Square recently launched their Square Reader physical device. AS well as accepting NFC based payments (e.g. Contactless or Apple/Android Pay, it also accepts Chip and PIN authentication.
However the PIN entry takes place in an app on the smart phone using software rendered buttons. How does this meet the EMV requirement for the PIN Pad to be a
"tamper evident" device(as described in the EMV specifications, book 2 section 11.1) - pushing buttons on an app that talks over bluetooth doesn't seem to be tamper evident to me.
The full flow is that the retailer installs the Square app onto their Android/iOS device. They then pair with the Square Reader over bluetooth. At payment time the retailer opens the Square app, and enters the items/total as per a usual Point of Sale system. When they total it and proceed to the payment step the customer then inserts their Chip and PIN enabled card into the Square Reader and then, on the retailers smart phone, validates the amount to be charged and enters their PIN into the app to authorize the transaction. The PIN is presumably sent over the bluetooth connection, with the amount, to the Square Reader where it then is passed into the Chip.
Am I misunderstanding the requirements on PIN Pads, or am I misunderstanding the functionality of the Square Reader?