Using EMV Cards to Protect E-commerce Transactions

Abstract

A growing number of payment transactions are now being made over the Internet. Although transactions are typically made over a secure channel provided using SSL or TLS, there remain some security risks. Meanwhile, EMV-compliant IC cards are being introduced to reduce fraud for conventional debit/credit transactions. In this paper, we propose a way of using EMV IC cards for secure remote payments, such as those made via the Internet, with the goal of providing protection against some of these residual risks. The scheme described in this paper is based on the EMV 2000 Integrated Circuit Card Specification for Payment Systems, which is first outlined. Threats to, and advantages and disadvantages of, the scheme are also examined.