Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Payments > Card Payments Data > Flashcards

Card Payments Data Flashcards

1
Q

Level 1

A
  • Consumer transactions

Merchants are only required to transmit the three data elements when accepting these payments:
1. Transaction amount
2. Transacton date
3. Merchant’s name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Level 2

A
  • Business to Business (B2B) and Business to Government (B2G)

“Companies might benefit from making more data available when processing card transactions”
- tax information
- additional customer information
- merchant ZIP

  • Commercial, corporate, purchasing and government cards are eligible for Level 2 processing, but not consumer cards (which can only be processed at level 1)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Level 3

A
  • Includes all Level 2 data and items such as invoice information, product information, quantity, unit of measure, postal code, VAT, and freight amount
  • Historically, these transactions could only be accepted virtually (they were beyond the capabilities of traditional hardware POS terminals)
  • Increasingly, modern card payment terminals offer Level 3 capability through touchscreen technology (Smart POS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Summary of the levels:

A

“The higher the level, the more data is processed and transmitted to the issuer as part of the card transaction”

  • Accepting Level 2 and Level 3 cards means that the merchant has to explicitly input more data at the point of interaction (through their PSP)
  • The benefits of utilizing level 2/3 processing are significant. Businesses can access reduced interchange rates, resulting in potential savings of 0.45% to 1% per transaction
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Implications for risk

A

“The greater the amount of data that is transmitted to the issuer, the more able they are to make better risk decisions”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

PAN

A
  • Primary Account Number
  • Follows the ISO 7812 standard

“Essentially, a card using the ISO 7812 standard can be read in a card terminal”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

First digit of PAN

A

MII - Major Industry Identifier

  • Identifies the industry or type of card

4 for Visa
5 for MC
3 for travel and entertainment cards (Amex & Discover)
7 for Petroleum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Digit 1-6 of PAN (since 2022 1-8)

A

BIN - Bank Identification Number (Issuer Identification Number)

  • The BIN enables you to identify a number of elements, including the card scheme, the issuer, they type of card (credit or debit) and the country
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Digit 7-15 of PAN

A

Cardholder Account Number

  • This identifies the cardholder
  • In the past, you may have come across card where this number was all zeros: These were anonymous prepaid cards, which have been banned in most geographies according to Anti Money Laundering regulations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Last Digit of PAN

A

Check-digit and is added to validate the authenticity of the credit card number (based on the Luhn algorithm)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The BIN enables you to identify a number of elements:

A
  • Card scheme
  • Issuer
  • Type of card (credit, debit, purchasing)
  • Country
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

BIN Sponsorship

A

“A BIN sponsor (a bank) enables other eligible organizations to issue cards by allowing them to use BIN ranges that they control”

  • This gives them quick time to market
  • Many neo banks used BIN sponsors before obtaining a banking license themselves
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

EMV Chip

A

“The chip contains the data required for EMV transactions at the POS”

Standards:

  • ISO 7816 for contact
  • ISO 14443 for contactless

The data on the chip will be read when:

  • the card is inserted into the card terminal (contact transaction)
  • The card is held close to the terminal (contactless transaction)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Magnetic Stripe

A
  • Constructed in accordance with ISO 7813

“Card swipe is the term used for a card payment transaction using the magstripe”

➡️Increasingly, modern cards do not include a magstripe

  • Two magnetic tracks are used for data storage: Track 1 and Track 2
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Hologram

A
  • Security feature originally designed to prevent fraudsters from cloning cards, as it is difficult to reproduce
  • For visa it is a dove
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Signature Panel

A

The cardholder’s signature is used to authenticate the cardholder for face- to-face transactions in chip and signature or non-EMV markets

  • Increasingly on modern cards, the signature panel is not present
17
Q

Card Verification Value (CVV or CVC)

A
  • 3 digits for Visa & MC
  • 4 digits for American Express

“The CVV is used to authenticate remote transactions (e.g. e-commerce or telephone) by verifying that the card- holder has the card in their possession”

  • It is intended for the cardholder’s eyes only and not machine readable

“The technical term, as defined in the standard, is CVV2”

  • Whilst there are other card verification values (CVV1, CVV3) the term ‘CVV’ in day-to-day life refers to the CVV2 because this is what cardholders see
18
Q

Wrapper

A

“The data remains the same regardless of the ‘wrapper’ (smart watch) you put around a card”

