update on inline testing of emv cards - icma · 2017. 12. 8. · card stock verification...

Br ian Summerhayes

Managing Director

Barnes Internat ional

© 2015 BARNES INTERNATIONAL LIMITED 1

Update on Inline Testing of EMV Cards

ICMA Expo

Phoenix, March 2015

A LOOK AT THE DEVELOPMENTS AND NEW TRENDS IN INLINE TESTING AND HOW THEY MAY AFFECT YOUR BUSINESS

Agenda

Inline Perso Quality Control Options

Inline QC + Offline Card Personalisation Validation Testing QC

100% Inline QC with Card Personalisation Testing Validation QC

Benefits and Implications


Personalisation Quality Control Testing


Introduction


Chip cards have far more complicated coding compared with a simple magnetic stripe

Chip cards have far more information inside them compared with a magnetic stripe

Dual interface cards are also complex to code with shared parameters

• Magnetic Stripe vs Chip Data

• Correct Keys • Validation vs

Payments Scheme

• Issuer/ Card Tag values

Data sent to card during personalisation


Data Elements

Magnetic StripeContact Chip DataContactless Chip Data (if DI or CL card)Cryptographic KeysEmbossing on card facePrinting, including CVV on reverse

Personalisation QC


Quality Control of the cards in manufacturing and during personalisation is essentialChip cards – many data Tags any one of which could be incorrectly set upChip cards are far more expensive than magnetic stripe and thus are costly

to reissueReputation/customer service impact can result in substantial lost revenue

Offline or Inline Quality Control of the cards during personalisationOfflineSingle Card tests with Batch Testing

InlineEnables 100% testing

PersoMachine Controller

EMV Card Perso with Offline QC


PersoData File

Mag‐Stripe Encode Emboss Chip Perso

Finished Card

Blank Card

Card Movement Perso Data Flow

CryptoKeys

Chip TAG

ValuesEmboss Data

Mag Stripe Data

Audit Log

Audit Data Flow

Offline CPT


Inline QC Testing – Offline EMV Data Validation


PersoData File

Mag‐Stripe Read


Reject Bin

Test StationFinished Card

Blank Card


Chip Read Camera Image Gate

CryptoKeys

Chip TAG

ValuesEmboss Data

Mag Stripe Data

Audit Log

QC Data Flow

Offline CPT

Magnetic Stripe QC


Magnetic Stripe – standard inline QC

Collected by Magnetic Stripe read headReads all 3 tracksMagnetic stripe data sent to Perso Machine ControllerValidation vs input file

Drawback: System assumes data sent in Perso file was valid

Magnetic Stripe – QC data validated by inline Card Perso Tool

Collected by Magnetic Stripe read headReads all 3 tracksMagnetic stripe data sent via Perso Machine Controller to CPTCorrelation vs ISO data rulesValidation vs input file &/or against Magnetic Stipe equivalent data in ChipValidation of iCVV/ Chip CVC/ iCSC/ Chip CAV

Contact Chip QC


Contact Chip Data – standard inline QC

Chip ATR activated and read by Contact couplerATR sent to Perso Machine ControllerConfirms that chip is working

Drawback: Unable to fully validate personalised data

Contact Chip Data – QC data validated by inline Card Perso Tool

ATR activated and APDUs sent to the chip by Contact couplerAPDU responses data sent via Perso Machine Controller to CPTCorrelation vs EMV, Payment Scheme Application rulesValidation of Tag values against test Scenario values (Issuer / card)Chip Data Validation vs Mag Stripe & Contactless ChipValidation that correct Keys were put onto the card

Contactless Chip QC


Contactless Chip Data – standard inline QC

Chip ATS activated and read by Contactless couplerATS read and sent to Perso Machine ControllerConfirms that contactless chip is working

Drawback: Unable to fully validate personalised data

Contactless Chip Data – QC data validated by inline Card PersoToolATS activated and APDUs sent to the chip by Contact couplerAPDU responses data sent via to Perso Machine Controller to a CPTCorrelation vs EMV, Payment Scheme Application rulesValidation of Tag values against test Scenario values (Issuer / card)Contactless Chip Data Validation vs Mag Stripe & Contact ChipValidation that correct Keys were put into the contactless chip

