A critical review of the EMV payment tokenisation specification

When a contact chip card is used to pay at the Point Of Sale (POS) it generates a cryptogram or a cryptographic checksum providing evidence that certain keys stored in the chip were used.1 Payment cards increasingly have a contactless interface so they can be simply ‘waved’ in front of the payment terminal. The chip storing the keys and executing the payment application is fundamentally the same regardless of the interface used to conduct the payment. Similarly, when Near Field Communication (NFC) mobile phones are used instead of cards, the chip is still present as the phone's so-called Secure Element (SE). The EMV Payment Tokenisation Specification diverges from existing schemes by giving tokens a uniform and interoperable format that enables them to be used during payments. Diego Ortiz-Yepes of IBM Research describes the main components of the specification and describes use cases where it can be applied. He also explains that there are many issues still to be properly addressed, such as online card-not-present payments and payments at the Point Of Sale (POS) using mobile phones.