19
Q

Service Code

A
  • Is a 3 digit value encoded into the magnetic stripe
  • Used by Issuers to tell merchants how the card can and cannot be used
  • For example, whether the card is for international use or domestic use only, or if a PIN is required for all transactions, or if it’s only to be used at ATMs
  • For instance, the comdirect debit has a service code of 221and means the transaction has to be authorized online (hence cannot be used at offline terminals)
  • Another example: 520 - Card is domestic only, transaction has to be authorized online and PIN is required
20
Q

CVV1

A

CVV1 is used in card-present transactions to verify if the data is valid and issued by a banking institution. It is provided in the card’s magnetic stripe

  • During a transaction, the CVV1 is sent to the card issuer as part of the authorization request. The issuer checks the CVV1 against the value it has on record for the card
  • It adds a layer of security that makes it more challenging to create a fully functional cloned card without the correct CVV1
21
Q

CVV2

A

CVV2, unlike CVV1, is a code printed on the card. It is used in the case of a card, not present transactions such as mail order/ telephone order (MOTO) or internet. It acts as an added security feature for preventing potential frauds

22
Q

iCVV

A
  • The chip does not contain the same card verification value as the magstripe, but an alternative value (iCVV)

“The iCVV is generated by the chip and the card reader for each transaction (it is dynamic) using a different calculation from that used for the CVV1 on the magstripe”

23
Q

Skimmer

A

A device used by fraudsters to read information from the magstripe

  • Found at ATMs and petrol stations and other unattended terminals

“Skimmers are devices overlayed on top of the card terminals, and sometimes combined with small cameras to capture the PIN”

24
Q

Shimmer

A

A shimmer (aka “shim”) is a device used to capture data from the EMV chip

25
Q

Security Benefit of Contactless:

A

The only difference is that the card will not be inserted in the terminal, thereby preventing both skimming and shimming attacks

26
Q

Level 3 Data Acceptance Options

A
  • Historically, these transactions could only be accepted virtually and often integrated with enterprise resource planning platforms such as SAP or Oracle
  • This is because they were beyond the capabilities of traditional hardware POS terminals (as many of the data elements require text input and standard card terminals have basic numeric keypads)
  • Increasingly, modern card payment terminals offer Level 3 capability through touchscreen technology
  • These card terminals are called Smart POS and support standard card payments as well as a range of applications supporting a merchants business
  • These modern terminals are usually cloud based and based on open operating systems such as Android
27
Q

Chip and PIN

A

A Personal Identification Number (PIN) – a four-digit code selected and managed by the cardholder – is used to authenticate face-to-face transactions at the physical POS

28
Q

Chip and Signature

A

A signature is used to authenticate face-to-face transactions at the physical PO

29
Q

Five basic elements for the data contained in the card

A
  1. PAN
  2. Name
  3. Expiry Date
  4. Service Code
  5. Discretionary Data

➡️ These elements are contained in the Track 1 and Track 2 of the magstripe as well as in the EMV chip

30
Q

Discretionary Data

A

“Used by issuers as they see fit”

  • Used for security
  • On Tracks 1 and 2, it may include PIN verification elements and a card verification value called the CVV1. The CVV1 is used to authenticate magstripe transactions
31
Q

Summary Verification Value

A

Both CVV1 (magstripe) and CVV2 (printed on card) are static data elements (i.e. they remain valid for the life of the card). The iCVV is dynamic and can’t be used twice

32
Q

Two Standards for EMV Chips

A
  1. Contact
  2. Contactless

“Security measures are the same”
- iCVV will work in the same way (dynamic, generated each time)

“Only difference is that the card will not be inserted in contactless preventing skimming and shimming”

33
Q

Dynamic CVV

A

“This is where the issuer supplies the cardholder with a little device as well as a card. The little device calculates a dCVV each time a remote trans- action is initiated by the cardholder, and this the three-digit number that the cardholder would use on an e-commerce website”

  • This can also be achieved through the card itself, where a small electronic screen is embedded directly into the back of the card to perform the same function
34
Q

Summary Why ICVV is Better Than CVV1

A

CVV1 is easier to clone because the data does not change.

  • A skimming device can capture all necessary information to create a counterfeit card
  • Much harder to clone because the data changes with each transaction. Even if data is intercepted, it’s useless without the ability to generate the correct dynamic iCVV for future transactions

Payments (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions