PayPass M-TIP Test Case User Guide. 09 April 2013

PayPass M-TIP Test Case User Guide 09 April 2013

Copyright The information contained in this manual is proprietary and confidential to Master International Incorporated (Master) and its members. This material may not be duplicated, published, or disclosed, in whole or in part, without the prior written permission of Master. Media This document is available in both electronic and printed format. Master Worldwide - CCoE Chaussée de Tervuren, 198A B-1410 Waterloo Belgium Fax: +32 2 352 5353

Table of Contents 1 Using this Manual...1 1.1 Scope...1 1.2 Audience...1 1.3 Terminology...1 1.4 Document structure...2 TC011 - Interoperability various uncommon data/length...2 1.5 Related Publications...3 1.6 Abbreviations...3 1.7 Notations...4 1.8 History...5 2 Introduction...6 2.1 Terminal Integration Testing Process...6 2.2 Introduction to the M-TIP s...7 2.3 Testing requirements...8 3 Test Cases...9 3.1 Test Case Template Description...9 3.2 Common PayPass M/Chip Test Cases... 11 TC001 - Regression card does not support any ODA... 11 TC002 - Regression CDA... 12 TC003 - Regression different CA key lengths... 12 TC004 - Regression exponent 2^16+1... 13 TC005 - Regression Offline-only & ARQC... 13 TC011 - Interoperability various uncommon data/length... 14 TC012 - Interoperability CDOL1 includes tags forbidden in DE 55... 14 TC021 - Integration/capabilities OfflinePIN not supported in PayPass... 15 TC024 - Integration/capabilities cardholder receipt... 15 TC025 - Integration/capabilities refund... 16 TC026 - Integration/capabilities Data Storage... 17 TC033 - Integration/CVM transactions below the CVM Required Limit... 18 TC034 - Integration/CVM ATM... 19 TC037 Integration/Mobile Non-[PayPass3.0] terminal vs Mobile device... 20 TC038 - Integration/Mobile On-Device cardholder verification requested... 20 TC041 - Integration/online message Gratuities / Tips... 21 TC042 - Integration/online message Issuer response: successful... 21 TC043 - Integration/online message Issuer response: unsuccessful... 22 TC045 - Integration/online message Issuer response contains script... 22 TC046 - Integration/online message Network mandatory data not in CDOL1... 23 TC047 - Integration/online message PAN sequence number from chip... 23 TC048 - Integration/online message PAN sequence number not returned... 24 TC049 - Integration/online message Full Grade... 24 TC050 - Integration/online message PayPass Values in Existing Authorization Fields... 25 TC051 - Integration/online message Online PIN... 26 TC052 - Integration/online message Issuer response: wrong Online PIN... 27 TC053 Integration/online message Track 2 Equivalent Data must be used in the authorization request... 27 TC054 - Integration/online message CVM Results in authorization message... 28 TC055 Integration/online message Device Type data element in the authorization request... 28 TC061 - Integration/ Contactless Transaction Limit... 29 PayPass M-TIP Test Case User Guide 09 April 2013 i

Table of Contents TC062 Integration/ Terminal application version number for PayPass - M/Chip is 0002... 30 TC065 - Integration PIX extension... 30 TC066 - Integration service code indicates a chip is present on card... 31 TC067 - Integration service code indicates Online PIN... 31 TC070 Integration Application Selection without cardholder assistance... 32 3.3 Master PayPass M/Chip Test Cases... 33 TC201 - Regression SDA... 33 TC221 - Integration/CVM attended terminal... 34 TC222 - Integration/CVM CAT1... 35 TC223 - Integration/CVM CAT2 and CAT3... 36 TC260 Integration/ Purchase with Cash Back... 37 3.4 Maestro PayPass M/Chip Test Cases... 38 TC401 - Integration/capabilities No PayPass Mag Stripe... 38 TC410 - Integration/CVM Online PIN above the CVM Required Limit (Maestro PayPass in soft limit markets)... 38 TC411 - Integration/CVM nocvm above the CVM Required Limit (soft limit market)... 39 TC412 - Integration/CVM No CVM below the CVM Required Limit... 39 3.5 PayPass Mag Stripe Test Cases... 40 TC601 - Interoperability various uncommon data/length... 40 TC611 - Integration Service Code checking... 40 TC612 - Integration ATC in discretionary data... 41 TC613 - Integration Issuer response: unsuccessful... 41 TC614 - Integration Traditional Mag Stripe... 42 TC615 Integration Track 1 and Track 2 data are processed independently... 42 TC616 - Integration Track1 data not fully populated... 43 TC681 Integration/Mobile Non-[PayPass3.0] terminal vs Mobile device (Mag-Stripe)... 43 TC682 Integration/Mobile On-Device cardholder verification not requested... 44 TC683 - Integration/Mobile On-Device cardholder verification requested... 45 TC684 - Integration/Mobile PIN verification successful... 46 4 Test Scenarios for M-TIP Subset 8... 47 4.1 M-TIP Subset 8 card details... 47 4.2 Using the Test s... 49 4.3 Test Scenario Template Description... 49 4.4 Test Scenarios for Master PayPass M/Chip... 52 4.5 Test Scenarios for Maestro PayPass M/Chip... 149 5 Test Scenarios for M-TIP Subset 6... 213 5.1 M-TIP Subset 6 card details... 213 5.2 Using the Test s... 214 5.3 Test Scenario Template Description... 214 5.4 Test Scenarios for PayPass Mag Stripe... 215 6 Annexes... 234 6.1 RSA Keys used... 234 6.2 DES Keys used... 236 6.3 DES Key Used for PVV and CVC... 237 ii PayPass M-TIP Test Case User Guide 09 April 2013

Using this Manual 1 Using this Manual This chapter contains information that helps you understand and use this document. 1.1 Scope This document lists the PayPass Mag Stripe and PayPass M/Chip test cases and test scenarios used for the PayPass M-TIP. 1.2 Audience This document is intended for use by terminal vendors and Acquirers who want to obtain approval for their PayPass implementation. 1.3 Terminology 'Terminal' vs. 'reader' In many cases the PayPass reader is separate from the POS terminal. However, when dealing with M-TIP it makes more sense to consider both the separate reader and the POS terminal as a single device. Therefore this document will use the term terminal or PayPass terminal in order to refer to: the device providing the contactless interface used by the PayPass card and the device supporting the PayPass application and the device sending the authorization/clearing messages online. '' This document uses the term "card" or "M-TIP card" but the test tool could also be a card simulator or a probe. 'Contactless Transaction Limit' This document uses the term "Contactless Transaction Limit" in order to refer to: the "Terminal Contactless Transaction Limit" (used in [PayPass2.x] and [PPReq2011]) the "Reader Contactless Transaction Limit (No On-device CVM)" (used in [PayPass3.0]) PayPass M-TIP Test Case User Guide 09 April 2013 1

