Checking processing restrictions

[Tomcat]

The terminal performs this stage of transaction processing on its own (without calls to the card and the issuer), using the data previously received from the card. This stage can be implemented by the terminal at any time between the moment the card data reading is completed and the moment the analysis of the result of the terminal checks starts.

At this stage, three criteria are considered for the correspondence of terminal and card applications to each other:

• 1) the correspondence of the version numbers of the card and terminal applications (Application Version Number);
• 2) Application Usage Control;
• 3) Application effective / expiration dates checking.
• 4.6.1. Correspondence of version numbers of card and terminal applications

Payment systems assign version numbers to the card application and the terminal application, each 2 bytes in size, using the Application Version Number data object (Tag '9F08'), respectively,

Chapter 4. PROCESSING TRANSACTION BY MICROPROCESSOR CARD 307 stored on the card, and the Application Version Number data object (Tag '9F09') stored on the terminal.

The terminal checks the compliance of application version numbers as follows:

• • among the data read by the terminal, search for an object with the Tag field equal to '9F08';
• • if such an object is not found, by default it is assumed that the versions of the card and terminal applications are compatible;
• • if the object is found, it is compared with the terminal data object with the Tag field equal to '9F09';
• • if the values of the Value fields of the objects coincide, the terminal proceeds to the check by the second criterion (control of application use);
• • otherwise, before proceeding to checking the second criterion, the terminal sets bit 8 "ICC and terminal have different versions" of the second TVR byte equal to 1.
• 4.6.2. Application control

The restrictions imposed by the card issuer on card use are determined by the card issuer using the Application Usage Control data object (AUC, Tag '9F07', 2 bytes). This data object is optional and may not appear on the card. In this case, the terminal checks described below are not performed.

The purpose of the bits in the Value field of the Application Usage Control data object is as follows:

• - bit 8 of byte 1 is equal to 1: the operation of cash withdrawal for intracountry (domestic) transactions is allowed;
• - bit 7 of byte 1 is equal to 1: the cash withdrawal operation for international (international) transactions is allowed;
• - bit 6 of byte 1 is equal to 1: the operation of purchasing goods for intra-country new transactions is allowed;
• - bit 5 of byte 1 is equal to 1: the operation of purchasing goods for international transactions is allowed;
• - bit 4 of byte 1 is equal to 1: the purchase of services for intra-country transactions is allowed;
• - bit 3 of byte 1 is equal to 1: the operation of purchasing services for international transactions is allowed;
• - bit 2 of byte 1 is equal to 1: operations at the ATM are allowed;
• - bit 1 of byte 1 is equal to 1: operations are allowed in devices other than ATMs;
• - bit 8 of byte 2 equals 1: Cashback is allowed for in-country transactions;
• - bit 7 of byte 2 is equal to 1: the cash-out purchase operation for international transactions is allowed;
• - Bits 1-6 of Byte 2 are reserved for future use.

Note that the Terminal Type and Additional Terminal Capabilities data objects (Tag '9F40') are used to determine if a given terminal is an ATM. A terminal is an ATM if and only if the Terminal Type of the terminal is equal to one of the values' 14'h, '15'h,' 16'h, and bit 8 of byte 1 Additional Terminal Capabilities of the terminal is 1.

The following data objects also apply to check the above restrictions on the use of the card:

• "Transaction Type" (Tag '9С') - defines the type of transaction (cash withdrawal, purchase of goods, services, etc.); the values of the Value field of this data object for various types of transactions are determined by payment systems; the value of the Value field is denoted by V ^
• "Issuer Country Code" (Tag '5F28') - is stored on the card and defines the country code of the issuer in accordance with the ISO 3166 standard; the value of the Value field of this data object is denoted by V 2 ;
• Terminal Country Code (Tag '9F1A') - is stored on the terminal and defines the terminal country code in accordance with the ISO 3166 standard; the value of the Value field of this data object is denoted by V 3 ;
• “Other size of the transaction amount” (Amount, Other, Tag '9F04') - determines the amount of cash issued to the cardholder when performing the Cashback operation.

The terminal performs the following card usage restrictions checks (assuming the terminal has read the AUC object).

If the terminal used is an ATM, then it is checked that bit 2 of Byte 1 of the AUC is 1.

If the terminal type does not match the ATM, then it is checked that bit 1 of byte 1 of the AUC is 1.

If the Issuer Country Code object is read by the terminal, then the following checks are performed (if the object is absent, then the checks are not performed):

• • if Vj - "Cash withdrawal" (Ol = Debit / Cash, 17-19 = Debit / Cash Advance with credit cards), to
• - if V 2 = V 3 , then we check that bit 8 of byte 1 of AUC is equal to 1;
• - if V 2 V 3 , then we check that bit 7 of byte 1 of AUC is equal to 1;
• • if Vi = "Purchase of goods", then:
  • - if V 2 - V 3 , then we check that bit 6 of byte 1 of AUC is equal to 1;
  • - if V 2 V 3 , then we check that bit 5 of byte 1 of AUC is equal to 1;
• • if V! = "Purchase of services", then:
• - if V 2 = V 3 , then we check that bit 4 of byte 1 of AUC is equal to 1;
• - if V 2 V 3 , then we check that bit 3 of byte 1 AUC is equal to 1;
• • if V, = "Purchase of goods / services" and the Amount, Other object is read by the terminal, then:
• - if V 2 = V 3 , then we check that bit 8 of byte 2 AUC is equal to 1;
• - if V 2 V 3 , then we check that bit 7 of byte 2 AUC is equal to 1.

If at least one check from the above list fails, bit 5 of byte 2 TVR ("Requested service not allowed for card product") is set to 1.

4.6.3. Checking the start / end dates of the application

If the terminal reads the Application Effective Date data object (Tag '5F25') from the card, it compares it with the current date. If the current date is less than the value of the Value field of the Application Effective Date object, then the terminal sets bit 6 of byte 2 of TVR ("Application not yet effective") equal to 1.

If the terminal reads the Application Expiration Date data object (Tag '5F24') from the card, it compares it with the current date. If the current date is greater than the value of the Value field of the Application Effective Date object, then the terminal sets bit 7 of byte 2 of TVR ("Expired application") equal to 1.