You start a transaction with a startTransaction command. There is another step after this - authenticateTransaction, which may or may not automatically be called for you. The authenticateTransaction is a step that allows you, if desired, to "pause" the transaction to understand what card is being processed in case you want make any changes, like change the amount if a store card is being used. At the end of the authenticateTransaction step (or the end of startTransaction step if auto authenticate is happening), the card needs to make a decision. It uses the CDOL1 to give the ICC the tags it needs to generate an AC - Application Cryptogram. There are three types of AC:
ARQC - this is the card telling you it needs to know the host decision before it can give you it's final decision (GO_ONLINE), and the transaction is still in progress waiting for that data.
AAC - this is the card telling you it made its final decision, which is declined, and that you don't need to contact the host (DECLINE_OFFLINE), and the transaction is now over
TC - this is the card telling you it made its final decision, which is approved, and that you don't need to contact the host (APPROVE_OFFLINE), and the transaction is now over.
If you got ARQC, you send that AC and other relevant tags to a host for a decision. You may get up to three pieces of information from the host. The decision (tag 8A), the Issuer Authentication Data (Tag 91) and issuer scripts (tag 71 and 72). You feed this information back to the card with a complete Transaction step.
The ICC then uses tags in CDOL to generate the second application AC. This is the card making the final decision, it can be either AAC (declined) or TC (approved). The transaction is now over.
Remember that in a standard EMV transaction, it is the card that makes the final decision, not the host. There may be cases where the host approves the transaction, but the card still declines it.
|