EMV is the global standard for chip-based card payments, named after Europay, Mastercard and Visa, which wrote the first specification in the 1990s. An EMV card's microprocessor generates a unique cryptogram for every transaction, so copied card data cannot be reused. EMVCo, founded in 1999 and owned by the major card networks, manages the specifications and certifies cards and terminals. The card combines amount, currency, date, a terminal random number and a transaction counter into an ARQC that the issuer verifies in its hardware security module. The chip replaced the static magnetic stripe, cutting counterfeit fraud. EMVCo also governs EMV 3-D Secure, and because terminal approvals expire, acquirer buyers check Level 2 and Level 3 dates.
What is EMV and who controls it
The specifications are managed by EMVCo, founded in 1999 and now owned by American Express, Discover, JCB, Mastercard, UnionPay and Visa. EMVCo writes the documents and runs testing and approval of cards and terminals; each card network layers its own rules on top.
The chip replaced the magnetic stripe, which holds static data that a skimmer can copy onto a blank card. After the UK completed chip-and-PIN in 2006, counterfeit fraud on UK cards fell sharply; the US followed with a liability shift in October 2015.
What is the EMV standard
The EMV standard is a specification, not a law, but card networks make compliance a condition of issuing and acceptance. The contact chip specification has four books: Book 1 on the card-terminal interface and application selection, Book 2 on security and key management, Book 3 on commands and data elements, and Book 4 on terminal requirements. Contactless has separate books plus kernels, the software modules that run each network's contactless logic.
How does EMV work
EMV payment technology explained in sequence:
- The terminal selects the card application by its application identifier, for example Visa Debit.
- Card and terminal agree how to verify the cardholder: PIN, signature, or none for low-value contactless.
- The terminal asks the card for a cryptogram covering the transaction.
- The cryptogram travels in the authorization request; the issuer validates it and responds.
How does the EMV standard work across networks
Every data element has a fixed tag and every step a fixed order, from application selection to the cryptogram exchange, so a terminal in Lisbon reads a card issued in Seoul.
How do EMV cryptograms work
The card holds a unique key derived from the issuer's master key. For each payment it combines the amount, currency, date, a random number from the terminal and an application transaction counter, and signs them to produce an Authorization Request Cryptogram (ARQC). The issuer repeats the calculation in its hardware security module; a match proves the card is genuine and the message unaltered. A €40 tap altered to €400 in transit would fail that match. Because the counter rises with every use, a replayed cryptogram is rejected.
EMV standards for card payments beyond the chip
EMVCo's remit now includes EMV 3-D Secure, the protocol behind 3DS2, which took over after Visa and Mastercard decommissioned 3DS1 in October 2022. It also publishes the Payment Tokenisation framework used for network tokens and the EMV QR Code specifications.
Devices are certified in three levels: Level 1 for the physical and electrical interface, Level 2 for the kernel software, Level 3 for end-to-end testing with a specific acquirer and network. A buyer of an issuer or an acquirer with its own terminal estate checks the Level 2 and Level 3 approval dates: approvals expire, and a kernel near end of life means an unpriced hardware refresh.