additional recommendations have been added to resolve the concerns for Contactless Acceptance Devices which also support QR code-based technology.

v1.1 2 Normative

References

Ref. [AP PCD] [AP CLS] Document Title EMVCo Terminal Type Approval Administrative Process for Contactless Terminal Level 1 (PCD) EMVCo Terminal Type Approval Administrative Process for Contactless product Version Latest Available Latest Available Distribution Publicly Available Publicly Available

v1.1 3 Glossary This appendix defines selected terms used in this document. Acquirer Contactless Acceptance Device EMVCo Contactless Level 1 Merchant Product Provider User The entity deploying the Contactless Acceptance Devices in its network The physical device used for the contactless transaction acceptance (Terminal, Reader, Pin Pad, etc) A Limited Liability Company established to maintain the EMV specifications and administer Type Approval against those specifications. Contactless communication protocol between the Contactless Acceptance Device and the Card or Payment Device as per EMVCo Specifications (Book D) The entity installing and using the Contactless Acceptance Device in its sales location The entity providing the Contactless Acceptance Device. The customer using a card or a device to conduct a contactless payment.

v1.1 4 Best Practices This section details best practices for designing and installing Contactless Acceptance Devices. They are intended to provide guidance to ease Contactless Acceptance Device development and integration into Merchant POS environment and to ensure efficient communication during transaction. The best practices for the Contactless Acceptance Device physical placement are also applicable for unattended terminals. These best practices take into account the Contactless Level 1 communication; therefore, it also includes recommendations related to the communication components, such as the antenna or reader, of the Contactless Acceptance Device. Best practices regarding hybrid acceptance devices supporting both contactless and QR code-based technologies have also been considered. Three categories of best practices have been defined:

  • Contactless Acceptance Device Design: these best practices can be used during the development of the device by the Product Provider.
  • Contactless Acceptance Device Implementation: these best practices concern the Product Provider or the Acquirer, to help them during the physical implementation of the device into the final product.
  • Contactless Acceptance Device Installation at Merchant Location: these best practices help the Merchant when installing the device at the final location.

1.3 Contactless Acceptance Device Design 1

Contactless Acceptance Devices should give easy access to the landing zone for both left and right handed, visually impaired, aurally impaired, and less able Users. 2. Contactless Acceptance Devices should be designed such that when a card or payment device is presented, neither the signage, the indicators nor the display (the User Interface) are visually obscured from the User by any of the following:

  • The card or payment device itself (except the Contactless Symbol which is centered on the sweet spot)
  • The User’s hand or arm (within the normal usage scenario)
  • Anything that is expected to be attached to the payment device (keys, phone cases, etc.) 3. Contactless Acceptance Devices should be designed to avoid accidental reading of contactless information when a User intends to perform magnetic stripe, contact chip, or QR code-based transactions. For example: v1.1
  • By not placing the landing zone/antenna of the contactless reader too close to the mag-stripe reader, contact chip reader, or QR code scanning camera
  • By ensuring sufficient shielding between the contactless reader and the magnetic stripe/contact chip reader or QR code scanning camera 4. Contactless Acceptance Devices should be designed with no physical obstruction around the landing zone and/or antenna that would prevent the acceptance of large payment devices (such as a tablet).
  • For Contactless Acceptance Devices with shielded PIN pads, the shield shall not be too close to the operating volume in order to be able to present large payment devices
  • Securing a “free zone” the size of 30cm x 30cm around the landing zone is recommended 1.4 Contactless Acceptance Device Implementation 1. When a Contactless Acceptance Device is added/connected to a terminal, both should adhere to the relevant requirements. Such as:
  • Electrical reliability and regulations
  • Environmental specifications
  • Electromagnetic compatibility (EMC) specifications
  • Electrostatic discharge (ESD) specifications
  • Local Legal regulations 2. Contactless Acceptance Devices should be designed to prevent the introduction of external objects/components, which may go unnoticed and be used to capture information from the presented card or payment device. Example of external objects:
  • Monitoring device 3. Installation of OEM Contactless Acceptance Device into Integrated Solution: When an EMVCo approved OEM Device is integrated into an Integrated Solution, the Acquirer or Merchant should ensure that the Integrated Solution comply with EMVCo approval requirement such as:
  • Contactless Level 1 requirements
  • Logo compliance design For example, integrating an EMVCo approved OEM Device into a metallic box may change the contactless Level 1 behavior and then may need a Type Approval of this Integrated Solution. v1.1 1.5 Contactless Acceptance Device Installation at Merchant Location 1. The way and the place where the Merchant install the Contactless Acceptance Device may influence contactless interoperability:
  • The installation of a Contactless Acceptance Device at Merchant location should be easily accessible and visible for the User. For example, it should not be located behind the merchant counter
  • Contactless Acceptance Devices should be installed in a way that prevents performance degradation, to avoid instances such as placing the acceptance device into a metallic box
  • Contactless Acceptance Devices should not be installed in close proximity to the QR code scanning camera, to avoid instances where unintended contactless transactions may occur, where the user/merchant’s intention is for QR code-based transactions. 2. Contactless Acceptance Devices at Merchant location should be installed in a place free of external interference. For example, the following location should be avoided:
  • Near wi-fi router or mobile phone
  • Near any inductive load equipment
  • On a metallic counter
  • Near anti-theft device
  • Near ungrounded devices (for example cash register shall be grounded)
  • Near high voltage components such as ignition coils (specifically when mounted on motor vehicles)
  • Near QR code scanning camera devices 3. If multiple Contactless Acceptance Devices are installed at a merchant location, a minimum distance between each other shall be respected (at least 30cm) *** END OF DOCUMENT *** December 2019 © 2019 EMVCo, LLC. All rights reserved. Reproduction, distribution and other use of this document is permitted only pursuant to the applicable agreement between the user and EMVCo found at www.emvco.com. EMV® is a registered trademark or trademark of EMVCo, LLC in the United States and other countries.