Commentary

How EMV makes mobile payments secure in self-serve kiosks

EMV compliant mobile payment processing improves payment security and safeguards organizations and individuals against fraud threats.

Image courtesy of iStock

April 22, 2019

David Smith is a cryptographer with 12 years of experience in both the public and private sectors. He is currently working on his second startup that will track and interpret the use of contactless payments in the Greater China region.

By David Smith

As self-order kiosks expand across a number of industries, it's important for businesses and organizations considering the technology to know that mobile payments are generally secure, thanks to the progress payment processors and mobile device manufacturers have made in recent years.

In self-service kiosks, mobile payments are implemented in the form of near field communication technology, a short range communication that is based on radio frequency identification technology, a high frequency wireless technology.

NFC enables two devices — such as a mobile phone and a payment card reader — to communicate within a short range. Keeping the two devices in a proximity of inches or touching them will establish a radio communication.

NFC mobile payments are EMV compliant, meaning the transactions are secure in addition to being fast.

NFC mobile payments secure

EMV is a regulated payment method that is based on a smart card technical payment standard. An example of extended secure payment service can be the state where a transaction is being signed by a cryptogram generated by the smart card which makes it difficult for malicious actors to break the associated security mechanism.

EMV reduces the damages that can result from counterfeit, lost or stolen cards. For example, in the case of contactless cards, the unique codes assigned to every transaction using EMV technology reduces the chances of contactless card skimming.

Mobile payment service providers can work with EMV card suppliers to secure payments used for different products and services that are transacted over self-service kiosks.

A self-order scenario

Let's take an example of an individual who wants to purchase a sandwich from a restaurant through its self-service kiosk and pay using their mobile device. If the mobile device supports ApplePay or SamsungPay, the user enters their financial information, including their credit card information, into their phone that will securely store and retrieve it upon request for future use.

To pay for a product at a self-service kiosk, the user puts their device in proximity of the point-of-sale device that is integrated into the self-service kiosk. The required financial information that is stored on the smart chip is safely and automatically read by the POS terminal.

When the mobile device is in range, the high frequency radio waves that are transmitted by the terminal are received by the antennas of a chip in the mobile device. This communication is established through a wireless protocol that enables the exchange of information between the payment reader and the mobile device.

During the transaction, the EMV-compliant chip encrypts the user's information. A newly encrypted datagram is created for every piece of information exchanged for all newly created data. As a result, the data is exchanged in an encrypted manner between the device and the POS terminal. The transferred encrypted data will be stored in a local file server of the self-service kiosk.

The user is also asked to enter a pin or a signature to verify their identity to complete the transaction. This serves as a second level of authentication in an EMV compliant transaction.

This process takes less than one second and protects the user's information and reduces the risks of fraud.

How EMV prevents fraud

If an attacker manages to obtain transaction related information, they cannot use that information due to the sophisticated encryption techniques used and the unique codes associated with the transaction data.

EMV technology improves the security of information of the consumer and the business through the encrypted handshake between the phone and the reader, which makes it difficult for a fraudster to obtain information about the transaction.

EMV compliant mobile payment processing improves payment security and safeguards organizations and individuals against fraud threats.