Appendix F. Visa U.S. Common Debit AID
F.3 Other Approaches
F.3.3 Application Selection for Contactless Transactions and the Visa U.S.
Common Debit AID
Contactless transactions do not support Cardholder Selection in the same way as contact chip transactions due to the minimal interaction between the contactless reader and the consumer device.
The default AID to be selected will normally be the highest priority AID (as identified by the issuer or consumer) on the consumer device. So, if merchants wish to preserve their routing choice for debit functionality or offer additional options (e.g., cash-back), they must override the default selection, preselect the AID, and should preselect the Visa U.S. Common Debit AID. In other words, contactless transactions can ultimately be routed over the Visa U.S. Common Debit AID to the same extent as transactions initiated using other methods, but custom logic will be required.
This approach is discussed in more detail in Section 4.5 and Appendices D and E of the Visa Smart
Debit/Credit and Visa payWave U.S. Acquirer Implementation Guide.
Note: Because MSD processing is functionally equivalent to magnetic-stripe processing (though with the enhanced security of dCVV or CVN 17) and does not rely on the AID selected for routing purposes, routing flexibility for MSD transactions can be accomplished through the use of BIN routing logic.
Assumptions for EMV Processing Approaches
1. U.S. Covered Visa Debit Cards will contain a Visa U.S. Common Debit AID in addition to the Visa
AID. Technically, this assumption is per BIN/PAN. This assumption is likely to remain true for some time (i.e., a given card will only have one source of debit funding).
2. A card may contain both credit and debit functionality. This will be represented by a Visa AID connected to the credit function, and a debit pair consisting of a Visa AID and a Visa U.S. Common
Debit AID both connected to a common source of debit funding. Removal of one of the AIDs of the debit pair from the Candidate List will result in two eligible AIDs. Either the highest priority AID can be selected to initiate the transaction or the two AIDs can be presented to the cardholder for selection. Merchants that wish to maintain routing flexibility will need to deploy specific logic in their readers/terminals to ensure the Visa U.S. Common Debit AID is used for debit functionality, in addition to the non-paired Visa AID for credit functionality.
3. The terminal must pass the AID (contained in the DF Name, Tag ‘84’) used to initiate the transaction to the acquirer or other routing entity in the transaction message to enable the acquirer or other routing entities to perform appropriate routing.
U.S. Territories and Protectorates
If there is a business need in a U.S. Territory to support the Visa U.S. Common Debit AID, the terminal should set the Terminal Country Code (Tag '9F 1A') to '08 40' for the Visa U.S. Common Debit AID only.
This will allow acceptance of the Visa U.S. Common Debit AID.
212 Visa Public November 2016
Appendix G. Contactless ATM Requirements
Transaction Acceptance Device Guide (TADG)
Appendix G. Contactless ATM Requirements
This appendix outlines the requirements and recommendations to support the acceptance of contactless cards and other contactless form factors at ATMs.
Note: This appendix focuses on Visa, Visa Electron, and Plus transactions at ATMs.
G.1 Transaction Processing Overview
Pre-Requisite: The EMV-compliant ATM has been upgraded for qVSDC (VCPS 2.1.1), has undergone required testing, and received the appropriate approvals. For more information on testing and
approvals, refer to Section G.2.1: Device Testing and Certification.
Important: The contactless transaction flow at an ATM follows a similar path to that of a POS transaction, with the key differences that ATMs are online-only, do not perform Pre-Processing, do not perform Offline Data Authentication, and only support Online PIN as the CVM.
1. Transaction Initiated—The cardholder initiates a contactless transaction by tapping the card on the contactless landing plane. The device obtains and reads the PPSE from the card.
2. Application Selected—The ATM selects the highest priority, mutually supported contactless application.
58
3. Data and Cryptogram Obtained—The transaction begins with the ATM obtaining data from the contactless card. This includes the ATM sending the card the GET PROCESSING OPTIONS command. Since the amount and transaction type are not known at this time, the ATM sends the card a zero amount and a default transaction type of Cash Disbursement to use in cryptogram generation. The card responds to GET PROCESSING OPTIONS with data including the cryptogram.