Using this Manual 1.4 Document structure This document includes 5 sections: Introduction: this section gives some details about the test cards and the testing requirements. Test cases: this section lists the high level test cases that are linked to individual requirements extracted from the specifications. Most of the high level test cases are split into several test scenarios in order to test all terminal types. The high level test cases first row is in blue. TC011 - Interoperability various uncommon data/length Test scenarios: this section lists the test scenarios that will be used during the testing session. The test scenarios first row is in black. In the second row, the objective contains a reference to the related high level test case in square brackets. PPC MCD 02 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Cases of Discretionary Data inconsistency and IAD ( 9F10 ) with maximum length. [TC011] Annexes: this section lists some test cards cryptography details. 2 PayPass M-TIP Test Case User Guide 09 April 2013

Using this Manual 1.5 Related Publications The following publications contain information related to the contents of this manual. PPReq2011 PayPass - M/Chip Requirements, 5 December 2011 PayPass3.0 PayPass2.1 PayPass2.0 PayPass2.x PayPass M/Chip Reader Application Interface Specification V3.0.1 April 2012 PayPass M/Chip Reader Application Interface Specification (V2.1) + PayPass M/Chip Application#18 (April 12, 2010) PayPass M/Chip Reader Application Interface Specification (V2.0) + PayPass M/Chip Application#15 (April 2, 2009) [PayPass2.1] or [PayPass2.0] MChip2011 M/Chip Requirements - 29 June 2011 CustomerIntfce Customer Interface Specification 6 April 2012 MTIPguide M-TIP Process Guide 20 July 2012 EMV BOOK 1 EMV BOOK 2 EMV BOOK 3 EMV BOOK 4 ICC Specification for Payment Systems: Application Independent ICC to Terminal Interface Requirements. Version 4.2, June 2008. ICC Specification for Payment Systems: Security & Key Management. Version 4.2, June 2008. ICC Specification for Payment Systems: Application Specification. Version 4.2, June 2008. ICC Specification for Payment Systems: holder, Attendant and Acquirer Interface Requirements. Version 4.2, June 2008. 1.6 Abbreviations The following abbreviations are used in this manual: Abbreviation AAC AFL AID AIP ARQC ATC CA Public Key CDA CDOL CVM Description Application Authentication Cryptogram Application File Locator Application Identifier Application Interchange Profile Authorization Request Cryptogram Application Transaction Counter Certification Authority Public Key Combined DDA/AC generation Risk Management Data Object List holder Verification Method PayPass M-TIP Test Case User Guide 09 April 2013 3

Using this Manual EMV IAC ICC M/Chip PAN PDOL PIN POS PPSE RFU RID SDA SE TAC TC TVR Europay Master Visa Issuer Action Code Integrated Circuit Master Chip Primary Account Number Processing Data Object List Personal Identification Number Point of Sale PayPass Payment System Environment Reserved for Future Use Registered Application Provider Identifier Static Data Authentication Subelement Terminal Authentication Code Transaction Certificate Terminal Verification Results 1.7 Notations The following notations apply: Notation Description 0 to 9 and A to F 16 hexadecimal digits. Values expressed in hexadecimal form are enclosed in single quotes (i.e. _ ). 1001b abcd [ ] xx Binary notation. Values expressed in binary form are followed by a lower case b. an or ans string. Optional part. Any value. 4 PayPass M-TIP Test Case User Guide 09 April 2013

Using this Manual 1.8 History The following lists the main changes: Version Changes September 2012 December 2012 February 2013 April 2013 New version aligned with [PPReq2011] - added MCD 4B test 4 for an offline only terminal - added MP4B test 4 for an offline only terminal - Device Type Indicator in Canada added - in some Maestro scenarios, clarified that the "Enter amount below the CVM limit" could be ignored if this limit is zero - MP16: the amounts must be different from *55* and *75* - Both CVM results values '1F0300' and '1F0302' are acceptable respectively in [PayPass2.x] and [PayPass3.0]. All occurences were not corrected - Some cards have 2 acceptable versions (eg: v2.0 and v2.1) - the Subset 6 cards IDxxx may also be called MCCxxx - transaction type values are precised in some scenarios - reviewed the tests to better cover the ATMs: > TC049 updated. Scenarios 'PPC MCD 01' T01b and 'MP01' T01b added accordingly. > Scenario MP17 split - Various test corrections: > PPC MAP 07 T11: amount must no longer be below the Floor limit > ID352 T02: added a pass criteria > ID372 T01, ID373 T02, ID374 T02: Amount must be below the Contactless Transaction Limit (on-device CVM) > TC061 reviewed and related scenarios updated > 'PPC MCD 04' and 'MP18' version 2.1 changed to 2.2 - Various minor changes: > split the test scenario pass criteria into 3 sub sections "Visual checks", " log checks" and "Network simulator checks" > in some scenarios, clarified that both 'D' and '=' are acceptable Track2 separators > rephrased the pass criteria about signature > homogenized the words subelement, subfield, pds, > added section "1.4 Document structure" PayPass M-TIP Test Case User Guide 09 April 2013 5

Introduction 2 Introduction This chapter contains an introduction to the M-TIP testing processes and the M-TIP cards. 2.1 Terminal Integration Testing Process The M-TIP process defined in [MTIPprocess] is applicable for PayPass terminals supporting [PayPass2.x] or [PayPass3.0]. Acquirers must complete the M-TIP process before deploying and using a terminal in a live environment. The objective of the M-TIP process is to ensure the terminal meets the Master requirements described in [PPReq2011]. The current document describes: the M-TIP test cases that are defined to ensure the correct implementation of the Master requirements. the test scenarios that must be executed in M-TIP. The test scenarios refer to one or several test cases. Each test scenario involves an M-TIP card. A Test Scenario is a short test procedure permitting to check one or several specification requirements identified in the Test Cases. This is outlined in the figure below: Specifications (requirements) Test Cases Test Scenario Test Case # 1 + Test Case # 2 + Test Case # 3 xx TIP cards 6 PayPass M-TIP Test Case User Guide 09 April 2013

