Usage of EMV Cards

Using EMV cards for internet transactions

The previous security features of EMV cards all relate to applications where a card comes into contact with a terminal owned by a merchant. In this sense, the card is physically ‘present,’ and the card’s security features can be directly employed.

However, an increasing number of transactions are conducted when the card is remote from the merchant, most commonly when a customer makes an internet transaction. These are referred to as card-not-present (CNP) transactions. The potential for fraud in such transactions is high, since the most common information used to authenticate CNP transactions is simple card data (PAN, expiration date, $CVV_2$), which a determined attacker can relatively easily acquire.

From the cardholder’s perspective, the counter to this threat of fraud is the ability to challenge fraudulent transactions. However, this brings high costs to the merchants and is an inconvenience to the PCOs and cardholders when new cards have to be reissued to customers who have been fraud victims.