英文:
Cryptogram Information Data 9F27 returns AAC in second generated AC but approved from host
问题
我对EMV新手，并且正在进行国内网络的认证工作。在记录9F27时，一些测试卡返回AAC，而另一些返回TC，尽管交易已从主机获得批准。我们怀疑问题可能源于标签91（发卡行认证数据），该标签在主机响应中缺失，但在检查了9F27返回TC的测试卡响应后，我们意识到它们也没有标签91。我的问题是，是否可以安全地忽略卡片决定，只需遵循主机响应？这种情况可能的其他可能原因是什么？
英文:
I am new to EMV and working on a certification of domestic network. Some of the test cards returns AAC while other returns TC when logging 9F27 despite the transaction was approved from host. We suspect that the issue might be root to the tag 91 (Issuer Authentication Data) which is missing in the host response but as we checked the response of those test card where 9F27 returns TC we realized that they also have no tag 91 in it. My question is, is it safe to ignore the card decision and just follow the host response? What could be the other possible reason for such case?
答案1
得分: 1
不，忽视卡片决策是不安全的。这违反了大多数支付方案和常识的规定。这可能意味着在欺诈案件中要承担全部责任，没有追索权。
关于测试卡，您确定它们不是用来模拟您应该拒绝并发送交易撤销的情况吗？请与您的处理器核实，为什么您没有收到发卡行身份验证数据 - 也许只是某些配置出了问题。
英文:
No, it is not safe to ignore card decision. It is against the mandates of most payment schemes and common sense. It may mean bearing full responsibility for the transaction in case of fraud and no recourse.
Regarding test cards, are you sure they are not meant to simulate exactly the scenario when you should decline and send reversal to these transactions? Please verify with your processor, why you do not receive Issuer Authentication Data - maybe something is simply misconfigured.
答案2
得分: 1
决定卡的密码永远不要忽视。您需要理解的一些附加信息：
- 密码的类型高度依赖于终端行动代码（源 - 终端）和发卡行动代码（源 - 卡）。这两个值进行异或运算，结果用于内核选择密码类型。
- 密码的类型：
- AAC - Daniel交易密码
- ARQC - 线上交易密码
- TC - 线下交易密码
- 我假设您所说的认证是L3（M-TIP）。如果是的话 - 请阅读测试案例的目标。有些测试案例假定要通过测试的成功条件是交易失败。
- 检查交易限额很重要，因为其值高度依赖于内核和卡的决定以批准交易。
- 对于某些交易类型 - 特别是退款 - AAC密码是正常的，并且授权主机不会对其进行检查。
英文:
Never ignore decision of a card. Some additional info you need to understand:
- Type of cryptogram is highly depend on Terminal Action Code (source - Terminal) and Issuer Action code (source - Card). This two values xored and the result is used in kernel to choose cryptogram type.
- Type of cryptograms:
- AAC - Daniel transaction cryptogram
- ARQC - Online transaction cryptogram
- TC - Offline transaction cryptogram
- I assume under certification you mean L3 (M-TIP). If yes - read testcase objectives. Some testcase assume that successful condition to pass testcase is failed transaction.
- It is important to check transaction limits as it's values highly depend on kernel and card decisions to approve transaction.
- For some transaction type - particularly refund - AAC cryptogram is normal and it's not checked by authorization host.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论