Introduction 2.2 Introduction to the M-TIP s About M-TIP s Master has designed sets of test cards, to allow the acquirer to test that the host and terminal payment applications are compliant with Master requirements. The M-TIP cards are grouped into different subsets in order to allow targeted testing. For the M-TIP process, the following PayPass subsets are used. For PayPass M/Chip terminals, the Subset 6 ensures that the PayPass M/Chip terminals correctly work with PayPass Mag Stripe cards. that the Subset 6 is also used during Network Interface Validation (NIV) tests of PayPass Mag Stripe terminals. However the current document is M-TIP-focused so the Subset 6 will sometimes be referred to as "M-TIP Subset 6". The Subset 8 ensures that the PayPass M/Chip terminals correctly work with PayPass M/Chip cards. Number of s The following table summarizes the content of the PayPass M-TIP Subsets. Subset Type Number of cards Subset 6 PayPass Mag Stripe cards 11 PayPass M/Chip cards 1 Master PayPass M/Chip cards 20 Subset 8 Maestro PayPass M/Chip cards 20 Combo cards (both Master and Maestro PayPass M/Chip) 2 Total Number of cards 54 that the tests defined in this document do not use all the cards above. The few unused cards may be removed in the next future. PayPass M-TIP Test Case User Guide 09 April 2013 7

Introduction 2.3 Testing requirements During the M-TIP testing session, the terminal must be as close as possible as it will be in the live environment. In particular, the terminal must be configured as follows. The list of Application Identifiers (AID) supported by the terminal must be the ones intended for live deployment. Application Version Number PayPass Mag Stripe: Terminal Application version number shall be set to 0001 for PayPass Mag Stripe. Application Version Number PayPass M/Chip: Terminal Application version number shall be set to 0002 for PayPass M/Chip. The Terminal Contactless Transaction Limit shall have the same value as in the field for Master and Maestro applications. The Terminal Contactless Transaction Limit (On-Device CVM), when applicable, shall have the same value as in the field for Master and Maestro applications. The Terminal Contactless Floor Limit shall have the same value as in the field for Master and Maestro applications The Terminal CVM Required Limit, when applicable, shall have the same value as in the field for Master and Maestro applications. However the Certification Authority Public Keys shall be the test keys defined further in the section "RSA Keys used". 8 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases 3 Test Cases This chapter lists the high level PayPass M/Chip M-TIP Test Cases. 3.1 Test Case Template Description Overview TC002 - Regression CDA Below is an example of Test Case. This template is described here after. Reference Documentation Test To ensure that the PayPass terminal performs CDA correctly. Terminal supports CDA [PPReq2011]: Section 2.4.5 Offline Data Authentication Requirements p2-11 The transaction amount must be below the Contactless Transaction Limit. The AIP byte 1 indicates that CDA is supported. Data returned by card is such as the transaction can be approved offline*. The terminal shall send request a TC with CDA ( 50 ) in the Generate AC. Transaction shall be approved offline. *: most of the PayPass terminals will bypass the CDA if the transaction is declined or sent online, see the transaction flow in technical specifications. TC002 - Regression CDA Test Case name The Test Case is as follows: TCxyy - [Test category] - [Test title]. TCxyy uniquely identifies the Test Case. It follows the below rules: TC0yy: Common PayPass M/Chip Test Cases TC2yy: Master PayPass M/Chip Test Cases TC4yy: Maestro PayPass M/Chip Test Cases TC6yy: PayPass Mag Stripe Test Cases [Test category] can be the following: "Regression": major Level2 tests that are re-performed during M-TIP to ensure no regression occurs when integrating the product in the live environment. "Interoperability": these tests are basic tests that are re-performed during M- TIP because they often led to interoperability issues. PayPass M-TIP Test Case User Guide 09 April 2013 9

Test Cases "Integration": those tests ensure the PayPass terminal complies with the Master requirements defined in [PPReq2011]. To ensure that the PayPass terminal performs CDA correctly. This is a short description of the objective of the test. Terminal supports CDA This gives the conditions for the test to be applicable. Reference Documentation Reference Documentation [PPReq2011]: Section 2.4.5 Offline Data Authentication Requirements p2-11 This makes a reference to the related requirement in the specifications. Test Test The transaction amount must be below the Contactless Transaction Limit. The AIP byte 1 indicates that CDA is supported. Data returned by card is such as the transaction can be approved offline*. This lists all the conditions required for testing the objective. : the test conditions often assume that the reader supports the "Contactless Transaction Limit". If not, it is obvious that the related condition shall be disregarded. The terminal shall send request a TC with CDA ( 50 ) in the Generate AC. Transaction shall be approved offline. This lists the conditions required in order to pass the test. *: most of the PayPass terminals will bypass the CDA if the transaction is declined or sent online, see the transaction flow in technical specifications. Some Test Cases include a note in order to clarify some test details. 10 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases 3.2 Common PayPass M/Chip Test Cases The test cases described in this section apply to terminals that accept either Master PayPass or Maestro PayPass. TC001 - Regression card does not support any ODA Reference Documentation Test To ensure the PayPass terminal correctly behaves when the card does not support any offline data authentication method. As per below sub-cases Regression test no specific reference The transaction amount must be below the Contactless Transaction Limit. The AIP byte 1 indicates that SDA, DDA and CDA are NOT supported. Tests are run for Master and Maestro applications, when applicable: Case 1a: [if CVM Required Limit is not zero] amount is below the Floor Limit (and terminal is online capable)* Case 1b: [if CVM Required Limit is zero] amount is below the Floor Limit (and terminal is online capable) Case 2: amount is above the Floor Limit Case 3: terminal is offline-only The terminal will set the TVR byte 1 bit 8 (offline data authentication not performed). Cases 1 & 2: Online capable terminals shall request an ARQC as per TAC settings, even if the amount is below the Floor Limit. Case 3: Offline-only terminals will decline the transaction offline as per TAC settings. *: if the CVM Required Limit is lower than the Floor Limit and if both the card and the terminal support Online PIN, the amount should be below the CVM Required Limit in order to not set the TVR byte 3 bit 3 ( OnlinePIN entered ). PayPass M-TIP Test Case User Guide 09 April 2013 11

