EMV CVM List Reference
The CVM list is the ordered set of verification methods a terminal may attempt, and the order decides which one is tried first and which is tried last.
| Condition | CVM | Method | Liability shift |
|---|---|---|---|
| If the transaction amount is greater than the CVM limit | 0x00 | Fail CVM processing | No shift |
| If the terminal does not support the CVM | 0x01 | Plaintext PIN by issuer | No shift |
| If the encrypted PIN is verified | 0x02 | Encrypted online PIN | Yes |
| If the plaintext PIN and signature are verified | 0x03 | Plaintext PIN and signature | No shift |
| If the terminal does not support the CVM | 0x04 | No CVM required | No shift |
| If the encrypted PIN is verified | 0x05 | Encrypted online PIN | Yes |
| If the terminal does not support the CVM | 0x06 | No CVM required | No shift |
| If the chip cannot be verified | 0x07 | No CVM required | No shift |
A terminal is configured with the set of CVMs it supports and the conditions under which each may be tried. The list is ordered, and the terminal walks it until one succeeds.
How this tool works
Each entry in the CVM list pairs a condition with a method. The terminal evaluates conditions in order and takes the first method whose condition is met and which the terminal supports. The method determines what proof of cardholder presence you have, and that in turn determines whether the issuer will shift liability for a fraud dispute.
When to use it
- Explain why a transaction was approved without a PIN
- Understand when liability shifts to the issuer
- Configure a terminal's CVM conditions
- Interpret a dispute where CVM did not complete
Frequently asked questions
What is a CVM?
A Cardholder Verification Method - the proof a terminal collected that the card was genuinely in front of the cardholder.
Which CVM gives the best liability protection?
Encrypted online PIN, because the issuer receives the PIN and can prove the cardholder knew it.
What does no CVM required mean?
The terminal accepted the transaction without verifying the cardholder, so the issuer generally cannot shift liability.
Why is the CVM list ordered?
Because the terminal tries methods from strongest to weakest, and a weaker method that still satisfies the condition is only used if the stronger one fails.