Know and understand electronic funds transfer at point of sale (EFTPOS) terminals including checking of the validity of cards, the use of chip and PIN, the use of contactless cards, the use of Near Field Communication (NFC) payment, the communication

6 ICT Applications – Electronic Funds Transfer at Point of Sale (EFTPOS)

1. Introduction to EFTPOS

EFTPOS terminals allow customers to pay for goods and services directly from their bank accounts using debit or credit cards. The transaction is processed electronically and the funds are transferred in real time between the retailer’s bank and the card‑holder’s bank.

2. Key Components of an EFTPOS Transaction

• Card – magnetic stripe, EM \cdot chip, contactless (NFC) or mobile wallet.
• Terminal – hardware that reads the card, captures the PIN (if required) and communicates with the retailer’s POS system.
• Retailer’s computer system – records the sale, sends transaction data to the acquiring bank.
• Acquiring bank – the retailer’s bank that forwards the request to the card‑issuing bank.
• Issuing bank – the card‑holder’s bank that authorises or declines the transaction.
• Network – secure communication channels (e.g., VisaNet, MasterCard Network) that carry the messages.

3. Checking the \cdot alidity of Cards

Before a transaction is sent for authorisation, the terminal performs several checks:

1. Physical inspection – card is present, not damaged, and the expiry date has not passed.
2. Magnetic stripe/Chip data verification – Luhn algorithm is applied to the primary account number (PAN) to detect entry errors.
3. Expiry date check – the terminal compares the date on the card with the current date.
4. Card verification value (C \cdot V/C \cdot C) – used for online transactions; not read by POS terminals but may be requested for contactless limits.
5. Card status check – the issuing bank can flag a card as blocked, stolen or exceeded credit limit; this is determined during authorisation.

4. Chip and PIN Process

The EMV (Europay, MasterCard, Visa) chip and PIN method provides a high level of security. The typical steps are:

1. Customer inserts the card into the chip reader.
2. Terminal reads the chip data and generates a unique cryptogram for the transaction.
3. Customer enters their PIN on the secure keypad.
4. Terminal encrypts the PIN using a public key supplied by the card scheme.
5. All data (cryptogram, encrypted PIN, transaction amount, etc.) are sent to the acquiring bank.
6. The acquiring bank forwards the request to the issuing bank via the payment network.
7. The issuing bank validates the cryptogram, decrypts the PIN, checks the account balance and returns an authorisation response (APPRO \cdot ED or DECLINED).
8. The terminal displays the result and prints a receipt.

5. Contactless Cards (Tap‑and‑Go)

Contactless cards use the same EM \cdot chip technology but do not require a PIN for low‑value transactions (usually up to \$50–\$100, depending on the region).

• Customer taps the card on the terminal’s antenna.
• The terminal reads the chip data via radio‑frequency (13.56 MHz).
• A transaction cryptogram is generated and sent for authorisation.
• If the cumulative amount of contactless purchases exceeds a set limit, the terminal will request a PIN for the next transaction.

6. Near Field Communication (NFC) Payments

NFC extends contactless technology to mobile devices (e.g., Apple Pay, Google Pay). The process is similar to contactless cards but includes additional security layers:

1. Device stores a tokenised version of the card number; the real PAN never leaves the device.
2. When the user taps the device, a one‑time dynamic security code (DSC) is generated.
3. The terminal receives the token and DSC, forwards them to the acquiring bank.
4. The issuing bank maps the token to the actual account, validates the DSC and returns an authorisation response.

7. Communication Between Supermarket Computer and Bank Computer

The data exchange follows a standardised message format (commonly ISO 8583). A simplified flow diagram is shown below.

7.1 Message Structure (ISO 8583)

7.2 Security Measures

• End‑to‑end encryption (E2EE) of all sensitive fields.
• Use of TLS/SSL for the network link between the retailer’s gateway and the acquiring bank.
• Tokenisation for NFC and mobile wallet transactions.
• PCI‑DSS compliance for all entities handling card data.

8. Summary Comparison

9. Key Points to Remember

• Validity checks prevent obvious errors before the transaction reaches the bank.
• Chip and PIN provide the strongest protection for in‑store purchases.
• Contactless is convenient for low‑value sales but still uses dynamic cryptograms.
• NFC payments add an extra layer of security through tokenisation.
• All communication follows ISO 8583 messages, is encrypted, and must comply with PCI‑DSS.