If additional card data is required for the transaction, the ATM sends one or more READ RECORD commands to the card to retrieve the additional data.
Note: Assuming that the cardholder requests a Visa-related service (i.e., Cash Disbursement,
Balance Inquiry, or Funds Transfer) in Step 6 below, the ATM will submit the cryptogram and its
associated data in the online authorization request to the issuer (refer to Step 8).
Now that the ATM has all the information it needs from the card, the interaction between the ATM and the card is complete. The ATM powers off the contactless interface and informs the cardholder that the card can be removed from the landing plane.
58 If the ATM supported a separate domestic debit application selection process, it would take place at this time.
November 2016 Visa Public 213
Appendix G. Contactless ATM Requirements
G.1 Transaction Processing Overview
4. ATM Offline Check Performed—The ATM may optionally perform the ATM Offline Check
Processing Restriction. With this check, the ATM reviews the Card Transaction Qualifiers (CTQ)
(obtained from the card) and may also review the Application Usage Control (AUC) (also obtained from the card). This information is used to determine whether the contactless ATM transaction should be sent online, declined offline, or switched to the contact chip interface. When the ATM
Offline Check Processing Restriction is not supported, all contactless ATM transactions are sent online.
Note: The ATM Offline Check is strongly recommended in the Europe Region and optional everywhere else.
Exception: If the ATM is unable to proceed with the transaction based on the results of the ATM
Offline Check, the ATM will display an appropriate message to the cardholder about the next step
(the cardholder is requested to insert his/her card into the ATM to complete the transaction or use another card).
5. Online PIN Requested—The cardholder is requested to enter his/her Online PIN. The PIN is
captured and may be submitted in the online authorization request in Step 7.
6. ATM Services Offered—The ATM presents its services to the cardholder and the cardholder selects a Visa-related service (such as Cash Disbursement, Balance Inquiry, or Funds Transfer).
Note: An ATM enabled to support contactless transactions should aim to support the same range of Visa transaction types for contactless transactions as for contact chip.
7. Online Authorization—The ATM sends an online authorization request to the issuer. This message
includes the cryptogram obtained from the card in Step 3 as well as the Online PIN obtained from
the cardholder in Step 5. While the amount and transaction type associated with the cryptogram
are zero and Cash Disbursement respectively, the amount and transaction type in the standard authorization message fields reflect the actual amount of the transaction and its transaction type.
Note: This means that the amount in Field 4 and Field 55/Expanded Third Bit Map and the
Transaction Type in Field 3 and Field 55/Expanded Third Bit Map may not match.
8. Service Processed—Assuming that the transaction is approved, the ATM carries out the service
(e.g., dispensing cash, displaying available balance, transferring funds, etc.).
Exception: If Visa declines the transaction with Response Code 57, the ATM may optionally check the Form Factor indicator and, based on the form factor used, can use this information to display a tailored message to the cardholder about the next. For example: “Insert card” or “Use another card to complete the transaction”.
Transaction Chaining (Not Outlined in the Flow Diagram)—If the cardholder would like to perform another transaction (for example, a Cash Disbursement after a Balance Inquiry), PIN entry is required but re-tapping the card on the contactless interface differs depending on whether the transaction is financial or non-financial:
214 Visa Public November 2016
Appendix G. Contactless ATM Requirements
Transaction Acceptance Device Guide (TADG) a) Financial Transactions (e.g., Cash Disbursements)—PIN entry is required and re-tapping is recommended. b) Non-Financial Transactions (e.g., Balance Inquiries)—PIN entry is required and re-tapping is optional.
November 2016 Visa Public 215
Appendix G. Contactless ATM Requirements
G.1 Transaction Processing Overview
Figure G–1: Contactless ATM Transaction Flow
216 Visa Public November 2016
Appendix G. Contactless ATM Requirements
Transaction Acceptance Device Guide (TADG)
G.2 Requirements
This section outlines the requirements associated with contactless-enabled ATMs.