Test Cases TC002 - Regression CDA Reference Documentation Test To ensure that the PayPass terminal performs CDA correctly. Terminal supports CDA [PPReq2011]: Section Offline Authentication p4-10 The transaction amount must be below the Contactless Transaction Limit. The AIP byte 1 indicates that CDA is supported. Tests are run for Master and Maestro applications, when applicable. Case 1: the amount is below the Floor Limit. Data returned by card is such that the transaction can be approved offline*. Case 2 (terminal supports [PayPass3.0]): the amount is above the Floor Limit TVR byte 1 bit 8 is not set (offline data authentication was performed). TVR byte 1 bit 7 is not set (SDA did not fail). TVR byte 1 bit 4 is not set (DDA did not fail). TVR byte 1 bit 3 is not set (CDA did not fail). Case 1: The terminal shall request a TC with CDA ( 50 ) in the Generate AC. The transaction shall be approved offline. Case 2: The terminal shall request an ARQC with CDA ( 90 ) in the Generate AC. The transaction shall be approved online. *: PayPass terminals supporting [PayPass2.x ] will bypass the CDA if the transaction is declined or sent online, see the transaction flow in technical specifications. TC003 - Regression different CA key lengths Reference Documentation Test To ensure the PayPass terminal correctly supports different certification authority public key lengths. Terminal supports SDA or CDA Regression test no specific reference The transaction amount must be below the Contactless Transaction Limit. The AIP byte 1 indicates that SDA or/and CDA is supported. If the terminal supports [PayPass2.x ], data returned by card is such as the transaction can be approved offline*. Tests are run for Master and Maestro applications, when applicable: Case 1: CA key length is 1152/144 Case 2: CA key length is 1408/176 Case 3: CA key length is 1984/248 The TVR shall indicate that the ODA was performed: TVR byte 1 bit 8 = 0. Transaction shall be approved. *: PayPass terminals supporting [PayPass2.x ] will bypass the CDA if the transaction is declined or sent online, see the transaction flow in technical specifications. 12 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC004 - Regression exponent 2^16+1 Reference Documentation Test To ensure the PayPass terminal correctly supports the exponent 2^16+1. Terminal supports CDA Regression test no specific reference The transaction amount must be below the Contactless Transaction Limit. The AIP byte 1 indicates that CDA is supported. ICC public key exponent is 2^16+1. If the terminal supports [PayPass2.x ], data returned by card is such as the transaction can be approved offline*. Tests are run for Master and Maestro applications, when applicable. The TVR shall indicate that the ODA was performed: TVR byte 1 bit 8 = 0. Transaction shall be approved. *: PayPass terminals supporting [PayPass2.x ] will bypass the CDA if the transaction is declined or sent online, see the transaction flow in technical specifications. TC005 - Regression Offline-only & ARQC Reference Documentation Test To ensure that offline-only PayPass terminal correctly behaves when the card erroneously sends an ARQC. Terminal is offline-only Regression test no specific reference The transaction amount must be below the Contactless Transaction Limit. The AIP byte 1 indicates that CDA is supported. The card is such as it always returns an ARQC. Tests are run for Master and Maestro applications, when applicable. The offline-only PayPass terminal shall terminate the transaction upon reception of the ARQC PayPass M-TIP Test Case User Guide 09 April 2013 13

Test Cases TC011 - Interoperability various uncommon data/length Reference Documentation Test To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Always applicable Interoperability test no specific reference The transaction amount must be below the Contactless Transaction Limit. The card returns the data defined below. Tests are run for Master and Maestro applications, when applicable: Case 1: Unknown tags (e.g.: 88 ) in PPSE response Case 2: Service Code inconsistency between track2 ( 57 ) and specific tag ( 5F30 ) Case 3: Discretionary Data inconsistency between track2 ( 57 ) and specific tag ( 9F20 ) Case 4: Track1 discretionary data (tag 9F1F ) with maximum length (48 bytes) Case 5: Track2 ( 57 ) with maximum acceptable length (37 digits) Case 6: Unrecognized CVM returned in the CVM list Case 7: IAD ( 9F10 ) with maximum length Case 8: the signed record is padded up to 254 bytes with '00's. supports SDA only. Case 9: the signed record is padded up to 254 bytes with '00's. supports CDA. Case 10: PayPass Third Party data ( 9F6E ) with length 5. Case 11: PayPass Third Party data ( 9F6E ) with length 32. In all cases the terminal shall approve the transaction. TC012 - Interoperability CDOL1 includes tags forbidden in DE 55 Reference Documentation Test To ensure the PayPass terminal correctly behaves when the CDOL1 includes tags being forbidden in the DE 55. Terminal is online capable. Interoperability test no specific reference The transaction amount must be below the Contactless Transaction Limit. The card requests 9F21 (Transaction Time) and 9F40 (Additional Terminal Capabilities) in CDOL1. Those data items are forbidden in DE 55. The network simulator validates the authorization message and returns the response '00' (Approved). Tests are run for Master and Maestro applications, when applicable. The Terminal shall not send the tags 9F21 and 9F40 to the network. The Terminal shall approve the transaction. 14 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC021 - Integration/capabilities OfflinePIN not supported in PayPass Reference Documentation Test To ensure the PayPass terminal does not support offlinepin. Always applicable [PPReq2011]: holder Verification page 4-13 The transaction amount must be below the Contactless Transaction Limit. The AIP byte 1 bit 5 indicates holder Verification supported. The first CVM in the card CVM list is OfflinePIN. Tests are run for Master and Maestro applications, when applicable: Case 1: amount is below the CVM Required Limit Case 2: amount is above the CVM Required Limit The terminal does not send any VerifyPIN command. The CVM results byte 1 is different from '41'. The PayPass transaction completes successfully. TC024 - Integration/capabilities cardholder receipt Reference Documentation Test To ensure that the PayPass terminal is able to print a cardholder receipt. Terminal supports receipt printing [PPReq2011]: Section Receipts page 4-15 Tests are run for Master and Maestro applications, when applicable. Case 1: amount is below the CVM Required Limit Case 2: amount is above the CVM Required Limit The terminal shall approve the PayPass transaction. Case 1:The PayPass terminal shall be able to print a cardholder receipt in case the cardholder requests it. Case 2: The PayPass terminal must print a cardholder receipt. PayPass M-TIP Test Case User Guide 09 April 2013 15

Test Cases TC025 - Integration/capabilities refund Reference Documentation Test To ensure the PayPass terminal correctly performs refund. Terminal supports refund [PPReq2011]: Section Refunds page 4-5 - First step is to perform the purchase: The transaction amount must be below the Contactless Transaction Limit. - Second step is to perform the refund: If requested, the refund amount must be the same as the purchase amount. Tests are run for Master and Maestro applications, when applicable: Case 1: [terminal supports [PayPass2.0]] PayPass M/Chip transaction to be refunded Case 2: [terminal supports [PayPass2.1] or [PayPass3.0]] PayPass M/Chip transaction to be refunded Case 3: PayPass Mag Stripe Master transaction Case 1: The first transaction is approved. In the second transaction, the end of the transaction is out of scope. At the end of the refund process, the terminal displays a message to inform the cardholder that refund has been done successfully. Case 2: The first transaction is approved. In the second transaction, the PayPass terminal requests an AAC. At the end of the refund process, the terminal displays a message to inform the cardholder that refund has been done successfully. Case 3: The first transaction is approved. At the end of the refund process, the terminal displays a message to inform the cardholder that refund has been done successfully. 16 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC026 - Integration/capabilities Data Storage Reference Documentation Test To ensure the terminal correctly completes the payment transaction when the card supports Data Storage. As per below sub-cases No specific reference The card requests the tags '9F5C' and '9F40' in the PDOL. The card returns the Application Capabilities Information '01 05 00' (DS version 1, field off request, CDA over AAC, Undefined SDS **). The card returns the DS ID. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). The card returns the DSDOL. The network simulator returns the response 00 (successful). Tests are run for Master and Maestro applications, when applicable: Case 1 [if the terminal does not support IDS]: the card only returns AIP and AFL in the GetPO response Case 2 [if the terminal supports IDS]: whatever the DS Requested Operator ID provided in the GetPO command, the card returns AIP, AFL and '9F5F 01 00' ("no slot available") in the GetPO response Case 3 [if the terminal supports IDS]: whatever the DS Requested Operator ID provided in the GetPO command, the card returns AIP, AFL, '9F5F 01 40' (volatile slot), '9F7F' (DS Unpredictable Number), '9F7D 08 00 00' (DS Summary 1). When the GenAC command includes the DSDOL data then Summary2 and Summary3 are included in the SDAD. Summary2=Summary1. Summary3<>Summary2. The terminal shall approve the transaction. PayPass M-TIP Test Case User Guide 09 April 2013 17

