Cryptomathic Blog

Cardholders (or consumers) are one of the corners of the ‘four corner’ model in the payment card world. Here we take a brief look at the payment security in relation to cardholders.

The “Four Corners'' model, also called the Four Party Scheme, is utilized in almost all standard card payment systems across the globe. Here we introduce that model and explain what type of hardware security module (HSM) is needed for each of its components involved in the cryptographic process.

Tokenization is a generalized concept of a cryptographic hash. It means representing something by a symbol (‘token’).

EMV is short for EUROPAY-VISA-MASTERCARD. This term is used to refer to standards that have been designed to improve the security of credit and debit card transactions by using chip technology for payment cards.

A key management system is a critical component in achieving PCI DSS compliance for a banking institution. It involves implementing a crypto system that manages the secure creation, exchange, distribution, storage and use of cryptographic keys for the ultimate goal of protecting users’ or clients’ sensitive data.

Payment Card Industry Data Security Standard (PCI DSS) is an information security standard to protect against credit card fraud and numerous additional security threats & vulnerabilities. Credit/Debit card providers, such as MasterCard and Visa etc., implement the mechanisms and security controls specified and suggested in PCI DSS.

Credit cardholders are generally protected from liability if unauthorized transactions are made with their credit cards because of consumer protection laws and card policies. This leaves merchants and financial institutions on the hook for losses related to credit card fraud. According to an October 2016 Nilson Report, card issuers were burdened with 72 percent of fraudulent losses in 2015 while merchants were left with 28 percent of the losses.

EMV chips on payment cards contain cryptographic co-processors and dual interfaces that allow for contact and contactless payment options. When issuing an EMV card, the customer’s information is extracted from the bank or financial institution’s database.

Migrating from magnetic stripes to EMV based smart cards is a challenging endeavour for banks and their IT teams. Even for small banks, necessary card data preparation rapidly overshoots the level of millions of data entries. In the frame of the migration process, banks need new systems and new processes, interweaving additional external entities.