Originally Posted by
bullfrog
This brings up an interesting (to me, anyway) question in my mind. Is EMV POS equipment "required" to respect the CVM list ordering on the card? Obviously a POS can't force a card to use a CVM that it doesn't physically support, but if my card says PIN is CVM #1, signature #2, and the POS is capable of handling PINs, is it permitted to skip PINs and ask for a signature? Likewise, if sig is before PIN, can the retailer choose to require PINs on cards that support them?
Visa/MC requires EMVco approval in order to approve terminals, so the ones for the US market will likely all follow the CVM list correctly (as in, the first one that both the card and terminal supports gets chosen). A significant number will likely not support PIN at all though, either because the keys required for it aren't there, the hardware makes it impossible or it's simply switched off at the firmware level.
Originally Posted by
bullfrog
In the same vein, when Australia switched to PINs last summer, from the articles I read it sounded like they just reprogrammed all the terminals on the changeover day, and didn't necessary hand out new cards to everyone. Actually it sounds like the terminals were programmed to always require PIN but ONLY for Australian cards, as the published materials indicate that cards from other countries might still require signatures. But I could be totally wrong about all of that, as I have (sadly) not yet visited Australia.
When I was there last year, most terminals followed the CVM list but some had a "PIN or signature" option which seems like it just gets rid of PIN as a supported CVM on the terminal side. The August deadline was probably for getting rid of that option on the remaining terminals and starting to autodecline transactions without an online PIN for Australian cards.