Second card action analysis rejects a transaction inspite of accepting results of online processing

Question

During Second Card Action Analysis, ICC may request the terminal to complete the transaction by either accepting or declining. And, this request may differ from the result of online processing.

I found in EMV that details of this card risk management like the algorithms within ICC are outside the scope of EMV specifications.

I would like to know some example scenarios where the online processing result is ACCEPTING but the card risk management result is DECLINING.

So, could anyone suggest how can I obtain information about these algorithms? Are there others specification about this? Thank you in advance!

Answer 1

Even though issuers are free to use any algorithm of their choice, the one you see generally implemented is Triple DES. Download and Read EMVCo Book 2 Security and Key Management specification.

• Read A1.2.1 MAC Algorithms using an 8-byte block cipher
• For ARQC Read 8.1.2 for ARPC generation.

Sample cases where card declines a transactions which is approved offline is

• When Issuer authentication is required by card and no ARPC received,
• ARPC verification failed,
• Issuer script template 71, received and it failed updating.

Unless EMV CPS application used, refer the corresponding payment scheme specification.