EMV offline authorization

[Papa Carder]

Overview of EMV Offline Authorization​

EMV offline authorization refers to the process in chip-based payment transactions where the card and terminal (e.g., point-of-sale device) approve or decline a transaction without real-time communication to the card issuer. This is governed by predefined rules from card networks (e.g., Visa, Mastercard), issuers, and risk parameters, allowing for quick processing in environments where online connectivity is unreliable or speed is critical. It contrasts with online authorization, where data is sent to the issuer for validation. Offline authorization is part of the broader EMV standard, which enhances security over magnetic stripe transactions by using dynamic data and cryptography. In regions like the U.S., offline is less common due to robust online infrastructures but is valuable for scenarios like transit, vending machines, or parking meters.

Offline authorization relies on Offline Data Authentication (ODA) to verify the card's legitimacy and Card Risk Management to decide approval. It uses cryptograms like TC (Transaction Certificate) for approvals or AAC (Application Authentication Cryptogram) for declines, generated by the card. While secure, it can be vulnerable to certain frauds if not properly implemented, such as offline relay attacks or manipulated terminals.

How EMV Offline Authorization Works​

The process integrates into the standard EMV transaction flow, which includes card authentication, cardholder verification, and risk analysis. Here's a step-by-step breakdown:

1. Card Insertion/Tap and Data Retrieval: The card is presented (contact or contactless via ISO/IEC 14443). The terminal reads application data, including the Application Interchange Profile (AIP) which indicates support for offline processing.
2. Offline Data Authentication (ODA): The terminal verifies the card's authenticity offline using public-key cryptography. This confirms the card's data hasn't been tampered with. ODA methods include:
   • Static Data Authentication (SDA): Uses a static digital signature from the issuer. Simplest but least secure, as it doesn't protect against cloned cards.
   • Dynamic Data Authentication (DDA): Generates a dynamic signature unique to the transaction, providing better protection against counterfeiting.
   • Combined Data Authentication (CDA): Combines DDA with cryptogram generation, ensuring both card authenticity and transaction integrity in one step.
3. Cardholder Verification Method (CVM): Verifies the user, potentially offline (e.g., offline PIN) or skipped for low-value transactions.
4. Risk Management and Decision: The card and terminal evaluate Issuer Action Codes (IACs) and Terminal Action Codes (TACs) against factors like floor limits, transaction amount, and counters (e.g., consecutive offline transactions). If below risk thresholds, the card generates a TC for approval or AAC for decline.
5. Completion and Clearing: The transaction is logged for later batch submission to the issuer during clearing/settlement.

In mobile or NFC contexts, protocols like EOPMA extend offline capabilities with mutual authentication and credit quotas.

Comparison of Offline vs. Online Authorization​

Aspect	Offline Authorization	Online Authorization
Connectivity	No real-time issuer contact; card/terminal decide.	Requires network to send data to issuer.
Speed	Faster (sub-second in contactless); ideal for high-volume/low-value.	Slower due to network latency.
Security	Relies on ODA (SDA/DDA/CDA) and cryptograms (TC/AAC); vulnerable to advanced fraud if terminal compromised.	Stronger; issuer validates ARQC cryptogram in real-time.
Risk Management	Based on pre-set limits, counters, and random selection.	Issuer performs full risk analysis.
Use Cases	Transit, vending, parking; areas with poor connectivity.	Most retail; high-value transactions.
Liability	Merchant/issuer share based on rules; less issuer control.	Issuer typically liable if approved.
Cryptogram Used	TC (approve) or AAC (decline).	ARQC (request), ARPC (response).

Advantages and Disadvantages​

• Advantages: Enables transactions in offline environments, reduces costs from network fees, and supports quick processing (e.g., no CVM for low-value). It maintains EMV's dynamic security over static magstripe data.
• Disadvantages: Higher fraud risk if ODA is weak (e.g., SDA cloning); limited to low-risk scenarios; requires careful PIN synchronization for offline CVM. In modern systems, it's often supplemented with online checks for higher amounts.

For detailed specifications, refer to EMVCo documents like EMV Book 2 (Security and Key Management) or network-specific guidelines.