No abstract

This paper examines the changes in the payment card environment as they relate to EMV (named after Europay, MasterCard and Visa). This research shows that if the combined dynamic data authentication (CDA) card variant of the EMV card is deployed in a full EMV environment, given the relevant known vulnerabilities and attacks against the EMV payment card technology, the consequences of unauthorized disclosure of the cardholder data is of significantly reduced value to a criminal. It also argues that it becomes unnecessary to comply with the Payment Card Industry Data Security Standard (PCI DSS) unless the merchant with the POS terminal has been exposed to proven breach and even in that case the damage caused is likely to be minimal.