EMV (Europay, Mastercard, Visa)

What Is EMV?

EMV (Europay, Mastercard, and Visa) is the global standard for smart payment card technology that defines how chip-based payment cards and terminals communicate. In the NFC context, EMV Contactless specifications govern how contactless payment transactions are processed when a consumer taps their card, phone, or wearable on a POS terminal. EMV is managed by EMVCo, a consortium owned by the six major payment networks: Visa, Mastercard, American Express, Discover, JCB, and UnionPay.

EMV Contactless Architecture

The EMV Contactless specifications build on the ISO 14443 physical layer and add payment-specific application protocols. The architecture consists of four specification levels:

Each payment network defines its own Level 2 kernel: Visa payWave (Kernel 3), Mastercard PayPass (Kernel 2), American Express ExpressPay (Kernel 4), and so on. A POS terminal must implement all kernels for the card schemes it supports.

Transaction Flow

An EMV Contactless transaction follows a standardized sequence within milliseconds of the tap-to interaction:

1. Polling. The terminal polls for NFC-A and NFC-B devices at the operating frequency of 13.56 MHz.
2. Entry point. The terminal activates the card and reads the Proximity Payment System Environment (PPSE) to discover available payment applications.
3. Application selection. Based on the PPSE response, the terminal selects the preferred payment application using its AID.
4. Kernel processing. The scheme-specific kernel manages the exchange of transaction data, risk assessment, and cryptogram generation.
5. Outcome. The kernel returns an outcome (approved, declined, try another interface) that the terminal acts upon.

Offline vs Online Authorization

EMV supports both offline and online transaction authorization. In offline mode, the card or secure element independently validates the transaction against stored risk parameters (spending limits, transaction counters). If the transaction exceeds offline limits or the risk parameters require it, the terminal performs online authorization by connecting to the card issuer's backend.

Contactless transactions below the cardholder verification method (CVM) limit typically proceed with no cardholder verification (NoCVM). Above the CVM limit, the terminal requests a PIN or device-based authentication (fingerprint, Face ID). These limits vary by country and card network.

EMV and NFC Security

Every EMV transaction generates a unique Application Cryptogram (AC) using symmetric (AES or 3DES) or asymmetric cryptography. This cryptogram proves the card's authenticity and the transaction's integrity. Even if an attacker intercepts the transaction data, the cryptogram cannot be reused for a different transaction, making replay attacks ineffective.

EMV Contactless vs Chip-and-PIN

EMV Contactless uses the same underlying security as chip-and-PIN transactions but optimizes for speed. The contactless interface skips the time-consuming chip-and-PIN insertion and PIN entry process, completing most transactions in under 500 milliseconds. This speed advantage is the primary driver of contactless payment adoption worldwide.