'Does host should increase ATC (Application Transaction Counter) (EMV tag 9F36) after unsuccessful transaction?
The host update the ATC after success transaction and the counter on the ICC and in the host DB is the same in this moment.
But, does host should increase/update the ATC in the own DataBase after not success transaction (for example after transaction with not correct PIN) because the counter on ICC is increased? Or host shouldn't change the ATC after it.
I didn't find answer into any EMV book.
Solution 1:[1]
One of the big objectives of emv transaction is to stop replay transactions. The authenticity of a transaction is verified using Authorization Request Cryptogram and ATC is a component of its generation and obviously in its validation.
Now, chip increments the ATC every time you issue a Get Processing Options. So when you receive a transaction online, it is expected that the ATC for the transaction is always higher than the last ATC you have at issuer. If it is same or lower than what stored at issuer for the card, the transaction is probably a replay.
Solution 2:[2]
The Host system should update its internal track of the chip ATC any time it is confident that it has received an authentic ARQC from the chip, to the new value received from the chip.
Remember that the ATC from the chip is always the correct value, so if you as the host received a message with an unexpected ATC value that you can be sure came from the chip, even if the actual transaction fails for some other reason (i.e. insufficient funds), you should always update the host tracking value to that value received from the card.
The ATC reflects the number of transactions initiated (via the GET PROCESSING OPTIONS call) against the chip across its whole life, and not the number of successful transactions.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | |
| Solution 2 | david.barkhuizen |