Embossing Verification


Embossing – standard inline QC

Camera recognition checks character impression on spent topping foil Uses OCR recognition to recreate embossing data Embossing sent to Perso Machine Controller Validation vs input file

Drawback: No validation against Mag Stripe or Chip cardholder data, issue and expiry dates

Embossing – QC data validated by inline Card Perso Tool Camera recognition checks character impression on spent topping foil Uses OCR recognition to recreate embossing data Embossing sent via Perso Machine Controller to CPT Validation vs Data personalised in Magnetic Stripe and Chip

Advantage: This is superior to an offline CPT where operator checks embossing against screen image

Card Stock Verification


Card Stock verification – standard inline QC

Vision system captures image of front and back of card including stock reference Images sent to Perso Machine Controller Validation vs images of correct card stock for the card batch

Drawback: Validation separate from the rest of card validation test

Card Stock verification – QC data validated by inline Card PersoTool Vision system captures image of front and back of card including stock reference Images sent via Perso Machine Controller to a Card Perso Tool (CPT) Card stock reference recorded in card validation file

Potential for 100% Data QC


Data – read by Mag Reader/ Chip Couplers

Magnetic StripeContact Chip DataContactless Chip Data (if Dual Interface or CL card)Cryptographic Keys

Data – read by Camera

Embossing on card facePrinting, including card stock ID and CVV on reverse

For 100% QC All Data Elements should be Validated

Inline QC Testing Architecture


Offline CPT with GUI

Scenario creationFailure investigation

QC Test Scripts and Scenarios

Bespoke Scripts & Scenarios

CPT Test Engine

Perso Machine Interface Module

Card Perso Machine

Inline QC Testing with Card Personalisation Validation

Machinery Manufacturer QC module(s) to collect data

Magnetic Stripe

Contact and Contactless Chip Data

Printed/ Embossed Data

Data Collection: Machine Modules

Validates data to EMV and payment scheme requirements

Confirms chip, Mag‐stripe and embossing correlation (depending on machine modules)

Identifies incorrect data or keys

Contact and Contactless chip validation tests

Multiple Application data validation

Validation: CPT Test Engine

Good / Bad card result

Bad card reject

Test Result recorded – for audit purposes

Test Results can be saved

Reporting: Machine interface &/or CPT Report

16© 2015 BARNES INTERNATIONAL LIMITED


Inline Testing – 100% EMV Validation QC


PersoData File

Mag‐Stripe Read


Reject Bin

Test Station with inline CPT

moduleFinished Card

Blank Card


Chip Read Camera Image Gate

CryptoKeys

Chip TAG

ValuesEmboss Data

Mag Stripe Data

QC Management

Audit LogOffline CPT

Test Scenarios

QC Data Flow

Offline CPT

100% Inline QC Testing is a reality


Proven Technology2 Perso Machine ManufacturersFor small and large operationsMachine speeds: 200 cph to 2,500 cph

4 Bureaus in US running 100% QC

Automated Card Vaults with Automated Hopper Filling

Inline Testing


Data loaded into card using “Store Data” APDUs, data is organised in Data Group Indicators (DGIs)

Differences in techniques and formats depending on the card stock and operating system

Data extracted from card using EMV defined APDUs, data is organised by files and records

All cards must present the same interface to the terminal, regardless of internal organisation

Inline Testing Time

Not necessary to slow machine speed

© 2015 BARNES INTERNATIONAL LIMITED

1 Testing Coupler per 2 Perso Couplers

EMV Contact Chip Personalization time: 10‐20 seconds Testing time: 6‐10 seconds

EMV Dual Interface Personalization time: 13‐23 seconds Testing time: 8‐12 seconds

Source: Customers 20

Inline Justification Benefits of 100% QC


Benefits in Throughput

All cards tested over all interfaces in real time Mag – Contact /Contactless Chip – Embossing correlation Full EMV Test Eliminate customer Card quality issues

No loss of machine speed Batches of mixed card types can be combined Rainbow Perso Less make ready time = Greater Productivity

21

Magnetic Stripe & Chip Data


Magnetic Stripe and Chip (ICC) comparison Validated

PAN Cardholder Name Expiration Date Service Code Discretionary Data

Contact Chip vs Contactless Chip data comparison

22

Customer Benefit – 100% Cards Tested


Elimination of customer card quality issues

100% cards tested as working

Bureau Audit Trail Better Reputation/ Rating Commercial Selling Point

Issuer 100% confidence good card holder experience Avoid non‐working card to back of wallet

