← Payment Systems: Magstripe, Tokenization, NFC and EMV
Level 2 · Practitioner55 min
Cardholder verification and the PIN
The CVM List in tag 8E, how a terminal walks it to choose a method, what tag 9F34 records afterwards — and the man-in-the-middle that let a terminal believe a PIN was verified while the card was never asked for one.
Enrolment required
Module 1 of this course is free to read. The rest needs an enrolment — and so does nothing else on this site: the workbench, the APDU decoder and the whole capture corpus stay open to everyone, signed in or not.
What this module covers
- 01What has to be true before any of this runs
- 02The CVM List, tag 8E
- 03Reading one CV Rule
- 04Four real lists, side by side
- 05How the terminal walks the list
- 06Offline PIN on the wire
- 07What the terminal writes down: tag 9F34
- 08A CVM List rewritten in flight
- 09The wedge
- 10Precisely which check would have caught it
- 11Yes cards are a different animal
- 12How you would actually see this
- 13What to carry out of this