G.2.1 Device Testing and Certification
The device must be tested prior to deployment. The testing requirements differ depending on whether the device was developed to:
•
VCPS (Table G–1: VCPS—Device Testing)
•
EMV Contactless Specifications for Payment Systems (Table G–2: EMV Contactless Specifications for
Payment Systems—Device Testing)
Refer to the appropriate table for the testing information.
The table below summarizes the contactless specific elements of a terminal implemented using VCPS that require testing and approval.
Table G–1: VCPS—Device Testing
Component Tested/Certified by
Contactless-Enabled ATM
59
Europe Region:
Acquirer through VpTT (test results approved by the Europe Region)
Visa (except for Europe Region):
Acquirer through Acquirer Device
Validation Tool (ADVT) and
Contactless Device Evaluation Tool
(CDET)
Visa Contactless Reader
Application
Contactless Communication
Layer
Visa Inc. Approval Services
EMVCo
Reference
This document
Europe Region: Visa Europe payWave Terminal Test Procedures
This document
Visa Inc.: ADVT User Guide, CDET
User Guide
Visa Contactless Payment
Specification
EMV Contactless Specifications for
Payment Systems (Book D)
59
If supported, the ATM Offline Check processing restriction described in Section G.2.12: ATM Offline Check Processing
Restriction must be implemented in the ATM system (not the reader kernel).
November 2016 Visa Public 217
Appendix G. Contactless ATM Requirements
G.2 Requirements
The table below summarizes the contactless specific elements of a terminal implemented using EMV
Contactless Specifications for Payment Systems that require testing and approval. The highlighted row identifies the differences between devices implemented using EMV and VCPS.
Table G–2: EMV Contactless Specifications for Payment Systems—Device Testing
Component Tested/Certified by Reference
Contactless-Enabled ATM
60
Europe Region:
Acquirer through VpTT (test results approved by the Europe Region)
Visa (except Europe Region):
Acquirer through Acquirer Device
Validation Tool (ADVT) and
Contactless Device Evaluation Tool
(CDET)
EMVCo contactless reader application (including Entry
Point and Kernel C-3)
EMVCo
Contactless Communication
Layer
EMVCo
This document
Europe Region: Visa Europe payWave Terminal Test Procedures
This document
Visa Inc.: ADVT User Guide, CDET
User Guide
EMV Contactless Specifications for
Payment Systems
(Books A, B, C-3)
EMV Contactless Specifications for
Payment Systems
(Book D)
G.2.2 Supported Interfaces
An ATM which is capable of processing contactless transactions shall also be capable of processing contact chip and magnetic-stripe transactions.
G.2.3 Mandatory and Not Supported Features
The contactless-enabled ATM shall support all mandatory features and transaction types listed in the following table to the extent described.
The contactless-enabled ATM shall either not support, or shall disable, all features and transaction types listed in the below table as ’Not supported’.
60
If supported, the ATM Offline Check processing restriction described in Section G.2.12: ATM Offline Check Processing
Restriction must be implemented in the ATM system (not the reader kernel).
218 Visa Public November 2016
Appendix G. Contactless ATM Requirements
Transaction Acceptance Device Guide (TADG)
Table G–3: Mandatory and Not Supported Features
Contactless ATM Features Requirements
MSD qVSDC
Offline Authorization
Online Authorization
Online PIN
Signature
Receipts
Not supported
61
Mandatory
Not supported
Mandatory
Mandatory
This is the only Cardholder Verification Method permitted at ATMs
Mandatory
In order to maximize card acceptance, support for Signature CVM must be indicated, although Online PIN will be the CVM that is performed for all contactless-initiated ATM transactions
Mandatory
Same requirements as contact; Refer to the Section 2.7: Transaction
Receipts for details
Consumer Device CVM (CDCVM) Mandatory
Support for CDCVM is mandatory in Visa Contactless Payment
Specification and EMV Contactless Specifications for Payment Systems
Kernel 3, although Online PIN will be the CVM that is performed for all contactless-initiated ATM transactions
Pre-Processing
62
Not supported
63
Contactless-enabled ATMs do not perform pre-processing and the reader is always initiated in the Ready to read state
Offline Data Authentication
(For qVSDC – fDDA)
Dynamic Reader Limits
Not supported
Not supported
Not supported Capability to display and print
Available Offline Spending
Amount
Contact Chip
Issuer Update Processing
Mandatory
Not supported for contactless (but Mandatory for contact)
61 MSD acceptance remains optional in the U.S. region but is strongly discouraged.
62 As described in Visa Contactless Payment Specification and EMV Contactless Specifications for Payment Systems.
63 As per the Visa Contactless Payment Specifications, ‘pre-processing’ refers to a terminal obtaining the transaction amount and performing the reader risk management prior to a contactless transaction being initiated.
November 2016 Visa Public 219
Contactless ATM Features
ATM Offline Check
Form Factor Indicator Check
Form Factor Indicator
Customer Exclusive Data
Appendix G. Contactless ATM Requirements
G.2 Requirements
Requirements
Strongly Recommended in the Europe Region
Optional in all other countries
Optional
Conditional
Must be provided in authorization message if present on card
Conditional
Must be provided in authorization message if present on card
G.2.4 Security Considerations
Contactless-enabled ATM vendors should follow industry best practices when designing and developing solutions to ensure payment data and transaction security.
Vendors should take all reasonable steps to design the ATM such that the contactless reader cannot be covered or obscured by a fraudster seeking to force a compromised magnetic-stripe slot to be used.
Contactless readers should be integrated into the overall design of the ATM in a seamless manner and avoid the appearance of being an external attachment.
The contactless-enabled ATM shall provide a mechanism to protect all Visa contactless configuration data from being loaded, altered, or deleted without the appropriate authority (for example, by the acquirer or merchant).
G.2.5 ATM Transaction States
In terms of the processing defined in Visa Contactless Payment Specification and EMV Contactless
Specifications for Payment Systems, when a contactless card is presented to the reader at a contactless-enabled ATM, the interaction between the two is limited to that performed between the following two transaction states:
•
Ready to read— The reader is ready to read a contactless card.
Note:
Contactless ATMs do not support Pre-Processing.
•
Card read complete— The interaction between the card and the reader is complete and the cardholder can remove the card from the landing pad.
220 Visa Public November 2016
Appendix G. Contactless ATM Requirements
Transaction Acceptance Device Guide (TADG)
The contactless transaction stops at this stage, and the contactless-enabled ATM continues with all further processing.
64
Indication of the Card read complete transaction state to the cardholder is required. This may be done using either a dedicated message for this purpose or a message that indicates the next step to be taken by the cardholder. For example, if the next step to be taken by the cardholder is the entry of their PIN, the vendor or service provider may choose to display a message to the cardholder stating,
“Please enter your PIN” as the indication of the Card read complete transaction state.
G.2.6 Performance Requirements
Per the Visa Contactless Payment Specification and the EMV Contactless Specifications for Payment
Systems the time between:
•
Card discovery (the start of the first ISO 14443-3 command from the reader to which the card responds), and;
•
The completion of card read (the point at which communication is no longer required with the card such that the contactless interface can be powered off)
65
Shall not exceed 500ms for a transaction where the card read completes successfully with no communication errors.
400ms of the 500ms is reserved for card processing and radio frequency (RF) level communication from the card to the reader. Consequently, all contactless-enabled ATM system processing and RFlevel communication from the reader to the card shall be performed within 100ms.
64 Unless “transaction chaining” takes place (i.e., where the cardholder wants to perform another transaction during the same session). If the subsequent transaction is a financial transaction, PIN entry is required and re-tap is recommended; if the subsequent transaction is non-financial transaction, PIN entry is required and re-tap is optional.
65 EMV Contactless Specifications for Payment Systems Book A section 10.1 describes the methods by which the performance can be measured. Some contactless-enabled ATMs may not provide a user interface indication to the cardholder that their card may be removed. Therefore, terminals without an audio or visual indication of card read complete must make special provision for testing as described therein.
November 2016 Visa Public 221
