Are you looking for test card numbers?

Would you like to contact support?

Point-of-sale icon

Cardholder Verification Methods

When used on a payment terminal, credit and debit cards can require a cardholder verification method (CVM) that the person using the card is the legitimate cardholder. Verification is done with a personal identification number or shopper signature.

Personal Identification Number (PIN)

The shopper is prompted to enter their PIN on the terminal. The terminal then verifies the PIN either offline using the EMV chip on the card, or online with the card issuer.

Contactless transactions above the CVM limit always require online verification of the PIN.

Some payment methods, specifically eftpos, require authentication with the PIN when the magnetic strip reader is used. Ask our POS Support Team to configure this for you if you accept such a payment method.

Signature

Whether the terminal prompts for a signature, depends on how you configure this. The major card schemes (American Express, Diners, Discover, JCB, Mastercard, Visa, UnionPay) no longer require a signature; they regard it as optional for card-present transactions. This means you can speed up your checkout by skipping the signature prompt.

But if your business requires it, you can still let the terminal prompt for a signature. The shopper then provides their signature on the touch screen of the terminal or on the printed transaction receipt. This depends on how you configure this setting. It is your responsibility to verify the signature of the shopper with the signature on the card or another form of identification.

To configure signature settings:

  1. Log in to your Customer Area.
  2. Go to Point-of-sale > Terminal settings > Customization.
  3. Under Signature and device name, configure these settings:
    • Skip signature: select Enable to skip asking for a signature, or Disable if you want the terminal to prompt for a signature.
    • Ask for signature: select On screen to let the shopper draw their signature on the display of the terminal, or On Paper to let the shopper draw their signature on the merchant receipt.

Implementing a manual signature check

In a Terminal API integration, the transaction is already authorised when the signature prompt appears. Therefore, the terminal always approves the signature, even when the shopper selects Cancel on the signature screen.

If you want to implement a manual signature check on the cash register, proceed as follows:

  1. Retrieve CapturedSignature data from the PaymentResponse.
  2. Make sure the cash register software shows a prompt to check the signature.
  3. Your staff then checks the signature:
    • If a signature is approved, no action is necessary.
    • If a signature is declined, the payment needs to be refunded.
      In this scenario, we recommend setting up a capture delay. This enables you to cancel the authorisation instead of having to issue a refund.

CVM lists

The CVM list is encoded in the card and contains amount thresholds and information about how to apply CVM. For each CVM, the list includes three elements:

  • CVM code: what to do when the CVM fails, either proceed with the next method or fail the CVM process.
  • CVM type: the actual CVM to be performed, such as PIN verification.
  • CVM condition: the conditions that determine when the CVM type is applicable. For example, Always enforce Online PIN for ATM withdrawals.

CVM list live example

The following CVM list is taken from a Mastercard of type "mcredit".

The amount thresholds are not used.
The first CVM is only used for ATMs and cashback transactions.
All other CVMs are used if the terminal supports them. An Adyen-supplied payment terminal supports all CVMs and would select the first available one in the list: CVM 2 Enciphered PIN verification performed by ICC.

Amount Thresholds

  • Amount X: 0
  • Amount Y: 0

Cardholder Verification Method 1

  • CVM code: if this CVM is unsuccessful, fail cardholder verification.
  • CVM type: enciphered PIN verified online.
  • CVM condition: if cash or cashback (includes quasi-cash).

Cardholder Verification Method 2

  • CVM code: if this CVM is unsuccessful, proceed with the next CVM.
  • CVM type: enciphered PIN verification performed by ICC.
  • CVM condition: if terminal supports the CVM.

Cardholder Verification Method 3

  • CVM code: if this CVM is unsuccessful, fail cardholder verification.
  • CVM type: plaintext PIN verification performed by ICC.
  • CVM condition: if terminal supports the CVM.

Cardholder Verification Method 4

  • CVM code: if this CVM is unsuccessful, fail cardholder verification.
  • CVM type: enciphered PIN verified online.
  • CVM condition: if terminal supports the CVM.

