Quality control (QC) during the cad personalization process is vital for card bureaus to ensure they are providing the highest quality cards to their issuer clients, and operating with efficient manufacturing processes. Currently, card personalization validation testing occurs as a separate production process, post personalization. This means that costly production errors are identified at the end of the batch, and data validation on the chip, mag-stripe or card embossing is limited and is a manual, time consuming process. However recent developments whereby card personalization validation QC has become an integrated and automatic part of the personalization process enables card bureaus to improve their production processes and efficiencies, and ultimately deliver a superior service to their clients.Why Do You Need To Test Card Personalization Validation?
EMV cards are far more complex than mag-stripe cards. The chip contains more detailed information and has more complicated encoding. Dual interface cards add still further complexity. As a result there are far more opportunities for errors to creep into the personalization process, with data mismatch occurring in different parts of the card.
It is therefore important to test the validity of the data in the following area:
· Magnetic stripe vs. chip data (contact and contactless)
· Adherence to payments scheme specifications
· Issuer/card type chip data integrity (tag data values)
· Cryptographic keys
· Card embossing and printing
· Card livery and stock
Types of Personalization Error
Due to a lack of knowledge about EMV and payment scheme specifications, the high levels of manual intervention and the fragmented supplier chain in the card manufacture to issuance process, invalid data generation can easily occur. Here are some examples of the most typical of error:
· Mag-stripe encoding quality
· Data transposition differences between mag-stripe, chip and contactless data
· Cryptography-DES keys incorrect
· Formatting-incorrectly formatted data
· Production file creation errors
· Chip malfunction-damaged contact or contactless chip
Quality Control Today
It is not possible to perform 100 percent QC with the process commonly used today. Typically, cards are tested at the beginning and end of each batch, with random cards tested in between. Whilst this may identify data transposition errors, other data errors or damaged chips may go undetected.
The card personalization testing process is currently “offline,” meaning that finished cards are manually tested by operators using an offline card personalization test tool. This can add a significant amount of time to the QC process and additional process error and security risks are introduced with the high level of human intervention.
Advances towards 100 Percent QC with Inline Testing
The latest development is to use inline testing, which means card personalization validation is integrated into the personalization process, performed automatically after personalization by a QC test module built into the perso machine.
Achieving 100 Percent QC
To achieve 100 percent QC, all data elements should be validated:
• Mag-stripe data
• Contact / contactless chip data
• Cryptographic keys
• Embossing on card face
• Card Stock
To validate all the data elements, test scripts and scenarios are set up to:
• Validate data to EMV and payment scheme requirements
• Confirm chip, mag-stripe and embossing correlation (depending on machine modules)
• Identify incorrect data or keys
• Validate contact and contactless chip data
• Validate multiple application data
• Validate issuer-specific data
• Confirm card livery and stock
Offline Testing Versus Inline Testing
Whilst offline testing has been the industry standard for many years, it does have its limitations. If a card bureau wants to manufacture to full efficiency, then it should consider moving to inline personalization QC. Here are examples of how inline QC testing combined with the card personalization test tool (CPT) brings additional benefits:
• Mag-stripe Data
o The QC module reads all three data tracks on the mag-stripe and the CPT test engine checks these against ISO character and data rules plus correlation between the mag-stripe and the chip, as well as validating that the mag-stripe and chip ICVV differ on every card.
• Contact/Contactless Chip Data
o The ATR is activated and APDUs sent to the chip by the QC module Contact/Contactless Coupler. The APDU response data is then sent via the Perso Machine Controller to the CPT test engine, where tests are performed to validate:
• EMV, Payment Scheme Application rules
• Validation of chip data values against issuer requirements test
• Chip Data vs. Mag-stripe and Contactless Chip
• The correct keys were put onto the card
These tests take just a couple of seconds. Since they are run simultaneously with other card personalization cycles, they do not add additional time.
• Embossing on card face
o Optical character recognition (OCR) scans character impressions on spent topping foil and the embossed data can be validated against the mag-stripe or chip cardholder data, issue and expiry dates by the CPT test engine. There is no need for any manual handling of the card, which reduces potential security risks from operator fraud.
• Card Stock Verification
o It is possible to add the card stock reference data to the test scenarios. OCR recognition passes the data to the CPT test engine which validates that the correct card stock for the batch has been used alongside all other cardpersonalization validation tests. This is particularly important when different card stocks are being used in the same batch.
A Validation Test Report
A validation test report provides a summary of the tests performed, and if and where errors occurred. The report allows the bureau to confirm test results to their issuer clients, identifying and explaining where and why cards have failed. The report can also be saved for audit purposes.
Benefits of Inline QC
• 100 percent card testing in real time
o Errors can be detected and corrected quickly
o Reduces time and costs of re-issuance
• Full data validation
o EMV and payment scheme
o Tag values and keys
o Issuer specific requirements
• Increased production efficiencies and ROI
o Can run 24/7
o No need for additional QC operatives
• Improved data security
o Less need for human intervention
• Full audit trail
o Comprehensive reports for each test
It is clear to see why inline card personalization validation is an attractive proposition for card bureaus looking to improve the efficiency of their current production practices and deliver a better solution to their clients. Whilst this is a relatively new development, adoption from progressive bureaus is expected to be rapid with increased pressure from card issuers in large emerging markets, who demand superior levels of product quality and service delivery.