EMV (Chip Card)
PCIComplianceHubLast updated
The global standard for chip-based payment cards and the terminals that accept them, named after Europay, Mastercard and Visa. An EMV chip generates a unique cryptogram for every transaction, so intercepted data from one payment cannot be replayed as another. This makes counterfeit card fraud impractical at chip-accepting terminals and is why fraud migrated toward card-not-present channels as EMV rolled out. EMV does not by itself take a merchant out of PCI DSS scope: the primary account number is still present and still requires protection.
Applies to. No PCI DSS v4.0.1 requirement names EMV. A chip transaction still hands the terminal the PAN, expiry and the chip's equivalent of track data, so the usual card-present rules apply: the PAN is cardholder data to protect, the full chip data and any PIN block are sensitive authentication data that Requirement 3 says must not be kept after authorisation, and Requirement 9 covers the terminals themselves. EMV cuts counterfeit fraud at the terminal but does not reduce PCI DSS scope; terminal approval comes from the Council's PTS programme, and the EMV specifications are maintained by EMVCo, a body separate from the Council.