SB nº SU-30 : Terminal Security Requirements for PIN Entry and Amount Entry (Spec Change)

Specification Update: Bulletin no. 30 First Edition April 2004 Terminal Security Requirements for PIN Entry and Amount Entry This bulletin clarifies the EMVCo terminal security requirements relating to PIN entry and amount entry as defined in EMV 2000 Integrated Circuit Card Specifications for Payment Systems Version 4.0 Book 2, Section 11.1.2 PIN Pads. As a result of this clarification a change is also made to EMV 2000 Integrated Circuit Card Specifications for Payment Systems Version 4.0 Book 4, Section 2.5.1 Amount Entry and Management In EMV 2000 Integrated Circuit Card Specifications for Payment Systems Version 4.0, Book 2, Section 11.1.2 PIN Pads please replace: For an attended terminal, the amount entry process shall be separate from the PIN entry process to avoid accidental display of a PIN on the terminal display. In particular, if the amount and PIN are entered on the same keypad, the amount shall be validated by the cardholder before PIN entry is allowed. with For an attended terminal, the amount entry process shall be separate from the PIN entry process to avoid accidental display of a PIN on the terminal display. In particular, if the amount and PIN are entered on the same keypad then the amount entry and PIN entry shall be clearly separate operations. PIN entry by the cardholder should be used to validate the amount if not validated by another method. In EMV 2000 Integrated Circuit Card Specifications for Payment Systems Version 4.0 Book 4, Section 2.5.1 Amount Entry and Management please delete the reference to “Book 2 Security and Key Management” thus: The cardholder should be able to validate the original or corrected amount when the transaction amount is known before authorisation. If PIN entry occurs immediately after the amounts are entered, PIN entry can act as the validation of the amount. If PIN entry does not occur immediately after the amounts are entered, the terminal should display the ‘(Amount) OK?’ message for the cardholder to validate the amount fields.