Test Cases TC033 - Integration/CVM transactions below the CVM Required Limit Reference Documentation Test To ensure the PayPass terminal is able to perform PayPass transactions below or equal to the defined limit, when applicable. To ensure the PayPass terminal completes CVM processing when the amount is below or equal to the defined limit. Terminal has a CVM Required Limit greater than zero [PPReq2011]: Section holder Verification page 4-12 The transaction amount must be below the CVM Required Limit. Tests are run for Master and Maestro applications, when applicable. contains ( 4203 5E03 1F03 ) in the CVM list. The terminal shall approve the PayPass transaction offline or online. The cardholder verification shall be successful: TVR byte 3 bit 8 = 0 CVM Result must indicate either 420300 or 5E0300 or 1F0300 or 1F0302. 18 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC034 - Integration/CVM ATM Reference Documentation Test To ensure the ATM correctly performs holder Verification. To ensure the Terminal Contactless Floor Limit is set to zero. Terminal is an ATM. [PPReq2011]: Section Automated Teller Machines, page 4-17 The transaction amount must be the smallest possible amount. The network simulator validates the authorization message and returns a successful response. Tests are run for Master and Maestro applications, when applicable: Case 1: card supports Signature and No CVM ( 5E03 1F03 ). Case 2: card supports Online PIN, Signature and No CVM ( 4203 5E03 1F03 ). TVR byte 4 bit 8 is set (floor limit exceeded). The terminal shall approve the transaction since the network simulator returns a successful response. Case 1: The cardholder verification shall fail: TVR byte 3 bit 8 = 1 CVM Result shall be 3F 00 01 The terminal shall neitherot prompt for PIN nor request print a signature receipt. Case 2: The terminal shall request an ARQC. The terminal shall prompt for PIN. TVR byte 3 bit 3 = 1 (Online PIN entered) CVM result shall be 42 03 00 PayPass M-TIP Test Case User Guide 09 April 2013 19

Test Cases TC037 Integration/Mobile Non-[PayPass3.0] terminal vs Mobile device Reference Documentation Test To ensure the terminal not supporting "On-device cardholder verification" correctly completes the transaction with a Mobile. Terminal does not support [PayPass3.0] or the "Kernel " indicates "Ondevice cardholder verification NOT supported" Integration test no specific reference The transaction amount must be below the Contactless Transaction Limit. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). The network simulator returns the response 00 (successful). Tests are run for Master and Maestro applications, when applicable: The terminal shall approve the transaction. TC038 - Integration/Mobile On-Device cardholder verification requested Reference Documentation Test To ensure the terminal correctly completes the transaction with a Mobile. Terminal supports [PayPass3.0] and On-Device cardholder verification No specific reference AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). The network simulator returns the response 00 (successful). Tests are run for Master and Maestro applications, when applicable: - A first transaction is performed where the Mobile indicates that the Mobile PIN was successfully verified Case 1: amount is below the CVM Required Limit. Case 2: amount is above the CVM Required Limit. - A second transaction is performed where the Mobile indicates "PIN verification successful" In first transaction, the terminal shall display "Please see phone" (or equivalent). In second transaction, the terminal shall approve the transaction. Case 1: CVM results value must be '3F 00 02' Case 2: CVM results value must be '01 00 02' 20 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC041 - Integration/online message Gratuities / Tips Reference Documentation Test To ensure the PayPass terminal correctly manages the gratuities, when supported. Terminal supports gratuities [PPReq2011]: Gratuities page 4-5 The cardholder must enter a gratuity amount. The transaction amount plus the gratuity amount must be below the Contactless Transaction Limit. The network simulator validates the authorization message and returns a successful response. Tests are run for Master and Maestro applications, when applicable. The online authorization request must contain the sum of initial amount and gratuity in the 'Amount authorized' field (DE 55 subfield SE 9F02) and in DE 04. The 'Amount, other' field (DE 55 subfield SE 9F03) must contain zeroes or be absent. The transaction shall be approved. TC042 - Integration/online message Issuer response: successful Reference Documentation Test To ensure the PayPass terminal correctly manages the Issuer response 00 (successful). Terminal is online capable [MChip2011] Section Authorization Response Code page 3-34 The transaction amount must be below the Contactless Transaction Limit. The card returns an ARQC. The network simulator validates the authorization message and returns the responses 00 (successful). Tests are run for Master and Maestro applications, when applicable. DE 55 subfield SE 9F27 value in the network log shall be the same as returned by the card to the first GENERATE AC. The terminal shall approve the transaction upon reception of the network response. PayPass M-TIP Test Case User Guide 09 April 2013 21

