What is EMV Chip Card Technology? (2026)

EMV is the global standard for chip-based payment cards, named after its founders: Europay, Mastercard, and Visa. If you've inserted or tapped a credit card to pay, you've used EMV technology. This guide explains how EMV chip cards work, the transaction flow step by step, the cryptography behind it, and why chip cards are dramatically more secure than magnetic stripe.

EMV vs Magnetic Stripe: What Changed?

EMV Transaction Flow (Step by Step)

Every EMV transaction follows a standardized sequence of steps defined by EMVCo Books 1-4:

Step 1: Application Selection

The terminal sends a SELECT command with the PPSE (Proximity Payment System Environment) AID for contactless, or directly with a specific AID for contact. The card responds with the available payment application (e.g., A0000000041010 for Mastercard, A0000000031010 for Visa).

Step 2: Initiate Application (GPO)

The terminal sends GET PROCESSING OPTIONS (GPO) with the PDOL (Processing Options Data Object List). The card responds with the AIP (Application Interchange Profile) and AFL (Application File Locator), which tells the terminal which files to read.

Step 3: Read Application Data

Using the AFL, the terminal sends READ RECORD commands to read card data: PAN (Primary Account Number), expiry date, cardholder name, CVM list, and application cryptogram parameters. This data is returned in BER-TLV format.

Step 4: Cardholder Verification (CVM)

The terminal and card negotiate how to verify the cardholder using the CVM List (EMV Tag 8E). Options: online PIN (sent to issuer), offline PIN (verified by chip), signature, or no CVM (for small amounts). The card tracks PIN retry count and locks after 3 failed attempts.

Step 5: Terminal Risk Management

The terminal performs floor limit checking, random transaction selection, and velocity checks. If the transaction is above the floor limit or randomly selected, it is forced online.

Step 6: GENERATE AC (Cryptogram Generation)

The terminal sends GENERATE AC with CDOL1 data. The card generates one of three cryptograms:

The cryptogram is computed using a session key derived from the card's master key and the transaction data (amount, terminal country, ATC, etc.). The issuer validates the ARQC and returns an ARPC (Authorization Response Cryptogram).

Step 7: Online Authorization

For ARQC transactions, the terminal sends the cryptogram to the issuer via the payment network. The issuer:
1. Validates the ARQC (proves the card is genuine)
2. Checks the account balance and fraud rules
3. Returns an authorization code and ARPC
4. Optionally sends issuer scripts (e.g., update PIN, block card)

Step 8: Issuer Authentication and Scripts

The card validates the ARPC (proving the issuer authorized). If issuer scripts are present, the card executes them (e.g., reset PIN try counter, update application parameters).

EMV Authentication Methods

EMV supports three levels of card authentication, from weakest to strongest:

EMV Cryptography: How ARQC Works

The ARQC is the cryptographic proof that a genuine EMV card initiated the transaction. Here is how it is computed:

1. Session Key Derivation: The card derives a unique session key (SK_AC) from its Application Cryptogram Master Key (MK_AC) and the Application Transaction Counter (ATC). For 3DES: SK = 3DES(MK, ATC || ATC || F1 || padding). For AES: SK = AES-CMAC(MK, ATC || ...).
2. Transaction Data Hash: The card assembles CDOL1 data (amount, terminal country, transaction date, ATC, etc.) into a data block.
3. Cryptogram Computation: ARQC = 3DES-CBC(SK, transaction_data_block) or ARQC = AES-CMAC(SK, transaction_data_block).
4. Issuer Validation: The issuer independently derives the same session key (using the card's master key from their HSM) and recomputes the ARQC. If it matches, the card is authentic.

Contact vs Contactless EMV

Both contact and contactless EMV use the same application on the card and generate the same type of cryptograms. The main difference is the physical interface and optimized data exchange for speed in contactless mode. Many modern cards are dual-interface — they have both a contact chip and an NFC antenna.

Frequently Asked Questions

Why are EMV chip cards more secure than magnetic stripe?

EMV chips generate a unique cryptogram for every transaction using a secret key that never leaves the chip. Even if an attacker captures all the transaction data, they cannot reuse it — the cryptogram is tied to that specific transaction's amount, date, and counter. Magnetic stripe cards store static data that can be copied with a skimmer and reused indefinitely.

What is chip-and-PIN vs chip-and-signature?

Chip-and-PIN requires the cardholder to enter a PIN at the terminal (verified by the chip offline or by the issuer online). Chip-and-signature requires a signature instead. Chip-and-PIN is more secure against lost/stolen fraud because a thief cannot use the card without the PIN. Most of the world uses chip-and-PIN; the US initially adopted chip-and-signature but is transitioning to PIN.

Can an EMV chip card be cloned?

Extremely difficult. The card's private keys are stored in secure hardware (SE) and cannot be extracted. The ARQC cryptogram requires the card's master key, which only the card and the issuer know. An attacker would need to break the card's hardware security or compromise the issuer's key management system (HSM). In practice, EMV cloning attacks require sophisticated equipment and are very rare.

What happens when I tap my contactless card?

The terminal powers the card via NFC, selects the payment application, exchanges the necessary data (GPO, READ RECORD), and the card generates an ARQC cryptogram — all in under 2 seconds. For transactions below the contactless limit, no PIN is required (no CVM). For higher amounts, the terminal may request PIN or fall back to contact insertion. Try the Contactless Payment Flow Tool to see every APDU exchanged.