Towards 100% card personalisation QC — from offline inspection to inline QC
An EMV card carries a complex data structure split across the chip, the magnetic stripe and the embossing, and the personalisation process leaves plenty of room for error. Conventional offline QC — the first and last of a batch plus random samples — cannot cover every card. This article sets out the case for inline verification with a QC module built into the personalisation machine.
Key points
- Typical faults: magnetic encoding quality; data transposed between the magnetic stripe, the contact chip and the contactless interface; wrong DES keys; malformed data; errors in the production file; damaged chips
- Conventional offline QC checks the first and last of a batch plus random samples. It may catch transposition, but other data errors and damaged chips can pass through
- With inline QC, a test module inside the personalisation machine verifies each card automatically as soon as it is personalised — every card, in real time, with almost no added process time, since chip verification takes seconds and runs alongside the other stages
- Scope: magnetic stripe data against the ISO rules and its correlation with the chip; chip data verified through ATR and APDUs against the EMV and scheme rules, tag values and keys; embossing checked against the stripe and chip; and confirmation of the card stock
- Benefits: every card inspected, lower reissue costs, round-the-clock operation, no dedicated QC staff, better confidentiality through less manual handling, and an audit trail
Why issuance data has to be verified
An EMV card is far more complex than a magnetic stripe card, and a dual-interface card is harder again. What has to be verified ranges from consistency between the stripe and the chip on both interfaces, through conformance to the scheme specifications, tag values that vary by issuer and card type, cryptographic keys, embossing and printing, right down to the card stock itself. Shipping a wrong card costs not only the reissue but also the issuer's reputation.
The limits of conventional offline QC
The methods in common use today cannot inspect every card. The first and last of a batch are checked and the rest sampled at random. An operator inspects finished cards by hand on an offline card personalisation test tool, which takes time and adds both process errors and security exposure through manual handling. There are technical limits too: the contact chip may only be checked as far as a live ATR, and consistency between the contact and contactless data on a dual-interface card cannot be confirmed.
Inline QC as the answer
The current approach is to build card personalisation verification into the process itself. A QC test module inside the personalisation machine verifies each card as soon as it has been personalised. On the magnetic stripe it reads all three tracks and checks them against the ISO rules, their correlation with the chip, and the required difference between the stripe iCVV and the chip iCVV, which is an anti-fraud requirement. On the chip it powers up to ATR and then sends APDUs to verify the EMV and scheme application rules, the tag values and the validity of the keys. Embossing can be checked against the cardholder name and expiry date held on the stripe and chip, removing the need for visual checks by hand. Add card stock reference data and the same pass confirms that the correct stock was used for the batch. These tests complete in seconds and run alongside the other personalisation stages, so the process as a whole takes no longer.
What this achieves
Inspecting every card in real time means faults are found and corrected immediately, which reduces the time and cost of reissue. Round-the-clock operation with no additional QC staff improves throughput and return on investment, and less manual handling improves data security. The verification report describes what was tested and explains any failures, so it serves both as confirmation to the issuer client and as an audit trail.
What we suggest
The core of inline QC is the Barnes card personalisation verification engine, the CPT range. If you are working offline, start with CPT 3000v3 and the 60H batch reader, which handles unattended QC of up to 60 cards, and move to inline integration when throughput becomes the priority. We suggest phasing the change to suit the production setup at your bureau or issuing operation. Generating the issuance data itself and managing the keys is handled by Barnes P3, the data preparation solution.