8E Cardholder Verification Method (CVM) List

The CVM List tells the terminal how the issuer wants the cardholder to be verified: online PIN, offline PIN, signature or nothing. It is a card data object read during READ RECORD, and the terminal processes it during cardholder verification when the AIP says the card supports it.

Structure

• Amount X, 4 bytes, and Amount Y, 4 bytes: binary amounts in the application currency, used by some conditions.
• CV rules, 2 bytes each, in priority order. The first byte is the method; the second is the condition.

In the method byte, bit 7 means "if this CVM fails, apply the next rule". If it is clear, a failure ends cardholder verification as failed. Bits 6–1 give the method: 01 plaintext offline PIN, 02 enciphered PIN online, 04 enciphered offline PIN, 1E signature, 1F no CVM required, among others. The condition byte says when the rule applies: always, if the terminal supports the CVM, if unattended cash, or under or over amount X or Y, and so on.

Example

8E 0E 00000000 00000000 4203 1E03 1F00

• Amounts X and Y are zero.
• 42 03: enciphered PIN online, if the terminal supports it; if it fails, try the next rule.
• 1E 03: signature, if the terminal supports it.
• 1F 00: no CVM required, always.

The terminal walks the rules in order and uses the first one whose condition is met and which it can perform. The outcome is recorded in the CVM Results and, on failure, in byte 3 of the TVR.

Contactless

Contactless kernels use the CVM List differently, or not at all. They also apply a reader CVM required limit set by the acquirer, and several kernels support consumer device CVM on phones. Kernel 3, for example, decides the CVM from the TTQ and the card's own qualifiers.

Common mistakes

• Ignoring bit 7, so a failed PIN never falls back to the next rule, or always does.
• Comparing amounts X and Y with an amount in another currency.
• Treating "No CVM required" and "No CVM performed" as the same. They are different codes and appear differently in the results.