PCI Watch

Tracking changes across the Payment Card Industry

SB nº SB-85 : CVM Results after a CVM Failure (Spec Change)

v1.0 Specification Bulletins

Specification Bulletin No. 85 First Edition May 2011 CVM Results after a CVM Failure This Specification Bulletin clarifies whether a subsequent Cardholder Verification Method (CVM) is performed after a CVM Failure.

Effective Date

This bulletin is effective from November 2012, at which time any affected or new type approval testing will also come into effect.

Applicability

This Specification Bulletin applies to:

  • EMV Integrated Circuit Card Specifications for Payment Systems Version 4.2 Book 3 [EMV Book3]
  • EMV Integrated Circuit Card Specifications for Payment Systems Version 4.2 Book 4 [EMV Book4]

Related Documents

None

Description

In the CVM Processing flow in EMV Book 3, this bulletin clarifies:

  • that the indication in CVM Results of a CVM failure could be overridden by the results of any subsequent CVM performed that is both recognised and supported
  • the conditions under which the TVR indicates that PIN entry was required and the PIN was not present or not working. This bulletin also clarifies ambiguous wording about whether a subsequent CVM is performed after a CVM fails. Specification Change In EMV Book 3, Section 10.5, the second major bullet of step 1, change: "If the CVM is not supported, processing continues at step 2. In case the CVM was PIN-related, then in addition the terminal shall set the ‘PIN entry required and PIN pad not present or not working’ bit (b5 of byte 3) of the TVR to 1." to: "If the CVM is not supported, processing continues at step 2. In addition, the terminal shall set the ‘PIN entry required and PIN pad not present or not working’ bit (b5 of byte 3) of the TVR to 1 for the following cases: ─ The CVM was online PIN and online PIN was not supported ─ The CVM included any form of offline PIN, and neither form of offline PIN was supported." In Book 3, section 10.5.5, Figure 9, flow T: Change the text in the second decision diamond from "CVM = Offline PIN?" to "CVM includes any form of offline PIN?*" Change the text in the third decision diamond from "Any form of Offline PIN supported?" to "Terminal supports any form of offline PIN?" Add the following note to the page, "* "CVM includes any form of offline PIN" includes the following CVMs: "Plaintext PIN verification performed by ICC", "Enciphered PIN verification performed by ICC", "Plaintext PIN verification performed by ICC and Signature (Paper)", "Enciphered PIN verification performed by ICC and Signature (Paper)"." The resulting new flow T is as follows: In EMV Book 3, section 10.5.5, Figure 12, change the text in the second decision diamond in the left flow from: "CVM for satisfied CVM Condition was recognised and supported?" to: "CVM for any satisfied CVM Condition was recognised and supported?" In EMV Book 4, Section 6.3.4.5, second paragraph change the fourth sentence from: "After an unsuccessful CVM with byte 1 bit 7 set to 1 (apply succeeding CVM), CVM Results reflect this unsuccessful CVM only when no CVM Conditions for any subsequent CVMs are satisfied; that is, no subsequent CVMs are performed." to: "After an unsuccessful CVM with byte 1 bit 7 set to 1 (apply succeeding CVM), CVM Results reflect this unsuccessful CVM only when no subsequent CVMs are performed; that is, when for each subsequent CV Rule either the CVM condition is not satisfied or the CVM condition is satisfied but the CVM method is not supported or is not recognised. " The updated paragraph reads: "The terminal shall set bytes 1 and 2 of the CVM Results with the Method Code and Condition Code of the last CVM performed. After a successful CVM, CVM Results reflect the successful CVM. After an unsuccessful CVM with byte 1 bit 7 of the CV Rule set to 0 (fail cardholder verification), CVM Results reflect the unsuccessful CVM. After an unsuccessful CVM with byte 1 bit 7 set to 1 (apply succeeding CVM), CVM Results reflect this unsuccessful CVM only when no subsequent CVMs are performed; that is, when for each subsequent CV Rule either the CVM condition is not satisfied or the CVM condition is satisfied but the CVM method is not supported or is not recognised. If a subsequent CVM is performed, CVM Results reflect the outcome of the subsequent CVM."