Test Cases TC043 - Integration/online message Issuer response: unsuccessful Reference Documentation Test To ensure the PayPass terminal correctly manages the Issuer responses 51 (insufficient funds) and 57 (Transaction not permitted). Terminal is online capable [CustomerIntfce] Section DE 39 - Response Code The transaction amount must be below the Contactless Transaction Limit. The network simulator validates the authorization message and returns the responses below. Tests are run for Master and Maestro applications, when applicable: Case 1: network simulator response is 51 (insufficient funds) Case 2: network simulator response is 57 (Transaction not permitted) The terminal shall decline the transaction upon reception of the network response. PayPass terminals should prompt for a contact transaction ([PPReq2011] section Subsequent Contact Transactions page 4-15). TC045 - Integration/online message Issuer response contains script Reference Documentation Test To ensure the PayPass terminal does not process the ICC response data erroneously returned by the issuer. Terminal is online capable [PPReq2011]: Section Acquirer Network Requirements page 4-18 The transaction amount must be above the Floor Limit and below the Contactless Transaction Limit. is let on the terminal until the transaction is completed or the ticket is printed. The network simulator validates the authorization message and returns the following response: - DE 39 (Response code) = '00' (Approved) - DE 55 - PDSSE 91 (Issuer Authentication Data) is present - DE 55 - PDSSE 72 (Issuer Script Template 2) with one script identifier and 6 PIN Unblock commands followed by a PIN Change Unblock. Tests are run for Master and Maestro applications, when applicable. The terminal must not send any command to the card beyond the 1st Generate AC. The transaction must successfully complete. 22 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC046 - Integration/online message Network mandatory data not in CDOL1 Reference Documentation Test To ensure the PayPass terminal transmits transaction mandatory data to the network even if it is not requested by the card in the CDOL1. Terminal is online capable [MChip2011] Section Contents of DE 55 page 3-30 The transaction amount must be below the Contactless Transaction Limit. The card does not request Terminal Country Code (tag 9F1A ), Transaction Date (tag 9A ), Transaction Type (tag 9C ) nor Transaction Currency Code (tag 5F2A ) in the CDOL1. The network simulator validates the authorization message (not the ARQC) and returns the response '00' (Approved). Tests are run for Master and Maestro applications, when applicable. The Terminal shall send to the network: Terminal Country Code (tag 9F1A ) Transaction Date (tag 9A ) Transaction Type (tag 9C ) Transaction Currency Code (tag 5F2A ) The Terminal shall approve the transaction. TC047 - Integration/online message PAN sequence number from chip Reference Documentation Test To ensure the PayPass terminal transmits the PAN sequence number coming from the chip and not from the Track2 equivalent data item. Terminal is online capable [MChip2011] Section Data in the Authorization Request Message page 3-30 The transaction amount must be below the Contactless Transaction Limit. The PAN sequence number value from the tag 5F34 is different from the one in the Track2 equivalent data item. The network simulator validates the authorization message and returns the response '00' (Approved). Tests are run for Master and Maestro applications, when applicable. The Terminal shall send the PAN sequence number value from the tag 5F34 to the network. The simulator must successfully validate the provided ARQC. The Terminal shall approve the transaction. PayPass M-TIP Test Case User Guide 09 April 2013 23

Test Cases TC048 - Integration/online message PAN sequence number not returned Reference Documentation Test To ensure the PayPass terminal does not transmit the PAN sequence number when it is not returned by the card. Terminal is online capable [MChip2011] Section Data in the Authorization Request Message page 3-30 The transaction amount must be below the Contactless Transaction Limit. The PAN sequence number is not returned by the card. The network simulator validates the authorization message and returns the response '00' (Approved). Tests are run for Master and Maestro applications, when applicable. The Terminal shall not send the PAN sequence number (DE 23) to the network. The Terminal shall approve the transaction. TC049 - Integration/online message Full Grade Reference Documentation Test To ensure that the PayPass terminal supports the Full Grade network messages. Terminal is online capable [PPReq2011]: Section Authorization Requirements p4-19 The transaction amount must be below the Contactless Transaction Limit. The network simulator validates the authorization message and returns the response '00' (Approved). Tests are run for Master and Maestro applications, when applicable. Case 1: terminal is an ATM Case 2: terminal is not an ATM The terminal shall approve the transaction. The terminal shall send a DE 55 message to the network. DE 55 SE 9F03 (Amount, Other) contains zeroes or is absent. Case 1: DE 3 subfield 1 (transaction type code) value is '00' (purchase). Case 2: DE 3 subfield 1 (transaction type code) value is '01' (withdrawal). DE 48 byte 1 value is 'Z'. 24 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC050 - Integration/online message PayPass Values in Existing Authorization Fields Reference Documentation Test To ensure the PayPass terminal correctly manages the PayPass values in the existing authorization fields. Terminal is online capable [PPReq2011]: Section Authorization Requirements page 4-19 The transaction amount must be below the Contactless Transaction Limit. The network simulator validates the authorization message and returns the response 00 (successful). Tests are run for Master and Maestro applications as well as card and mobile device types, when applicable: Case 1: PayPass Mag Stripe transaction (Master application only) Case 2: PayPass M/Chip transaction, tag 5F34 is returned by card* Case 1: the network simulator shall receive the following: DE 22 SE subfield 1 = 91 DE 61 subfield SE 11 = 3 Case 2: the network simulator shall receive the following: DE 22 subfield SE 1 = 07 DE 23 = 01 DE 55 shall be present DE 61 subfield SE 11 = 3 The terminal shall approve the transaction. *: another specific test [TC048] exists where the card does not return the tag 5F34. PayPass M-TIP Test Case User Guide 09 April 2013 25

Test Cases TC051 - Integration/online message Online PIN Reference Documentation Test To ensure the PayPass terminal correctly manages the Online PIN verification, when supported. Terminal supports Online PIN [MChip2011] Section Data Requirements Network Data, page 4-36 The transaction amount must be above the CVM Required Limit and below the Contactless Transaction Limit. The AIP indicates that CVM is supported. Data returned by card is such as Online PIN is to be performed. The network simulator validates the authorization message (including PIN) and returns a successful response. Several tests are performed. In all cases the Online PIN entered is correct: Case 1: Online PIN is 4 digits long Case 2: Online PIN is 5 digits long Case 3: Online PIN is 6 digits long. The TVR byte 3 bit 3 must be set (Online PIN entered). The network simulator displays the correct PIN value: PIN Validation, PIN = xxxx where xxxx is the card PIN. The terminal shall approve the transaction. 26 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC052 - Integration/online message Issuer response: wrong Online PIN Reference Documentation Test To ensure the PayPass terminal correctly manages the Issuer responses 55 (wrong PIN) and 75 (Allowable number of PIN tries exceeded). Terminal supports Online PIN [PPReq2011] section holder Verification page 4-13 The transaction amount must be above the CVM Required Limit and below the Contactless Transaction Limit. The network simulator validates the authorization and returns the responses below. Tests are run for Master application: Case 1: network response is 55 (wrong PIN) Case 2: network response is 75 (Allowable number of PIN tries exceeded) The TVR byte 3 bit 3 must be set (Online PIN entered). The terminal shall decline the transaction upon reception of the network response.* *: In case of a wrong PIN (case 1), one could expect the terminal to prompt the cardholder to enter the PIN again and then resend the authorization message with the second PIN. However some issuers will decline if they receive a second authorization with the same ATC (transaction counter) value, even if the second PIN is correct. Therefore the terminal shall decline the transaction in order to avoid such issues in the field. TC053 Integration/online message Track 2 Equivalent Data must be used in the authorization request Reference Documentation Test To ensure that a terminal transmits the Track2 Equivalent Data for a PayPass M/Chip transaction. Terminal is online capable [PPReq2011]: Section Track Data Consistency, page 4-9 The transaction amount must be above the CVM Required limit (if existing) and below the Contactless Transaction Limit. Tests are run for Master and Maestro applications, when applicable. Case 1: purchase with a card Case 2: purchase with a mobile Case 3: purchase with Cash Back The 0100 (or 0200) message shall contain a DE 35 populated with the content of the card Track2 Equivalent Data (both D and = are acceptable separators). PayPass M-TIP Test Case User Guide 09 April 2013 27

