Terminal Risk Management

Agenda Terminal Risk Management in the End-to-End Process Types of Terminal Risk Management Visa recommendations Summary

Chip End-to-End process AUTHORISATIONS Offline PIN Validation Card holder verification method Terminal Risk Management iCVV checking ATC checking Card Risk Management ISSUER HOST Online CAM Online PIN Script processing

Types of terminal risk management Processing restrictions Terminal risk management Terminal action analysis Terminal Risk Management

Processing restrictions Domestic transactions International transaction Domestic goods International goods Domestic services International services At ATMs At terminals other than ATMs Domestic cashback allowed International cashback allowed Application Usage Control Can this transaction proceed? Version number check VIS 1.3.2 ‘v’ VIS 1.4 Card Date Check Effective Date Expiry Date Check the Location and Device Terminal Country Code Card Country Code Terminal Risk Management

Terminal risk management Traditional Terminal Risk Management Terminal Exception File Check Merchant Force Online Random Selection Floor Limit Check IMPORTANT NOTE: If the terminal floor limit is exceeded the transaction WILL attempt to go online, irrelevant of the cards requirements Terminal Risk Management

Terminal action analysis Terminal reviews the transaction so far Record events so far Have any exceptions been triggered such as Floor Limit, Expired Card, Usage? Can I support online, decline and default transactions? Record ‘position statement’ in the Terminal Verification Result (TVR) Apply actions provided to me by the Acquirer Apply Terminal Action Codes Request a response from the card (Online, Decline, Approve) Terminal Risk Management

Terminal action analysis Terminal Action Codes (TAC’s) Provides the Acquirer with certain transaction protection when exceptions are detected A set of conditions where the terminal will want to: Decline the transaction NOW Approve the transaction Request an online authorisation decision from the Issuer If unable to go online decide to decline because of a certain condition Terminal Risk Management

Visa recommendations (TAC’s) Decline NOW if Go Online if: If unable to go online decline Service not allowed Offline authentication not performed or failed PAN on exception file Card expired Online PIN entered Exceeds floor limit Offline limits exceeded Randomly selected for online Merchant forced online NOTE: If none of the conditions are met the terminal will request that the transaction approves offline Terminal Risk Management

Summary EMV Terminal Risk Management is an extension of magnetic stripe processing Consider domestic processing (BIN Table processing) TAC’s need to be implemented Terminal Verification Result is vital to transaction audit trail Transactions above floor limits will also attempt to go online Terminal will request a response from the card before taking any further action Next session Send the Terminal Request to the card Terminal Risk Management

Floor Limits and How they Impact Chip Floor limits where very common in some markets and in some cases still are. If floor limits exist they can be checked by the chip process and used if they fit in to the process. They do not override the chip. If the merchant use them, they are liable for any fraud under standard scheme rules