2013-2014 saw the first trial of EMV online. It ran in the UK with only a select number of online merchants and over the year of the trial there were no chargeback attempts and zero fraud. Consumers were given a small, ultra low cost, fully EMV certificated device that could connect to PCs, laptops, tablets and smartphones using USB, Bluetooth etc. Shopping online was unaffected except that when coming to pay a new button was present on the checkout page offering EMV. The actual payment then became just like a retail store with PIN entry and EMV transaction processing. The consumer device had the benefit that, in addition to making online payments, it could receive payments (AKA mobile merchants), top-up the new inhome smart utility meters and use EMV for remote sign-on to banking etc. All good being based on the card the user already had and the PIN they already use. The system was the first recipient of it's type of the International Common Criteria Security Certification, an extremely high level of security accreditation, with the award presented with much fanfare in Florida. The CCC included all major payment schemes and UK Cards issued the permission to deploy.

The second step in the development was to be to clone the EMV application from the user card into a multiapplication SIM Card using a sophisticated variant of tokenisation of the authentication to avoid the need to enter the EMV card PIN on a smartphone screen. Hence for those in the world with nextgen smartphones and the multiapplication SIM, their mobile became an EMV secured payment vehicle offline and online and retained the ability to both make and receive EMV transactions.

Chris Jarman
One of the original architects of EMV.
christopher.jarman@gmail.com