Jan 16, 2017, 6:55 am
Last edit by: storewanderer
Older (archived) threads: 2014-16
- - - - - -
- What is EMV contactless?
EMV contactless is a form of contactless/NFC that uses the same security and encryption that is used when inserting a chip card into an EMV-enabled terminal. Other than not having to sign/enter a PIN for smaller transactions, the security is effectively the same as chip and PIN/chip and signature.
In contrast, MSD contactless is an older version that is designed just and only for the United States. This effectively uses much the same flow as a swiped card transaction with the same rules.
- What is CDCVM?
CDCVM stands for Consumer Device Cardholder Verification Method. It's a method of telling the terminal that the customer verified their identity using their mobile device. Terminals that support it will waive the signature/PIN requirement typically in place for larger transactions, potentially saving time at checkout.
More info: https://support.apple.com/en-us/HT202527
- Does EMV contactless need to be supported to support CDCVM?
Typically, yes. (However, there are some exceptions below.)
- Why can't I tap my foreign-issued contactless card at most places in the US?
This is likely because the store does not support EMV contactless. Foreign issued contactless cards typically do not support MSD contactless since other markets have had EMV for quite some time. In contrast, most stores in the US have yet to get the necessary certifications/software for EMV contactless so they are typically MSD-only--if contactless is enabled at all. (See below for a list of stores where your card will likely work.)
- I paid for a purchase with Apple/Android/Samsung Pay and still had to sign for it.
Most likely, the store in question does not have EMV contactless enabled (see above question). However, there are instances where CDCVM does not work even with EMV contactless enabled. Restaurants that allow tip adjust, for example--where the tip amount is written on a paper receipt and entered by the staff later--cannot support CDCVM. It may simply be a matter of the merchant's processor or the POS software in use not supporting it too.
Another common reason is if you used a US-issued AmEx card with a mobile wallet. AmEx currently does not allow EMV contactless support in mobile wallets for these cards, so they always run as MSD contactless. Because of this, CDCVM is not supported (with very few exceptions, as noted below).
Note: if you used Samsung Pay, you may have paid with MST instead of NFC. Since MST emulates the magnetic pulses that the terminal receives when swiping a regular card, the normal magstripe rules apply.
- How can I tell whether EMV contactless was used?
An easy way to tell if you have Apple Pay is to pay with a Visa or MC while in airplane mode. Wallet will then show a transaction amount next to "Payment" for the card that was used. Alternatively, EMV-related information will typically print on the receipt (AID, etc.) if EMV contactless was used.
(Non-exhaustive) list of EMV contactless supporting merchants in the US:
- 7-Eleven
- 99 Ranch
- Albertsons (Safeway, Vons, Pak N Save, Jewel, Acme, Shaws, Star, Carrs, Randalls, Tom Thumb, Haggen, Eagle, Lucky UT/SoCal)
- Apple Store*†
- Athleta
- Auntie Anne’s Pretzels
- Banana Republic
- Costco Wholesale
- CVS
- DuaneReade*
- El Pollo Loco
- EG Group US (Quik Stop, Kwik Shop, Tom Thumb, Turkey Hill) Note: cashier must press "Electronic Payment" to activate NFC
- Five Below*
- Five Guys
- GAP
- Grocery Outlet*
- Harmon's Grocery
- H&M*
- Jolibee
- Kohl's*
- Lush Cosmetics*
- Maverik
- McDonald's*
- Meijer
- Old Navy
- Panera Bread
- PetSmart
- Ray's Food Place
- Round Table Pizza
- Royal Farms
- Red Ribbon Bakeshop
- Sheetz
- Sherm's Thunderbird Discount Markets Inc.*
- Sprouts
- Staples*
- Starbucks*
- Subway
- Walgreens*
- Weis Markets
- All businesses that use Square and support contactless*
- All businesses that use Clover and support EMV†**
- All businesses that use First Data standalone terminals (e.g. FD100+FD35, FD130) with EMV enabled**
* CDCVM support confirmed
** CDCVM support depends on store/restaurant
† CDCVM supported in MSD mode
USA contactless credit/debit/transit (2017 - 2021)
Jun 22, 2018, 12:23 am
#4216
Join Date: Mar 2011
Location: Window Seat
Programs: National Executive, HHonors Gold, IHG Platinum, Hyatt Visitor
Posts: 2,495
The station now accepts credit cards and I tried the NFC out at the pump. Worked flawlessly with both the phone and the physical card. The receipt says " *** CONTACTLESS *** " on the top. Another Arco left the brand here last year and had those same old pumps/add ons but for some reason the Contactless stopped working. They seem to have kept the Arco cash registers at both locations so I have no clue why it worked at one but not the other.
Jun 22, 2018, 7:01 am
#4217
Join Date: Sep 2014
Posts: 1,722
An Arco here just left Arco and is now unbranded. This is an old station with real old pumps but it got the pay at the pump "add ons" that Arco put onto those 20 year old Wayne pumps they have a few years back, then the NFC add on that came later.
