With the introduction of chip cards into our lives, the terminal needs to verify the credit card before the transaction.
So how does it perform this verification?
The value calculated and sent by the card is called ARQC (Application Request Cryptogram).
Every EMV transaction request is expected to include ARQC, a cryptogram derived from the transaction data. In an EMV financial transaction, this cryptogram can be thought of as a digital signature.
Since some of the information used in the calculation varies on a per-transaction basis, a different ARQC value is calculated for each transaction.
The card issuer's authorization system recreates the ARQC value using the derivation data, the incoming transaction data, and the master key, then compares the value it generated with the value received in the authorization. If the two values match, online cryptogram verification is successful.
A verified online cryptogram indicates two things:
- the financial message was generated by the source it claims to be from
- the content of the message was not altered
The online cryptogram check is two-way.
- The issuer host verifying the card
- The card verifying the issuer host
After the issuer host verifies the ARQC (Request Cryptogram) value, it generates the ARPC (Response Cryptogram) value using the ARQC value and sends it to the card. Whether the transaction is rejected by the card depending on whether the ARPC value is correct or incorrect depends on the parameters set on the card.
