EMV CVM Database
Do you have an EMV credit card and how to determine what the CVM card list looks like? This tutorial will show you how to do it.
What You Need
To least of all read CVM, you need some kind of hardware that can read a smart card. If you have a reader that works with a US government PIV, a US military CAC, or some other card reader, it will work with your EMV credit card as well. Some laptops and keyboards, typically for businesses using smart cards, have built-in card readers. Otherwise, you can buy a USB smart card reader, some are available on Amazon for under $ 20. I am using SCM SCR331 reader.
You will also need software that can read the data from the card. Luckily, there is a free Cardpeek app that works well for this. Cardpeek runs on Windows, Mac OS X, Linux, and FreeBSD. This tutorial will show you how to use Cardpeek to find your card's CVM list, so if you haven't already, download and install Cardpeek.
Launch Cardpeek
After connecting your card reader, launch Cardpeek. You will be prompted to select a card reader; if you have multiple connected, select the one you want to use. Click OK. This will bring up the main Cardpeek window:
Analyze your card
Once the Cardpeek window appears, insert your EMV credit card into the card reader, chip first, and leave it there as if you were using your card in an EMV-enabled payment terminal. On my card reader, the light blinks for a few seconds and then turns off, this may vary depending on your reader and computer. On Windows, your computer will also try to install the device driver software and eventually fail, that's okay.
After inserting the card, click the Analyzer button on the Cardpeek toolbar and select EMV from the menu that appears: The application and card will run for some time, then a dialog box appears asking if you want to execute the Get Processing Parameters command. Click Yes.
The app and card will run for a few more seconds, and when done, the Cardpeek window will be filled with the information read from your card, and the status bar at the bottom of the window will display the message “Reader Disabled”.
Find and review the list of CVMs
Scroll until you find List of Cardholder Verification Methods (CVM). This can help you enlarge or expand the Cardpeek window. Explaining CVM handling is beyond the scope of this tutorial, but I'll give you a basic summary. When you insert a card into a payment terminal, the terminal will read this list in order until it finds a cardholder verification method it supports that is suitable for the transaction. Also be aware that the "If" statement shown at the end is processed first.
So let's start with CVM 1. It says "If cash is unattended." This usually refers to cash withdrawals from an ATM (from your bank account if it is a debit card, or an advance if it is a credit card). CVM stands for Online Verified Encrypted PIN. Thus, if we are at an ATM, the terminal is instructed to check your PIN-code over the network at the bank, and if this fails, then the cardholder check is not performed. This is just like using a magnetic stripe card at an ATM.
But if we are not an ATM, then CVM 1 will not apply. So we move on to CVM 2. It says, "If the terminal supports CVM." Well, this is not really useful, we need to know if this CVM is supported by the terminal. The CVM is called “Signature (on paper),” which means that the cardholder should be asked to sign the receipt or digital pad. Most payment terminals that have a cashier support this (even in countries where most people have chip cards and PINs), so CVM will be used. This is similar to what would happen to a magnetic stripe card if you passed it through a payment terminal or if you held an EMV card in a location that does not support EMV. So the example above shows a card with a chip and a signature.
So most of the time the user of the shown card will be asked to sign a receipt, but two more CVMs are shown, so let's talk about them. CVM 3 is not a CVM. In this case, the transaction can be continued without any verification by the cardholder. This is not as strange as it sounds, many small US kiosk transactions do not actually have a CVM. Consider using a magnetic stripe card at a parking meter, at a subway ticket vending machine, or at a gas station where you insert and remove the card to make a payment.
CVM 4 is "ICC encrypted PIN verification". Similar to CVM 1, this refers to PIN verification. Only this one is verified by "ICC", not online. ICC is another way to designate a chip on a card. Thus, this suggests that the card itself must verify the PIN. This is called "offline PIN" versus "online PIN" when the PIN is verified over the network by the issuing bank. Credit cards can support one or the other or both for purchases, this card supports an offline PIN, which is common in countries that have historically had high communication costs and therefore wanted to be able to perform cardholder verification without going online.
So we have what some call "Chip and Signature with PIN Capability." In most cases, the cardholder will be prompted to sign the receipt, but in some cases, the cardholder will be prompted to enter a PIN. In some countries where EMV has been in use for some time, automatic payment terminals, such as train ticket kiosks, usually require a PIN, and this card will work at these kiosks. Some US banks issue credit cards that do not have any kind of PIN support (other than cash advances), and the credit card industry is pushing for No CVM support to be mandatory at kiosk kiosks, so in the future, a chip and signature card may also work in these places.
Now what?
So now that you know what the CVM list on your card is, you should know what to expect when using the card. If your card does not appear on this site, or this site shows a list of CVMs other than the card, please let us know and we can add it. You can use this contact form to send us detailed information. At a minimum, please submit your CVM list and card name. The link to the map on the issuer's website will also be quite helpful so that we can easily add more details.