The station now accepts credit cards and I tried the NFC out at the pump. Worked flawlessly with both the phone and the physical card. The receipt says " *** CONTACTLESS *** " on the top. Another Arco left the brand here last year and had those same old pumps/add ons but for some reason the Contactless stopped working. They seem to have kept the Arco cash registers at both locations so I have no clue why it worked at one but not the other.
The station now accepts credit cards and I tried the NFC out at the pump. Worked flawlessly with both the phone and the physical card. The receipt says " *** CONTACTLESS *** " on the top. Another Arco left the brand here last year and had those same old pumps/add ons but for some reason the Contactless stopped working. They seem to have kept the Arco cash registers at both locations so I have no clue why it worked at one but not the other.
Jun 22, 2018, 8:36 am
#4218
FlyerTalk Evangelist
Join Date: Jan 2014
Location: San Diego, CA
Programs: GE, Marriott Platinum
Posts: 15,507
Heh, so it looks like the US media was still pushing the whole RFID scare thing as late as 2016:
Surprisingly, the rest of the video is okay in terms of facts and tips; I was completely expecting them to claim that the chip itself was useless or something. Whether the recent scaremongering has made it more difficult for issuers to roll contactless out en masse without a backlash, I'm not sure.
Surprisingly, the rest of the video is okay in terms of facts and tips; I was completely expecting them to claim that the chip itself was useless or something. Whether the recent scaremongering has made it more difficult for issuers to roll contactless out en masse without a backlash, I'm not sure.
Jun 22, 2018, 9:58 am
#4219
Join Date: Mar 2017
Programs: HHonors, TrueBlue, Delta SkyMiles, Hyatt Discoverist, Starwood Preferred Guest, American Airlines.
Posts: 2,035
Perhaps it's time to re-define what "freedom of the press" means.
The card networks should be able sue journalists and companies that make news stories like that. "Freedom of the press" was written when social media didn't exist, so lies about non-government stories weren't spoon fed to a large portion of the population like they are now. The government isn't suing the journalists, so no constitutional violations should exist. The media has had a major hand in destroying this country... Either by scaring people or by taking political sides (thus, dividing everyone).
Jun 22, 2018, 2:18 pm
#4220
FlyerTalk Evangelist
Join Date: Jan 2014
Location: San Diego, CA
Programs: GE, Marriott Platinum
Posts: 15,507
Yeah, no.
Also, the video is correct in saying that data can be retrieved wirelessly from cards with a phone (in fact, I have such an app on my phone for use with my own cards). What the video didn't mention, however, is that a) the card has to be contactless in the first place (which the vast majority of US issued cards are not) and b) the data retrieved isn't all that useful to criminals, except maybe for online purchases.
Also, the video is correct in saying that data can be retrieved wirelessly from cards with a phone (in fact, I have such an app on my phone for use with my own cards). What the video didn't mention, however, is that a) the card has to be contactless in the first place (which the vast majority of US issued cards are not) and b) the data retrieved isn't all that useful to criminals, except maybe for online purchases.
Jun 22, 2018, 2:19 pm
#4221
FlyerTalk Evangelist
Join Date: Jan 2014
Location: San Diego, CA
Programs: GE, Marriott Platinum
Posts: 15,507
Anyway, it sounds like there might not be much demand for fingerprint readers on cards in the US: https://www.inc.com/eric-mack/visa-w...time-soon.html
Then again, I thought the Mountain America pilot was just among their own employees. I kinda wish I had a WSJ subscription to see what the original article said.
Then again, I thought the Mountain America pilot was just among their own employees. I kinda wish I had a WSJ subscription to see what the original article said.
Jun 22, 2018, 2:22 pm
#4222
Join Date: Mar 2017
Programs: HHonors, TrueBlue, Delta SkyMiles, Hyatt Discoverist, Starwood Preferred Guest, American Airlines.
Posts: 2,035
Yeah, no.
Also, the video is correct in saying that data can be retrieved wirelessly from cards with a phone (in fact, I have such an app on my phone for use with my own cards). What the video didn't mention, however, is that a) the card has to be contactless in the first place (which the vast majority of US issued cards are not) and b) the data retrieved isn't all that useful to criminals, except maybe for online purchases.
Also, the video is correct in saying that data can be retrieved wirelessly from cards with a phone (in fact, I have such an app on my phone for use with my own cards). What the video didn't mention, however, is that a) the card has to be contactless in the first place (which the vast majority of US issued cards are not) and b) the data retrieved isn't all that useful to criminals, except maybe for online purchases.
We'll be the last in the world to get this too. The banks will complain it costs too much to implement.
Jun 22, 2018, 6:15 pm
#4223
FlyerTalk Evangelist
Join Date: Jan 2014
Location: San Diego, CA
Programs: GE, Marriott Platinum
Posts: 15,507
The assertion is that "only" 125 people signed up for the US pilot. Without the sample size, we can't even begin to form any conclusions. Not to mention that Visa could very easily just not have bothered with it in the US at all and simply recommended mobile wallets for those who wanted such authentication.
