CDCVM: Promoting Security, Reliability and Convenience

Consumers are increasingly choosing to authenticate payment transactions using their own device. In this Q&A post, Jianhua Ni, Chair of EMVCo’s CDCVM Task Force, explains how EMVCo is addressing the increasing popularity of Consumer Device Cardholder Verification Methods (CDCVM) and working to promote security, reliability and convenience. Firstly, what is a Consumer Device Cardholder Verification Method (CDCVM)? Jianhua Ni: A Cardholder Verification Method (CVM) is used to confirm whether the person presenting a payment card is the legitimate cardholder. When an individual enters a PIN or signs their name to authorise a transaction, they are providing a CVM. Now, the growing use of mobile devices for payments has enabled consumer authentication to be performed on the consumer’s own device via passcodes, passwords and patterns, as well as biometrics such as fingerprint, iris, voice and facial recognition. This type of authentication on a consumer device is known as a Consumer Device Cardholder Verification Method (CDCVM). Technologies that enable CDCVM are called CDCVM solutions. Why is EMVCo involved in this area and what activity is it undertaking? Jianhua Ni: EMVCo is working to promote confidence and consistency by identifying and addressing specific security, functional and performance needs required for CDCVM solutions. To prevent fraud, it is imperative that CDCVM solution assets (such as a user’s biometric or passcode) are adequately secured. Also, results must not be manipulated, falsified or exploited, and the solution must not be maliciously abused, disabled or bypassed. To support these objectives, EMVCo has published EMV® CDCVM Security Requirements and has established a Security Evaluation Process to help ensure CDCVM solutions maintain robust security and can withstand known attacks. To promote a consistent user experience and global interoperability, EMVCo has also proposed industry best-practices to address key functional and performance considerations. This includes considerations like the recommended length of passwords and passcodes, capture points for patterns, and the number and frequency of incorrect authentication attempts. The best-practice guidelines also include high-level biometric performance objectives to address false acceptance, false rejections and imposter attacks. What other challenges is EMVCo working to address related to CDCVM? Jianhua Ni: We know that CDCVM presents more complexity and variability than traditional CVM. Unlike an online PIN, a CDCVM cannot be seen by the issuer. CDCVM solutions can use various components and functions on a device and can be used across many consumer devices manufactured by different original equipment manufacturers (OEMs) and deployed across many markets. Put simply, this can make it more difficult for issuers to identify the precise CDCVM used for a particular payment transaction. This has highlighted the need to provide more information about a CDCVM solution used during a transaction to enable issuers to make better-informed authentication and authorisation decisions for payments conducted on consumer devices. To address this challenge, EMVCo is piloting a way to enable issuers and other participants to better identify CDCVM solutions – the EMV CDCVM Solution ID and Database. What is the EMV CDCVM Solution ID and Database? Jianhua Ni: Each registered CDCVM solution is assigned a unique, short identifier known as an EMV CDCVM Solution ID, together with a set of related metadata of the CDCVM solutions being entered and maintained in the database. This will allow a single value to be communicated to issuers, enabling them (or a service provider acting on their behalf) to access the CDCVM solution-related metadata. What type of information will be registered in the Database? Jianhua Ni: The CDCVM Database will include information such as CDCVM Solution Name, Solution Provider, Solution Type,