Scope of This Guide
This guide focuses on implementing numberless card programs and smartphone-based authentication for Card Not Present (CNP) transactions. It's designed for payment security engineers tasked with integrating physical card innovations into digital payment systems, especially those managing authentication for e-commerce platforms.
You'll find requirement mappings, integration patterns, and deployment considerations. This guide specifically addresses using physical card presence for digital transaction authentication.
Key Concepts and Definitions
Numberless card: A payment card without the Primary Account Number (PAN), expiration date, and CVV printed on it. These details are accessed through a mobile app.
NFC-based card authentication: A method where the physical card is tapped against an NFC-enabled smartphone to verify cardholder presence during a CNP transaction.
Hybrid authentication flow: Combines possession of a physical card with device-based authentication to establish cardholder identity for remote transactions.
Card Present authentication for CNP: Uses the physical card as an authentication factor in remote transactions, blurring the traditional Card Present/Card Not Present distinction.
Requirements Breakdown
PCI DSS 4.0 Alignment
Requirement 3.5.1: Numberless cards meet this requirement as the PAN isn't visible on the card. Your mobile app must still secure the PAN with encryption and masking.
Requirement 8.4.2: If your app allows viewing full PANs or initiating transactions, it must enforce Multi-Factor Authentication (MFA). The card tap can be one factor, but you'll need another, like biometrics or a PIN.
Requirement 11.6.1: When integrating NFC authentication, monitor the authentication module for changes. Any modification should trigger alerts.
EMV Payment Tokenisation Framework Considerations
If using network tokens with numberless cards, your system must maintain the link between the physical card and the digital token. The token vault should store the mapping between the card's NFC identifier and the tokens, not the actual PAN.
Implementation Guidance
Architecture Pattern: NFC Authentication for CNP Checkout
Here's a flow you can use:
- Initiation: User selects "Authenticate with card tap" at checkout.
- Challenge Generation: Your service generates a cryptographic challenge and sends it to the app.
- NFC Interaction: User taps their card; the card signs the challenge.
- Verification: Your backend validates the signature.
- Transaction Authorization: Upon successful authentication, the transaction proceeds.
Critical Detail: The challenge must be single-use and time-bound. Store used nonces to prevent replay attacks.
Mobile App Security Controls
Your app displaying PAN details should include:
- Local Authentication: Require biometric or device PIN before showing full PAN.
- Screenshot Prevention: Disable screenshots when PAN is visible.
- Clipboard Restrictions: Don't allow copying full PAN; mask if necessary.
- Certificate Pinning: Prevent man-in-the-middle attacks.
- Root/Jailbreak Detection: Don't display full PAN on compromised devices.
Enrollment and Provisioning Flow
When issuing a numberless card:
- Inject card credentials into the card's secure element.
- Establish cryptographic keys for NFC authentication.
- Provision the app with a secure reference for card details.
- Require MFA before first PAN reveal.
- Register the card's public key certificate with your service.
Common Pitfalls
Single-Factor Authentication: The card tap is a possession factor. You need a second factor for MFA.
Storing Full PAN Locally: Retrieve the PAN on-demand from a secure API. If cached, use hardware-backed encryption with a short expiry.
Card Replacement Scenarios: Update the app's card reference when reissuing cards.
Inadequate NFC Timeout Handling: Implement timeout handling to reset the session state if authentication isn't completed in time.
Ignoring Device-Based Fraud Signals: Evaluate device fingerprint and behavior even for card-tap-authenticated transactions.
Quick Reference Table
| Implementation Aspect | Requirement | Control |
|---|---|---|
| PAN display in app | PCI DSS 8.4.2 | MFA (biometric + possession of card) |
| PAN storage in app | PCI DSS 3.5.1 | Retrieve on-demand; if cached, use hardware-backed encryption with 5-min expiry |
| NFC authentication challenge | General security | Single-use nonce, 60-90 second validity, replay prevention |
| Card tap signature validation | General security | Validate against issuer's public key certificate |
| Checkout page modification | PCI DSS 11.6.1 | Include NFC auth module in change detection scope |
| Network token binding | EMV Tokenisation | Map card NFC identifier to token reference, not PAN |
| Card reissuance | Operational | Invalidate old credentials, update app reference, notify user |
| Compromised device detection | Risk management | Root/jailbreak detection, refuse PAN display |
| Screenshot prevention | Data protection | Disable screenshots when PAN visible |
Version References: This guide reflects PCI DSS v4.0 requirements. If using PCI DSS v3.2.1, note that MFA requirements (8.3 in v3.2.1) still apply.
Issuer Coordination: Confirm your card issuer supports the necessary cryptographic operations for NFC authentication. Not all numberless card programs include this capability.
