References

Pix key resolution, and the rate limiting that exists because the directory maps a phone number to a person's name. The token buckets, the cost of a failed lookup against a successful one, and the ratio a participant is expected to watch are all specified, which tells you enumeration was the anticipated attack.

What a scheme does after an irrevocable transfer turns out to be fraud: the deadlines, the cautionary block, and the tracing through the accounts the money moved to next. Read it beside the settlement-finality material: this is the machinery that exists because settlement cannot be undone.

Settlement finality written as an operating rule rather than a principle, including the part that matters to anyone reasoning about recovery: a transfer is final regardless of whether the participant can yet see the entry.

The document module 12 quotes rather than paraphrases, so you can check every requirement number against the source. v4.0 was retired on 31 December 2024, so a course, a checklist or a consultant still citing 4.0 is citing a withdrawn document. Requirement numbers moved between versions: the rule against storing full track data after authorization is 3.3.1.1 here, not 3.2.

The structure behind a merchant QR: two-digit ID, two-digit length, value; the Payload Format Indicator first and the CRC last, everything between them in any order. It also draws the boundary this course keeps pointing at: inside a merchant account template, the meaning of the data is set by whoever owns the identifier and is explicitly outside EMVCo's scope.

Where module 7's worked example comes from: real published Terminal Action Codes, the zero floor limit, and the Terminal Type values. A rare case of a scheme showing its actual configuration rather than describing one.

The only published table that encodes the Terminal Transaction Qualifiers bit by bit. Kernel 3's own encoding lives in Visa's proprietary VCPS, so where this course draws a TTQ it draws Table 4-16 and says which kernel it belongs to. The Card Transaction Qualifiers has no equivalent published table, which is why only three of its bits are ever labeled here.

The normative source for almost every byte in this course: the TVR bit meanings in Annex C5, the CVM codes and conditions in Annex C3, the cryptogram coding in Table 14, and the command definitions. Where a lesson states what a bit means, it means this.

SDA, DDA and CDA, the certificate chain, and the data elements that go into an application cryptogram. Read alongside Book 3 rather than instead of it.

Table 3, service code assignments, is the source for what each of the three digits means, and for the footnote the downgrade attacks turn on: values 2 and 6 in position 1 indicate the card contains an integrated circuit and the transaction shall be processed from it, if feasible. Those last three words are the standard supplying its own escape clause.

The layer underneath EMV. The command and response APDU structure, the four cases, the status-word scheme, and the 61xx/6Cxx retry mechanics all come from here. EMV inherits them and then narrows them. Module 4 leans on this as heavily as on Book 3.

Presented three weeks before this page was written. Expiry is enforced as a terminal policy check rather than a property of the card, and in the Visa configuration tested that date was not covered by the card's signature, so two phones and a relay revived an expired card at a real terminal. Read it against module 7, where the terminal writes exactly that judgment into the TVR.

The best single starting point if you are new to this field. It organizes the whole literature into seven attack vectors across three areas, application selection, cardholder verification and transaction authorization, which is close to how this course is sequenced, and it compares Visa and Mastercard side by side.

What happens when several parties each retrofit a feature onto EMV independently: offline reader restrictions, transit modes, regional high-value rules. The attacks come from the interactions, not from any one feature, and one of them got a terminal to accept a fraudulent £25,000 payment.

The measurements behind modules 16 and 17: real Level 1 and Level 3 round-trip times, why Visa's L1SessionParameter is not distance bounding, and the L1RP proposal. The source for the sentence that corrected this course: there is no round-trip timing measurement within Visa's protocol.

A Tamarin model of EMV, and the flaws it found. Its companion result, the card brand mixup, which makes a terminal run the wrong kernel, is the step that removes mandatory CDA in the wallet attacks of module 10.

The attack distance bounding cannot address. When a reader is held against a card in a pocket, the card and the terminal are close, so a timing bound measures a short round trip and approves. The defense is answering a question nobody asked. The proposed alternative uses the phone's orientation as the signal instead, and the paper is honest about its error rates.

The relay with no electronics on the victim side: copper coils and tunable capacitors that draw their power from the reader's own field and extend the range to about half a meter. Read it for what a passive relay removes from the attacker's shopping list. It is a range extension, and the timing arguments of module 17 still apply to it.

Terminals whose unpredictable number was a counter, and what that makes possible. Module 14 is built on it. It began with a disputed transaction and a bank that, unusually, produced its logs.

The relay outside payments that module 16 measures against: a physical-layer relay independent of modulation and protocol, tested on ten car models over cable and radio. Read Section 4 for the measured delays. It says nothing about EMV timing itself, which is why the module uses it only as a bound.

The man-in-the-middle that makes a terminal believe a PIN verified while telling the card no PIN was attempted. Module 6 is built on it, and its central observation, that the PIN verification step is never explicitly authenticated, is still the clearest statement of why this class of attack keeps returning.

How to build the hardware that sits between a card and a terminal, from someone who did. Around a hundred pounds of parts, and the reason several results in this course could be demonstrated at all.

What a regulator does when the fraud is entirely above a cryptographically sound rail: split the cost between the sending and receiving institutions. Worth reading by anyone who assumes the answer to authorized-push-payment fraud is a technical one.

Module 10. Transit mode pays from a locked phone, and flipping one byte of tag 9F27 turned the wallet's refusal into an authorization: the Cryptogram Confusion attack.

Module 15. Six cards, five banks, and the cumulative-limit counter reset without ever knowing a PIN, while the card's own IAD said the offline PIN had not been performed.

Eleven cards, ten issuers, and the finding that four of them let a counterfeit magnetic stripe authorize a swipe. The magstripe half of module 13, and the reason module 3 is not history.

The clearest short account of how the contactless kernels actually differ, including the two opposite meanings of AIP byte 2 bit 8 under Kernels 2 and 3, mag-stripe mode and COMPUTE CRYPTOGRAPHIC CHECKSUM, and the measured contactless terminal timeout above fifty seconds that makes relay work practical.

SPEI in the central bank's own words: three-second settlement cycles, balances that are always zero or positive, no credit granted, and an accepted order that is final and irrevocable. The clearest published statement of what finality actually means on a real rail.

My own work on the PIN retry counter. A man-in-the-middle between terminal and card exploits an issuer practice that resets the counter, so all ten thousand four-digit PINs can be tried against a contact EMV card. Read it for the loop and for what the issuer has to change; it does not apply to an issuer that leaves the counter alone.

Where the CVM-required bit in TTQ byte 2 and the CDCVM-performed bit in CTQ byte 2 are demonstrated as attacker-controlled rather than merely specified. Read it beside the contactless limits module: the bits it moves are the ones that decide whether a terminal asks for a PIN at all.

Module 13's spine, and the source of its framing: you cannot economically clone a card, but you can clone a transaction, and legacy support is what makes that true.

A device the size of a card that emulates a magnetic stripe wirelessly, by switching the polarity of a coil until a reader's head sees a swipe. Worth building, and worth reading for the service-code observation in module 3. Kamkar removed the chip-disabling function before release, and says plainly that it does not let you use cards you are not authorized to use.