Jun 24, 2018, 7:28 pm
#4224
FlyerTalk Evangelist
Join Date: Jan 2014
Location: San Diego, CA
Programs: GE, Marriott Platinum
Posts: 15,507
I visited Liberty Public Market (basically a giant food hall near SAN) today for the first time in a while and it seems that at least one of the merchants there switched away from ShopKeep to Square's new POS. I wonder if this means that ShopKeep, Revel, etc. are going to have to put more pressure on merchant processors to keep from losing more merchants.
Also, it turns out that on the 2018 Clover Station, the cashier still needs to push something on their end to activate the contactless reader on the receipt printer. Fortunately that particular merchant had Apple Pay stickers on the door and had no problem enabling it.
Also, it turns out that on the 2018 Clover Station, the cashier still needs to push something on their end to activate the contactless reader on the receipt printer. Fortunately that particular merchant had Apple Pay stickers on the door and had no problem enabling it.
Jun 24, 2018, 10:45 pm
#4225
Join Date: Apr 2010
Location: SAN
Programs: UA
Posts: 204
If the story contains information that is factually inaccurate (libelous/slanderous,) then they indeed could be sued if this has resulted in harm to their business or reputation. This has been established in US case law.
Jun 24, 2018, 10:47 pm
#4226
Join Date: Apr 2010
Location: SAN
Programs: UA
Posts: 204
The assertion is that "only" 125 people signed up for the US pilot. Without the sample size, we can't even begin to form any conclusions. Not to mention that Visa could very easily just not have bothered with it in the US at all and simply recommended mobile wallets for those who wanted such authentication.
Jun 24, 2018, 10:57 pm
#4227
FlyerTalk Evangelist
Join Date: Jan 2014
Location: San Diego, CA
Programs: GE, Marriott Platinum
Posts: 15,507
Also, I've yet to see anything about how these will work in practice. For instance, will the fingerprint sensor only work for contactless purchases? If not, will the terminal know that fingerprint was used and not ask for signature regardless of whether the card's tapped or inserted? (Or is Visa getting rid of the signature requirement supposed to serve that purpose? Never mind that many merchants will likely never stop asking.) And if there are indeed special software updates required on the merchant side, how are those going to be rolled out? And this isn't even getting into the whole thing with restaurants, either.
Jun 24, 2018, 11:39 pm
#4228
Join Date: Apr 2010
Location: SAN
Programs: UA
Posts: 204
Yep. 125 people signing up for something that's only open to employees is pretty good, honestly.
Also, I've yet to see anything about how these will work in practice. For instance, will the fingerprint sensor only work for contactless purchases? If not, will the terminal know that fingerprint was used and not ask for signature regardless of whether the card's tapped or inserted? (Or is Visa getting rid of the signature requirement supposed to serve that purpose? Never mind that many merchants will likely never stop asking.) And if there are indeed special software updates required on the merchant side, how are those going to be rolled out? And this isn't even getting into the whole thing with restaurants, either.
Also, I've yet to see anything about how these will work in practice. For instance, will the fingerprint sensor only work for contactless purchases? If not, will the terminal know that fingerprint was used and not ask for signature regardless of whether the card's tapped or inserted? (Or is Visa getting rid of the signature requirement supposed to serve that purpose? Never mind that many merchants will likely never stop asking.) And if there are indeed special software updates required on the merchant side, how are those going to be rolled out? And this isn't even getting into the whole thing with restaurants, either.
From this picture that I saw a while back, you can see the fingerprint reader being used while the card is inserted in the reader:
Seems to me, this is the only way it could work, since the card is going to need to be powered to do this I'd imagine. But this isn't going to work in devices that hold the card inside, and as you mentioned, it'll be an issue wherever the card reader isn't accessible to the end user.
EDIT: Answered my own question; apparently banks will serve as enrollment centers:https://www.engadget.com/2017/04/20/...gerprint-card/
Last edited by HotelHacker; Jun 24, 2018 at 11:56 pm Reason: Added link
Jun 25, 2018, 8:05 am
#4229
FlyerTalk Evangelist
Join Date: Jan 2014
Location: San Diego, CA
Programs: GE, Marriott Platinum
Posts: 15,507
Alternatively, they could just mandate customer-facing/accessible equipment (like they probably should have done at the beginning), but I'm not sure how well that'd go over.
Jun 25, 2018, 10:18 am
#4230
FlyerTalk Evangelist
Join Date: Jan 2014
Location: San Diego, CA
Programs: GE, Marriott Platinum
Posts: 15,507
Venmo's new debit card supports contactless: https://www.theverge.com/2018/6/25/1...-now-available
It won't work outside the US, however, but maybe that's okay. (On that note, I wonder why Bancorp doesn't like foreign transactions. That restriction was there for Google Wallet too, for instance.)
It won't work outside the US, however, but maybe that's okay. (On that note, I wonder why Bancorp doesn't like foreign transactions. That restriction was there for Google Wallet too, for instance.)