Test Cases TC054 - Integration/online message CVM Results in authorization message Reference Documentation Test To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55 (effective 1 April 2017). The terminal is online capable [MChip2011]: "Contents of DE 55", page 3-31 Tests are run for Master and Maestro applications, when applicable: Case 1: the CDOL requests the CVM Results. device type. Case 2: the CDOL requests the CVM Results. Mobile device type. Case 3: the CDOL does not request the CVM Results The PayPass terminal must transmit the CVM Results (DE 55 SE- PDS 9F34) in the authorization message (effective 1 April 2017). TC055 Integration/online message Device Type data element in the authorization request Reference Documentation Test To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. Always [PPReq2011]: Section Authorization Messages, page 4-19 The transaction amount must be below the Contactless Transaction Limit. Tests are run for Master and Maestro applications, PayPass M/Chip and PayPass Mag Stripe, when applicable. Case 1: the card returns a Third Party Data indicating a device type 'card' Case 2: [terminal does not support on-device cardholder verification] the card returns a Third Party Data indicating a device type 'mobile' Case 3: [terminal supports on-device cardholder verification] the card returns a Third Party Data indicating a device type 'mobile' Case 4: the card returns a Third Party Data indicating a device type 'tag' The 0100 (or 0200) message shall contain a DE 48 SE s23 (effective 19 April 2013 in US region and 18 October 2013 in Canada) populated with the correct device type value: Case 1: '00' (card) Cases 2 & 3: '01' (mobile) Case 4: '04' (tag) 28 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC061 - Integration/ Contactless Transaction Limit Reference Documentation Test To ensure the PayPass terminal correctly implements the Contactless Transaction Limit. As per below sub-cases [PPReq2011]: Section Terminal Contactless Transaction Limit p4-6 The card returns only one AID in the PPSE. Tests are run for Master and Maestro applications, when applicable: Case 1a: [if the terminal allows the user to enter amounts equal to the Contactless Transaction Limit] amount is equal to the Contactless Transaction Limit (e.g.: 25.00 ) Case 1b: [if the terminal supports On Device holder Verification and allows the user to enter amounts equal to the Contactless Transaction Limit (On Device CVM)] amount is equal to the Contactless Transaction Limit (On Device CVM) (e.g.: 25.00 ) Case 2: [if the terminal supports [PayPass2.x] and allows to enter amounts greater than the Contactless Transaction Limit], the amount is one minor unit above the Contactless Transaction Limit (e.g.: 25.01 ) Case 3a: [if the terminal supports [PayPass3.0] and allows to enter amounts greater than the Contactless Transaction Limit], the amount is one minor unit above the Contactless Transaction Limit (e.g.: 25.01 ) Case 3b: [if the terminal supports On Device holder Verification and allows to enter amounts greater than the Contactless Transaction Limit (On Device CVM)] the amount is one minor unit above the Contactless Transaction Limit (On Device CVM) (e.g.: 25.01 ) Cases 1a & 1b: the terminal shall approve the transaction. Case 2: the terminal shall not perform the transaction above the Contactless Transaction Limit. The terminal will either abort after the PPSE response or will not activate the PayPass reader*. Cases 3a & 3b: the terminal shall not perform the transaction above the Contactless Transaction Limit. The terminal shall will either abort after the last ReadRecord response or will not activate the PayPass reader*. Case of amount below the Contactless Transaction Limit is implicitly tested in most of the scenarios. *: The [PayPass2.x] terminals may not will activate the reader and send the PPSE command if none of the they supported applications accepting amounts greater than the Contactless Transaction Limit being tested. PayPass M-TIP Test Case User Guide 09 April 2013 29

Test Cases TC062 Integration/ Terminal application version number for PayPass - M/Chip is 0002 Reference Documentation Test To ensure that a terminal has its application version number for PayPass - M/Chip set to 0002. Always applicable [PPReq2011]: Section Terminal Risk Management, page 4-14 The transaction amount must be below the Contactless Transaction Limit. Test is run for Master and Maestro applications, when applicable The card Application Version Number is set to 0002 ( 9F08 02 0002 ) The terminal shall approve the transaction online or offline. TVR byte 2 bit 8 = 0 (ICC & terminal have same application versions) TC065 - Integration PIX extension Reference Documentation Test To ensure that the PayPass terminal correctly manages the extended AIDs. Always applicable [PPReq2011]: Section Application Selection page 4-10 The transaction amount must be below the Contactless Transaction Limit. The network simulator validates the authorization message and returns the response '00' (Approved). Tests are run for Master and Maestro applications, when applicable: Case 1: AID is extended with the following: D056 01 Case 2: AID is extended with the following: C123456789 The terminal shall select the extended AID and correctly continue the transaction. 30 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC066 - Integration service code indicates a chip is present on card Reference Documentation Test To ensure that the PayPass terminal does not prompt for a contact transaction when the service code indicates a chip is present on the card. Always applicable [PPReq2011]: Section Service Codes page 4-9 The transaction amount must be below the Contactless Transaction Limit. The service code included in the Track2 indicates that a chip is present on the card. Tests are run for Master and Maestro applications, when applicable. The terminal shall approve the PayPass transaction. The terminal shall not prompt for a contact transaction. TC067 - Integration service code indicates Online PIN Reference Documentation Test To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Always applicable [PPReq2011]: Section Service Codes page 4-9 The transaction amount must be below the Contactless Transaction Limit. Tests are run for Master and Maestro applications, when applicable: CVM list does not include Online PIN. Case 1: Service Code contained in Track2 is 206 (Normal Authorization, PIN if pinpad present). Amount is below the CVM Required Limit. Case 2: Service Code contained in Track2 is 206 (Normal Authorization, PIN if pinpad present). Amount is above the CVM Required Limit. Case 3: Service Code in Track2 is 220 (Issuer Authorization, PIN if pinpad present) Case 4: Service Code contained in Track2 is 226 (Issuer Authorization, PIN required) Cases 1: the terminal shall not prompt for PIN. The terminal shall approve the PayPass transaction. Case 2 & 03 & 04: the terminal shall not prompt for PIN. The terminal shall approve the PayPass transaction offline. PayPass M-TIP Test Case User Guide 09 April 2013 31