23

Throughput Benefit


Increase Machine Productivity

Objective: Avoid effect of decreasing Batch Sizes on productivity

24

Offline Card QC Steps


Steps in an Offline EMV Chip Card Test

1. Run 1 card/ Stop Perso Machine2. Select and carefully Remove card3. Walk/ Move to offline QC station4. Log In to offline CPT5. Select Test Scenario (can be automated)6. Insert card in card reader7. Card test run + Result shown + Check passed8. Check Embossing on card vs screen9. Log Out of offline CPT10. Walk / Move back to Perso machine11. Carefully Reinsert Card12. Begin Batch Run

25

Offline QC ‐ Time


Steps in an Offline EMV Chip Card Test: 2 mins 45 secs = 165 secs

1. Run 1 card/ Stop Perso Machine 60 secs2. Select and carefully Remove card 10 secs3. Walk/ Move to offline QC station 20 secs4. Log In to offline CPT 10 secs5. Select Test Scenario (can be automated) 8 secs6. Insert card in card reader 2 secs7. Card test run + Result shown + Check passed 10 secs8. Check Embossing on card vs screen 4 secs9. Log Out of offline CPT 1 secs10. Walk / Move back to Perso machine 20 secs11. Carefully Reinsert Card 10 secs12. Begin Batch Run 10 secs

Source: Barnes Estimates

Test Result


Desired Result:

2727

Batch Sizes – The Problem with Offline QC

As Banks develop more card models, cards/per batch decreases

% time machine running (based on 1,700 cph)


Batch Size Offline QC Time*1,000 5 ½ minutes/ ‘000 cards500 11 minutes/ ‘000 cards100 55 minutes/ ‘000 cards50 1 Hr 50 minutes/ ‘000 cards

Source: Barnes Estimates

Batch %1,000 87%500 76%100 39%50 24%

28

Inline QC with Rainbow BatchesRainbow Batch


Multiple small batches combined into one batch Multiple Perso Data files organized and joined Card Stock organised to match Perso Data Automated Card Storage Vault with Picking System Perso Data file drives picking process Stock picked into hoppers/ trays

Single Machine Make Ready 100% inline QC Stock QC ‐ Correct Perso Data Record onto Correct

Card EMV and Payment Scheme Validation tests Tag value validation

29

Inline QC with Rainbow Batches

% machine running time (based on 1,700 cph max)

© 2015 BARNES INTERNATIONAL LIMITED Source: Barnes Estimates

Batch % running time6,800 (4 hrs) 98%4,000 96%2,000 93%1,000 87%

Minimum batch 2 hoppers/ trays of 500 cards500 x 2 87%100 x 10 87%50 x 20 87%

30

Human Resources

Efficient use of Human Resources

Inline QC can work 24/7 and does not get tired or distracted Greater Operator Job Satisfaction Greater Efficiency Less Staff ‐ no extra QC staff required Faster ROI

No Human Intervention – better Data Security

© 2015 BARNES INTERNATIONAL LIMITED Source: Datacard 31

QC Audit Trail ‐ Reporting

Card Test Reporting

Reporting by Individual card Offline audit of QC process Ability to collect and retain test reports of failed cards Offline verification of failed cards


Complete Validation Test Report

Accessed from Inline test Result File on an Offline CPT1. Summary of Test2. Individual Fail/ Observations with

Explanatory Annotations3. Refers to Applicable Specification4. List of all Tags Tested & Result


3

4

2

1

Summary

100% Inline QC Testing

100% Full EMV test a reality Mag / Chip / Contactless Verification Full EMV Validation test Testing time does not impact Machine Running speed or time Greater Productivity through Rainbow Batches Human resources optimized Complete Test report viewable Offline Offline audit of QC process Fully Payment Scheme and PCI Compliant


Significant competitive Benefit

Br ian Summerhayes

bsummerhayes@barnestest .com

www.barnestest .com

barnes ‐ internat iona l ‐ l td @barnes_test


100% Personalisation Quality Control

Thank you for your attention – Questions

update on inline testing of emv cards - icma · 2017. 12. 8. · card stock verification...

Documents