Module 6 of 22 · Practitioner · 55 min
Cardholder verification and the PIN
The CVM List in tag 8E, how a terminal walks it to choose a method, what tag 9F34 records afterward, and the man-in-the-middle that let a terminal believe a PIN was verified while the card was never asked for one.
Enrollment required
Module 1 of this course is free to read. Buying the course opens every other module, the transaction lab and search across the course. The workbench and the APDU decoder stay free for anyone.
The course is tied to your account, so you sign in first and come straight back here.
One payment for this course. Access for as long as the course exists, with every update and new research module that follows, at no further cost.
No hardware is sold here, and none is needed to read the course.
Payments are final. Module 1 is free so you can judge the course before you pay. Terms
Already enrolled? Sign in
Open the free workbench →What this module covers
- 01What has to be true before any of this runs
- 02The CVM List, tag 8E
- 03Reading one CV Rule
- 04Four real lists, side by side
- 05How the terminal walks the list
- 06Offline PIN on the wire
- 07What the terminal writes down: tag 9F34
- 08A CVM List rewritten in flight
- 09The wedge
- 10Which check would have caught it
- 11Yes cards are a different animal
- 12How you would actually see this
- 13What to carry out of this