ARQC VS ARPC in EMV online contacless card Payment. How does it work?

Question

EMV contactless card payments have 7 kernels. There are two kernels (Visa FDDA and Union Pay) just support Offline Authorization by either generate cryptogram TC (in case of approval) or AAC (in case of decline) the transaction by the contactless card itself (without going online to the Issuer bank). on the other hand, the rest five kernels (Visa, MasterCard, American Express, JCB and Discover) support both online and offline transaction authorization. In case of Online transaction Authorization, the contactless card will generate ARQC and will be sent to the Issuer Bank through the POS and the Acquire Bank. then the Issuer Bank will validate the ARQC and generate its own response ARPC which will include the Issuer Bank decision (either Approve or decline the contactless card transaction). my question is: is the EMV contactless card should validate the ARPC? if yes, then the card should stay in the range of the POS to wait for the Issuer Bank to validate the card's ARQC and then generate the Issuer Bank ARPC ( which make the EMV contactless card waits for a long time which I do believe more than 500ms) if no, does that mean that the Issuer bank will approve or decline the transaction with just the POS without the card itself? ( which I still can get it) your answer is very appreciated and thanks in advance Ossama

Answer 1

Q: Is the EMV contactless card should validate the ARPC?

A: No. At the moment none of Card Schemes can validate ARPC reply from Issuer for Contactless transactions. Contactless card at the moment of reply may be out of Contactless terminal reader range.

Q: If no, does that mean that the Issuer bank will approve or decline the transaction with just the POS without the card itself?

A: Issuer(and Acquirer) validate online transaction request using several sensitive data sources.

To pass Acquirer system it is always validated:

• POS Terminal Data,
• Transaction Data,
• Required Card Data, etc.

In some business cases Acquirer may approve transaction at this stage without Issuer.

Then authorization request forwarded to Issuer system , they validate:

• For Contactless EMV card - EMV Data (including ARQC).
• For Contactless Swipe card - Dynamically created Track 2 Data.
• Online PIN, where it is expected.

So, YES. Final decision for Contactless transaction will be taken by POS Terminal without card. But, basing on the Acquirer/Issuer validations of sensitive Data and Merchant business cases.

Answer 2

The card does not have to wait for the response to come from issuer and validate the ARPC. Based on the response code alone the transaction is approved. In case all the below are true, the card is asked to be represented.

1. issuer update processing is supported by the contactless reader
2. ctq indicates that card supports issuer update processing
3. issuer authentication/update data received in response.