Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
In Mag stripe transactions, I've worked on solutions by which you get an initial small value Authorization and then can capture a full amount later using the transaction_id. E.g. The payment gateways in restaurants.
With the move to chip and pin / EMV, is this still possible? I've stumbled into some vague articles implying that the future capture amount is now reduced to 20% etc. Can someone point me to some correct information?
EMV has no effect on the rules for capture amounts. It's only an authorization-time feature. There are things you can do with swipe cards that you can't with a chip, but your specific example isn't one of them. For example, you can't display one total on the device and then authorize a different total, such as when the card is swiped while still ringing up the transaction. 1.
For transactions where the capture/settlement amount is different from the authorization amount, those rules are set by the card brands and are more dependent on industry and type of the transaction than how the card is presented.
For example, Visa's says:
A Merchant must submit an Authorization Request for either:
- The final Transaction amount
- A different amount or amounts if the final Transaction amount is not known, and the Merchant or Transaction type is included in and complies with Table 5-13, Special Authorization Request Allowances and Requirements
Table 5-13 starts on page 370 and runs for the next six pages, so there's a lot of special cases. But if you aren't one of them, then Visa can fine you if you change the amount, regardless of swipe or chip.
1 Actually, you can, but the bank can see it and is likely to decline. Except in the US where the banks specifically don't care, and in fact encourage this. See QuickChip, for example.
Tampering with the amount is not possible with EMV card. With MagStripe card, the transaction is authorised online by the Issuer. In EMV, transaction authorisation is done by the Integrated Circuit Card (ICC) itself. The ICC generates MAC over the transaction data which contains both transaction amount and currency. ICC also signs MAC together with static data about the card and noce of both terminal and ICC. The signature is verified by the terminal while the issuer is only given MAC and transaction data.
A third party cannot tamper with these details in transit. But that doesn't stop a merchant to tamper with payment gateways. They can modify the screen content to display lesser amount than they are charging. They can charge you as high as your issuer allows while still generating the bill of actual cost. EMV has no control over the security of terminals.
I'm trying to understand how within the EMV how to replace the MagStripe usecase where Authorization with initial amount when price is not yet known and then capture the full amount minutes/hours after the fact.
About that, then the accepted answer is correct.
EMV is not accountable for updating the transaction amount in later point in time. It is handled by the acquirer (merchant's bank) and the issuer (customer's bank) via payment networks. My issuer blocks any update to the transaction. If there was a mistake in transaction amount then merchant is held responsible for this. But sometimes merchants have to make refunds to their customers which is done by separate payment gateways.
Even if you use MagStripe for the initial amount, the later changes in transaction is still handled by the decision of issuer.