Cardholder Verification Method 5

  • CVM code: if this CVM is unsuccessful, fail cardholder verification.
  • CVM type: signature (paper)
  • CVM condition: if terminal supports the CVM.

Cardholder Verification Method 6

  • CVM code: if this CVM is unsuccessful, fail cardholder verification.
  • CVM type: no CVM required.
  • CVM condition: if terminal supports the CVM.

CVM list test example

Adyen has various test cards with "applications" programmed onto it that each simulate a card with a unique brand, language, country, and currency. In combination with a specific CVM list, this allows you to test a wide variety of scenarios with a single physical card (see Testing credit and debit cards).

In your test Customer Area, when you view the transaction details for test payments made with your Adyen test card, you can also see the applicable Cardholder Verification Method List. This uses Amount Thresholds, which is not common for live cards but very useful for testing purposes. You can trigger different CVMs by varying the amount in combination with currency conditions from the CVM list.

As an example, the CVM list for one of Adyen's test card applications has the following elements:

Amount Thresholds (in minor units)

  • Amount X: 10000
  • Amount Y: 20000

Cardholder Verification Method 1

  • CVM code: if this CVM is unsuccessful, proceed with the next CVM.
  • CVM type: enciphered PIN verified online
  • CVM condition: if transaction is in the currency of the test card application and is over Y value.

Cardholder Verification Method 2

  • CVM code: if this CVM is unsuccessful, proceed with the next CVM.
  • CVM type: enciphered PIN verification performed by ICC.
  • CVM condition: if transaction is in the currency of the test card application and is over X value.

Cardholder Verification Method 3

  • CVM code: if this CVM is unsuccessful, fail cardholder verification.
  • CVM Type: signature (paper).
  • CVM condition: always.

If the test card application you're using has currency code EUR and the transaction is for GBP 95 there are two options:

  • The shopper accepts DCC and is charged ~ EUR 135,-. This means CVM 2 is selected because EUR 135 is over Amount X and the transaction – after accepting DCC - is in the currency of the test card application.
  • The shopper rejects (or is not offered DCC). This means CVM 3 is selected because the transaction is not in the currency of the test card application and CVM 3 'Always' is applied.

CVM results

The resulting CVM is reported to the cash register in the key cardHolderVerificationMethodResults. The value is a hexadecimal representation of the CVM used to verify the cardholder. For example, 440702. The second character in this string represents the CVM. The following table shows what each possible value of the second character means.

Second character Definition
1 Offline plaintext PIN
2 Online PIN
3 Offline plaintext PIN and signature
4 Offline enciphered PIN
5 Offline enciphered PIN and signature
E Signature
F No CVM performed

Contactless (NFC) transactions and CVM

To make contactless transactions, the card must be capable of near-field communication (NFC). The following terminal settings affect contactless transactions:

  • Contactless CVM limit: the transaction amount (in minor units) above which the terminal requires a CVM.

    Current CVM limits
    CVM limits change sometimes. For example, because of the COVID-19 pandemic card schemes temporarily increased the contactless CVM limits. You can find the latest limits in your Customer Area under Point of sale > Terminal settings > Payment features > Limits > Contactless CVM limit.
    When there is a configuration change, the terminal automatically picks up the changed CVM limits in the next maintenance call.

  • Contactless reader limit: the transaction amount above which the contactless reader does not work and the cardholder needs to insert the card. We recommended leaving this setting at the default, to allow for mobile phone and smart watch payments.
  • Contactless currency: the currency for which contactless transactions are accepted. This is the currency of the country where the store is located.
  • Contactless floor limit: the minimum transaction amount for an offline contactless transaction. The default is 0.

If the transaction amount is higher than the contactless CVM limit and the shopper uses an NFC-capable card, the terminal indicates to the card that a CVM is required. The card then indicates to the terminal whether a signature or PIN is required. In the case of PIN, this always means an Online PIN is the actual CVM. This means an NFC transaction over the CVM limit, requiring PIN, can't be processed offline.