TVR Decoder

What the TVR records

The Terminal Verification Results is tag 95, five bytes that start a transaction as all zeros. As the terminal works through the EMV steps it sets a bit each time a check fails, is skipped or cannot be completed. Each byte belongs to one stage: offline data authentication, card and application validity, cardholder verification, terminal risk management, and in byte 5 the things that happen after the card has spoken to the issuer.

The card usually asks for the TVR in the data for GENERATE AC, and the issuer receives it in DE 55, so all three parties end up holding the terminal's account of the transaction.

Reading one by hand

Take 0000048000. Split it into bytes: 00 00 04 80 00. Bytes 1 and 2 are clear. Byte 3 is 04, which is b3 on its own: an online PIN was entered. Byte 4 is 80, which is b8: the transaction exceeds the floor limit. That is an ordinary chip and PIN purchase going online, and nothing in it is a fault.

The Hex column in the table above gives the value of each bit alone. A byte with several bits set is their sum, so C0 in byte 1 is 80 plus 40: offline data authentication not performed, and SDA failed.

Values you will see often

0000000000 means the terminal recorded nothing. 0000008000 is the floor limit bit alone, which a terminal with a zero floor limit sets on every transaction. 8000008000 adds byte 1 b8, offline data authentication not performed, which is normal for an online-only terminal. 0080008000 has byte 2 b8 set: the card and the terminal carry different application version numbers, which is informational.

A set bit is not a decline

The TVR is a report. The decision comes from terminal action analysis, where the terminal compares the TVR against the Issuer Action Codes from the card and its own Terminal Action Codes: the Denial pair first, then the Online pair, then the Default pair if it cannot reach the issuer. A bit matters only when the same bit is set in the action code being checked. The IAC comparator does that comparison and names the bit that decided it.

Read it with the TSI

A clear bit has two possible meanings: the check passed, or the check never ran. For cardholder verification, issuer authentication and script processing, only the TSI tells them apart. Offline data authentication is the exception, because byte 1 b8 says outright that it was not performed.

The relay resistance bits in byte 5 are set by the Mastercard contactless kernel (EMV Book C-2). On a contact transaction, or under another kernel, expect them clear.