What is EMV® Security and Why is it Important?

Ensuring the reliability and security of payment transactions is a shared responsibility. When payments don’t work and security is compromised, everyone within the payments community is impacted. Banks, technology providers and merchants globally trust EMV® Technology as a foundation for safe and reliable payments. In this post, Chair of the EMVCo Security Evaluation Working Group, Alan Mushing, explains the role of EMVCo to support payment stakeholders in creating products and solutions to withstand known attacks. He also introduces the latest EMV security framework, which defines the security expectations of multi-factor authentication solutions used in payments. Q: What does EMVCo do to support payment security? EMV produces specifications, requirements and guidelines that define what is needed by all stakeholders within the EMV payment community to facilitate a seamless and secure technical interaction between the consumer and merchant. The EMVCo Security Evaluations is a suite of industry requirements and tests that builds on this market knowledge. They work to confirm that a payment product or solution has been assessed against a common EMVCo security evaluation methodology, and leads to an EMVCo listing of the product. Our dedicated security group also supports the work of the JIL Hardware Attack Subgroup (JHAS) and related initiatives, as well as performs continuous monitoring of known attacks and security developments to keep up to date with currently known vulnerabilities and threats. Q: There are lists of approved and evaluated EMV products and solutions on the EMVCo website. What is the process to approve products and solutions? EMVCo audits and recognises laboratories as following the EMVCo process to deliver security evaluation services. Once tests have been undertaken by a recognised laboratory, EMVCo reviews the report and – if the requirements have been met – issues an evaluation or security certificate. Q: Is EMVCo the only body responsible for payment security? No, more than one approach to security is required to fight fraud effectively. Our focus is on payment transactions that are using EMV Technology, i.e. payment solutions that are built using EMV Specifications. Beyond this, EMVCo works closely with regional and global technical bodies and industry associations such as PCI SSC, W3C and FIDO Alliance, which have complementary activity to meet other security aspects that are required to ensure payments are protected. Individual payment networks also use EMV Specifications and technical requirements as a baseline, before adding further requirements and publishing their own EMV technology compliance and implementation rules. This collaboration ultimately aims to ensure that the payment landscape is trusted and has the mechanisms in place to protect consumers and merchants, without causing unnecessary friction in the payment experience. Q: What is the latest security evaluation focus of EMVCo? As remote payments continue to grow in popularity, it is paramount for consumers to be able to securely prove their identity and authenticate their transactions. Using our payments knowledge and security expertise, we recently defined an EMVCo framework to assess the security of multi-factor authentication (MFA) solutions that are used in payment transactions. As a quick recap, MFA is an authentication method that requires the payee to provide two or more factors to confirm their identity. There are three types of authentication factors: ’knowledge’ (things you know), such as a PIN or password; ’possession’ (things you have), such as a smartphone; and 'inherence’ (things you are) such as biometrics. EMVCo recognises that MFA has a crucial role in today’s payments landscape as it gives industry flexibility in how it wants to authenticate consumers using different credential combinations in different payment scenarios. Q: Does EMVCo also provide the testing for