Quality control (QC) during the cad personalization process
is vital for card bureaus to ensure they are providing the highest quality
cards to their issuer clients, and operating with efficient manufacturing
processes. Currently, card personalization validation testing occurs as a
separate production process, post personalization. This means that costly
production errors are identified at the end of the batch, and data validation
on the chip, mag-stripe or card embossing is limited and is a manual, time
consuming process. However recent developments whereby card personalization
validation QC has become an integrated and automatic part of the
personalization process enables card bureaus to improve their production
processes and efficiencies, and ultimately deliver a superior service to their
clients.
Why Do You Need To
Test Card Personalization Validation?EMV cards are far more complex than mag-stripe cards. The chip contains more detailed information and has more complicated encoding. Dual interface cards add still further complexity. As a result there are far more opportunities for errors to creep into the personalization process, with data mismatch occurring in different parts of the card.
It is therefore important to test the validity of the data
in the following area:
·
Magnetic stripe vs. chip data (contact and
contactless)
·
Adherence to payments scheme specifications
·
Issuer/card type chip data integrity (tag data
values)
·
Cryptographic keys
·
Card embossing and printing
·
Card livery and stock
Types of Personalization Error
Due to a lack of knowledge about EMV and payment scheme
specifications, the high levels of manual intervention and the fragmented
supplier chain in the card manufacture to issuance process, invalid data
generation can easily occur. Here are some examples of the most typical of
error:
·
Mag-stripe encoding quality
·
Data transposition differences between
mag-stripe, chip and contactless data
·
Cryptography-DES keys incorrect
·
Formatting-incorrectly formatted data
·
Production file creation errors
·
Chip malfunction-damaged contact or contactless
chip
Quality Control Today
It is not possible to perform 100 percent QC with the process commonly used today. Typically, cards are tested at the beginning and end of each batch, with random cards tested in between. Whilst this may identify data transposition errors, other data errors or damaged chips may go undetected.
The card personalization testing process is currently “offline,” meaning that finished cards are manually tested by operators using an offline card personalization test tool. This can add a significant amount of time to the QC process and additional process error and security risks are introduced with the high level of human intervention.
Advances towards 100 Percent QC with Inline Testing
The latest development is to use inline testing, which means card personalization validation is integrated into the personalization process, performed automatically after personalization by a QC test module built into the perso machine.
Achieving 100 Percent QC
To achieve 100 percent QC, all data elements should be validated:
• Mag-stripe
data
• Contact /
contactless chip data
•
Cryptographic keys
• Embossing
on card face
• Card Stock
To validate all the data elements, test scripts and scenarios are set up to:
• Validate
data to EMV and payment scheme requirements
• Confirm
chip, mag-stripe and embossing correlation (depending on machine modules)
• Identify
incorrect data or keys
• Validate
contact and contactless chip data
• Validate
multiple application data
• Validate
issuer-specific data
• Confirm
card livery and stock
Whilst
offline testing has been the industry standard for many years, it does have its
limitations. If a card bureau wants to manufacture to full efficiency, then it
should consider moving to inline personalization QC. Here are examples of how
inline QC testing combined with the card personalization test tool (CPT) brings
additional benefits:
• Mag-stripe
Data
o The
QC module reads all three data tracks on the mag-stripe and the CPT test engine
checks these against ISO character and data rules plus correlation between the
mag-stripe and the chip, as well as validating that the mag-stripe and chip
ICVV differ on every card.
•
Contact/Contactless Chip Data
o The
ATR is activated and APDUs sent to the chip by the QC module
Contact/Contactless Coupler. The APDU response data is then sent via the Perso Machine
Controller to the CPT test engine, where tests are performed to validate:
• EMV,
Payment Scheme Application rules
• Validation
of chip data values against issuer requirements test
• Chip Data vs.
Mag-stripe and Contactless Chip
• The
correct keys were put onto the card
These tests
take just a couple of seconds. Since they are run simultaneously with other
card personalization cycles, they do not add additional time.
• Embossing
on card face
o Optical
character recognition (OCR) scans character impressions on spent topping foil
and the embossed data can be validated against the mag-stripe or chip
cardholder data, issue and expiry dates by the CPT test engine. There is no need
for any manual handling of the card, which reduces potential security risks
from operator fraud.
• Card Stock
Verification
o It
is possible to add the card stock reference data to the test scenarios. OCR
recognition passes the data to the CPT test engine which validates that the
correct card stock for the batch has been used alongside all other cardpersonalization validation tests. This is particularly important when different
card stocks are being used in the same batch.
A Validation Test Report
A validation
test report provides a summary of the tests performed, and if and where errors
occurred. The report allows the bureau to confirm test results to their issuer clients,
identifying and explaining where and why cards have failed. The report can also
be saved for audit purposes.
Benefits of Inline QC
• 100
percent card testing in real time
o
Errors can be detected and corrected quickly
o
Reduces time and costs of re-issuance
• Full data
validation
o
EMV and payment scheme
o
Tag values and keys
o
Issuer specific requirements
• Increased
production efficiencies and ROI
o
Can run 24/7
o
No need for additional QC operatives
• Improved
data security
o Less
need for human intervention
• Full audit
trail
o Comprehensive
reports for each test
It is clear to see why inline card personalization validation is an attractive proposition for card bureaus looking to improve the efficiency of their current production practices and deliver a better solution to their clients. Whilst this is a relatively new development, adoption from progressive bureaus is expected to be rapid with increased pressure from card issuers in large emerging markets, who demand superior levels of product quality and service delivery.
No comments:
Post a Comment