1

In Mag stripe transactions, I've worked on solutions by which you get an initial small value Authorization and then can capture a full amount later using the transaction_id. E.g. The payment gateways in restaurants.

With the move to chip and pin / EMV, is this still possible? I've stumbled into some vague articles implying that the future capture amount is now reduced to 20% etc. Can someone point me to some correct information?

closed as off-topic by Ghedipunk, Conor Mancone, Lie Ryan, Graham Hill, DoubleD Oct 17 at 14:47

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Ghedipunk, Conor Mancone, Lie Ryan, DoubleD
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    By capturing do you mean tampering with the transaction amount during transition? – defalt Oct 11 at 6:07
  • Technically, yes, the auth/capture still works as it had always been. Whether or not your bank impose any other transaction limits, that's bank policy and you have to ask your bank. – Lie Ryan Oct 11 at 12:40
  • @defalt by capturing i mean charging a different amount from what is initally authorized e.g. renting a bike, bike gets returned an unknown period later or like renting a dvd from redbox where you dont know when the customer will return it. – wmitchell Oct 11 at 19:09
2

EMV has no effect on the rules for capture amounts. It's only an authorization-time feature. There are things you can do with swipe cards that you can't with a chip, but your specific example isn't one of them. For example, you can't display one total on the device and then authorize a different total, such as when the card is swiped while still ringing up the transaction. 1.

For transactions where the capture/settlement amount is different from the authorization amount, those rules are set by the card brands and are more dependent on industry and type of the transaction than how the card is presented.

For example, Visa's says:

A Merchant must submit an Authorization Request for either:

  • The final Transaction amount
  • A different amount or amounts if the final Transaction amount is not known, and the Merchant or Transaction type is included in and complies with Table 5-13, Special Authorization Request Allowances and Requirements

Table 5-13 starts on page 370 and runs for the next six pages, so there's a lot of special cases. But if you aren't one of them, then Visa can fine you if you change the amount, regardless of swipe or chip.


1 Actually, you can, but the bank can see it and is likely to decline. Except in the US where the banks specifically don't care, and in fact encourage this. See QuickChip, for example.

1

Tampering with the amount is not possible with EMV card. With MagStripe card, the transaction is authorised online by the Issuer. In EMV, transaction authorisation is done by the Integrated Circuit Card (ICC) itself. The ICC generates MAC over the transaction data which contains both transaction amount and currency. ICC also signs MAC together with static data about the card and noce of both terminal and ICC. The signature is verified by the terminal while the issuer is only given MAC and transaction data.

A third party cannot tamper with these details in transit. But that doesn't stop a merchant to tamper with payment gateways. They can modify the screen content to display lesser amount than they are charging. They can charge you as high as your issuer allows while still generating the bill of actual cost. EMV has no control over the security of terminals.

I'm trying to understand how within the EMV how to replace the MagStripe usecase where Authorization with initial amount when price is not yet known and then capture the full amount minutes/hours after the fact.

About that, then the accepted answer is correct.

EMV is not accountable for updating the transaction amount in later point in time. It is handled by the acquirer (merchant's bank) and the issuer (customer's bank) via payment networks. My issuer blocks any update to the transaction. If there was a mistake in transaction amount then merchant is held responsible for this. But sometimes merchants have to make refunds to their customers which is done by separate payment gateways.

Even if you use MagStripe for the initial amount, the later changes in transaction is still handled by the decision of issuer.

  • can you elaborate about tampering? obviously i'm not speaking about nefariously changing the amount im trying to understand how within the EMV world how to replace the MagStrip usecase where Auth with initial amount then when price is not yet known then capture the full amount minutes/hours after the fact. – wmitchell Oct 15 at 18:38
  • @wmitchell See my edit. – defalt Oct 18 at 5:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.