The CPoC (PCI Contactless Payments on Commercial off-the-Shelf) standard, issued by the PCI Security Standards Council (PCI SSC) in 2019, is a new data security standard published for solutions that enable payment-accepting companies to accept contactless payments using a commercial off-the-shelf (COTS) mobile device (e.g., a smartphone or tablet) with near field communication (NFC).
Vendors that use contactless payments under the COTS Standard and support the validation program can provide merchants with contactless acceptance solutions that have been developed and lab-tested to protect payment data.
The CPoC Standard is designed for solutions that accept payment with EMV-chip contactless cards and any contactless device that complies with EMV contactless standards. In addition, contactless magnetic stripe data (MSD) transactions that use a dynamic transaction verification code can also be supported by a CPoC solution.
What are the core elements of a CPoC solution?
The core elements of a CPoC Solution are as follows:
- A COTS device with an embedded NFC interface for reading the payment card or payment device
- An approved payment acceptance software application running on the merchant's COTS device that initiates a contactless transaction
- Back-end systems, independent of the COTS device, that support monitoring, integrity checks, and payment processing.
Can software-based PIN entry be used in a CPoC solution?
Software-based PIN entry is not permitted in a CPoC solution.
Is a CPoC solution reliable? Can I trust this solution?
Thanks to a combination of security controls built into the merchant application and continuous monitoring and integrity checks performed by the back-end systems, merchants and consumers can trust the security of the CPoC Solution and the contactless transaction.
You can access the document prepared by PCI on this topic at the link below.