Do you have an EMV credit card and how to determine what the CVM card list looks like? This tutorial will show you how to do it.
What You Need
To least of all read CVM, you need some kind of hardware that can read a smart card. If you have a reader that works with a US government PIV, a US military CAC, or some other card reader, it will work with your EMV credit card as well. Some laptops and keyboards, typically for businesses using smart cards, have built-in card readers. Otherwise, you can buy a USB smart card reader, some are available on Amazon for under $ 20. I am using SCM SCR331 reader.
You will also need software that can read the data from the card. Luckily, there is a free Cardpeek app that works well for this. Cardpeek runs on Windows, Mac OS X, Linux, and FreeBSD. This tutorial will show you how to use Cardpeek to find your card's CVM list, so if you haven't already, download and install Cardpeek.
Launch Cardpeek
After connecting your card reader, launch Cardpeek. You will be prompted to select a card reader; if you have multiple connected, select the one you want to use. Click OK. This will bring up the main Cardpeek window:
Analyze your card
Once the Cardpeek window appears, insert your EMV credit card into the card reader, chip first, and leave it there as if you were using your card in an EMV-enabled payment terminal. On my card reader, the light blinks for a few seconds and then turns off, this may vary depending on your reader and computer. On Windows, your computer will also try to install the device driver software and eventually fail, that's okay.
After inserting the card, click the Analyzer button on the Cardpeek toolbar and select EMV from the menu that appears: The application and card will run for some time, then a dialog box appears asking if you want to execute the Get Processing Parameters command. Click Yes.
The app and card will run for a few more seconds, and when done, the Cardpeek window will be filled with the information read from your card, and the status bar at the bottom of the window will display the message “Reader Disabled”.
Find and review the list of CVMs
Scroll until you find List of Cardholder Verification Methods (CVM). This can help you enlarge or expand the Cardpeek window. Explaining CVM handling is beyond the scope of this tutorial, but I'll give you a basic summary. When you insert a card into a payment terminal, the terminal will read this list in order until it finds a cardholder verification method it supports that is suitable for the transaction. Also be aware that the "If" statement shown at the end is processed first.
So let's start with CVM 1. It says "If cash is unattended." This usually refers to cash withdrawals from an ATM (from your bank account if it is a debit card, or an advance if it is a credit card). CVM stands for Online Verified Encrypted PIN. Thus, if we are at an ATM, the terminal is instructed to check your PIN-code over the network at the bank, and if this fails, then the cardholder check is not performed. This is just like using a magnetic stripe card at an ATM.
But if we are not an ATM, then CVM 1 will not apply. So we move on to CVM 2. It says, "If the terminal supports CVM." Well, this is not really useful, we need to know if this CVM is supported by the terminal. The CVM is called “Signature (on paper),” which means that the cardholder should be asked to sign the receipt or digital pad. Most payment terminals that have a cashier support this (even in countries where most people have chip cards and PINs), so CVM will be used. This is similar to what would happen to a magnetic stripe card if you passed it through a payment terminal or if you held an EMV card in a location that does not support EMV. So the example above shows a card with a chip and a signature.
So most of the time the user of the shown card will be asked to sign a receipt, but two more CVMs are shown, so let's talk about them. CVM 3 is not a CVM. In this case, the transaction can be continued without any verification by the cardholder. This is not as strange as it sounds, many small US kiosk transactions do not actually have a CVM. Consider using a magnetic stripe card at a parking meter, at a subway ticket vending machine, or at a gas station where you insert and remove the card to make a payment.
CVM 4 is "ICC encrypted PIN verification". Similar to CVM 1, this refers to PIN verification. Only this one is verified by "ICC", not online. ICC is another way to designate a chip on a card. Thus, this suggests that the card itself must verify the PIN. This is called "offline PIN" versus "online PIN" when the PIN is verified over the network by the issuing bank. Credit cards can support one or the other or both for purchases, this card supports an offline PIN, which is common in countries that have historically had high communication costs and therefore wanted to be able to perform cardholder verification without going online.
So we have what some call "Chip and Signature with PIN Capability." In most cases, the cardholder will be prompted to sign the receipt, but in some cases, the cardholder will be prompted to enter a PIN. In some countries where EMV has been in use for some time, automatic payment terminals, such as train ticket kiosks, usually require a PIN, and this card will work at these kiosks. Some US banks issue credit cards that do not have any kind of PIN support (other than cash advances), and the credit card industry is pushing for No CVM support to be mandatory at kiosk kiosks, so in the future, a chip and signature card may also work in these places.
Now what?
So now that you know what the CVM list on your card is, you should know what to expect when using the card. If your card does not appear on this site, or this site shows a list of CVMs other than the card, please let us know and we can add it. You can use this contact form to send us detailed information. At a minimum, please submit your CVM list and card name. The link to the map on the issuer's website will also be quite helpful so that we can easily add more details.