Test Cases TC070 Integration Application Selection without cardholder assistance Reference Documentation Test To ensure the terminal always selects the highest priority application without cardholder assistance. As per below sub-cases [PPReq2011]: Section Application Selection, page 4-9 The transaction amount must be below the Contactless Transaction Limit. 1: The card exposes a PPSE returning the following 2 applications in this specific order: Maestro with priority 03 (tag '87' with value '03') Master with priority 02 (tag '87' with value '02') 2: The card exposes a PPSE returning the following 2 applications in this specific order: Master with priority 15 (tag '87' with value '0F') Maestro with priority 06 (tag '87' with value '06') Case 1: The terminal supports Master and the cardholder uses card 1. Case 2: The terminal supports Maestro and the cardholder uses card 2. Case 3: The terminal supports Master only and the cardholder uses card 2. Case 4: The terminal supports Maestro only and the cardholder uses card 1. In all cases below the terminal must automatically select the application mentioned and successfully complete the transaction. Case 1: The terminal selects the Master application. Case 2: The terminal selects the Maestro application. Case 3: The terminal selects the Master application. Case 4: The terminal selects the Maestro application. 32 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases 3.3 Master PayPass M/Chip Test Cases The test cases described in this section apply to terminals that accept Master PayPass. TC201 - Regression SDA Reference Documentation Test To ensure that the PayPass terminal performs SDA correctly. Terminal supports SDA and supports Master Regression test no specific reference The transaction amount must be below the Floor Limit. The AIP byte 1 bit 7 indicates that SDA is supported. Data returned by card is such as the transaction is approved offline*. TVR byte 1 bit 8 is not set (offline data authentication was performed). The terminal shall send request a TC without CDA ( 40 ) in the Generate AC. Transaction shall be approved offline. *: most of the PayPass terminals will bypass the SDA if the transaction is declined or sent online, see transaction flow in technical specifications. PayPass M-TIP Test Case User Guide 09 April 2013 33

Test Cases TC221 - Integration/CVM attended terminal Reference Documentation Test To ensure the attended PayPass terminal correctly manages the cardholder verification above the CVM Required Limit. Terminal is attended and supports Master [PPReq2011]: Section holder Verification p 4-11 The transaction amount must be below the Contactless Transaction Limit. The network simulator validates the authorization message and returns 00 (successful). Several tests are run, when applicable: Case 1: the card supports offlinepin then Signature ( 5E 03 ) then nocvm. The transaction amount must be the lowest value above the CVM Required Limit (e.g.: 25.01 ). Case 2: Terminal supports gratuity. The card supports offlinepin then Signature ( 5E 03 ) then nocvm. The sum of transaction and gratuity amounts must be the lowest value above the CVM Required Limit (e.g.: 25.01 ). Case 3: card supports Online PIN ( 02 03 ) then nocvm. Terminal supports Online PIN. The transaction amount must be the lowest value above the CVM Required Limit (e.g.: 25.01 ). Case 4: card supports nocvm only ( 1F 03 ). The terminal supports nocvm above the CVM Required Limit. The amount is above the CVM Required Limit. Case 5: card supports nocvm only ( 1F 03 ). The terminal does not support nocvm above the CVM Required Limit. The amount is above the CVM Required Limit. The terminal shall approve the transaction. The cardholder verification shall be successful (except case 5): TVR byte 3 bit 8 = 0 Case 1 & 2: The terminal shall request print a signature for cardholder verificationreceipt. - CVM result shall be 5E 03 00 Case 3: The terminal shall request an ARQC. The terminal shall prompt for PIN. - TVR byte 3 bit 3 = 1 (Online PIN entered) - CVM result shall be 02 03 00 Case 4: The terminal shall neitherot prompt for PIN nor request a print a signature receipt. - CVM result shall be 1F 03 00 or '1F 03 02' Case 5: The cardholder verification shall fail: - TVR byte 3 bit 8 = 1 - CVM result shall be 3F 00 01 - The terminal shall neitherot prompt for PIN nor request print a signature receipt. 34 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC222 - Integration/CVM CAT1 Reference Documentation Test To ensure the CAT1 PayPass terminal correctly manages the cardholder verification above the CVM Required Limit. Terminal supports Master and is a CAT1 or a CAT1/2 [PPReq2011]: Section holder Verification page 4-13 The transaction amount must be above the CVM Required Limit and below the Contactless Transaction Limit. The network simulator validates the authorization message and returns the responses 00 (successful). Several tests are run, when applicable: Case 1: the card supports offlinepin then Signature then nocvm. Case 2: the card supports Online PIN then nocvm. Case 3: the card supports nocvm only. The terminal shall approve the transaction. Case 1: the cardholder verification shall fail: - TVR byte 3 bit 8 = 1 - CVM result shall be 3F 00 01 The terminal shall neitherot prompt for PIN nor request print a signature receipt. Case 2: the cardholder verification shall be successful: - TVR byte 3 bit 8 = 0 - TVR byte 3 bit 3 = 1 (Online PIN entered) - CVM result shall be 02 03 00 The terminal shall request an ARQC. The terminal shall prompt for PIN. Case 3: the cardholder verification shall fail: - TVR byte 3 bit 8 = 1 - CVM result shall be 3F 00 01 The terminal shall neitherot prompt for PIN nor request print a signature receipt. PayPass M-TIP Test Case User Guide 09 April 2013 35

Test Cases TC223 - Integration/CVM CAT2 and CAT3 Reference Documentation Test To ensure the CAT2 and CAT3 PayPass terminals correctly manage the cardholder verification above the CVM Required Limit. Terminal supports Master and is a CAT2 or a CAT3 and has a CVM Required Limit lower than the Contactless Transaction Limit. [PPReq2011]: Section holder Verification page 4-13 The transaction amount must be above the CVM Required Limit and below the Contactless Transaction Limit. The network simulator validates the authorization message and returns the responses 00 (successful). Several tests are run, when applicable: Case 1: the card supports offlinepin then Signature then nocvm Case 2: the card supports Online PIN then nocvm Case 3: the card supports nocvm only The terminal shall approve the transaction. Case 1: the cardholder verification shall be successful: - TVR byte 3 bit 8 = 0 - CVM result shall be 1F 03 00 or '1F 03 02' The terminal shall neitherot prompt for PIN nor print request a signature receipt. Case 2: the cardholder verification shall be successful: - TVR byte 3 bit 8 = 0 - CVM result shall be 1F 03 00 or '1F 03 02' The terminal shall neitherot prompt for PIN nor requestprint a signature receipt. Case 3: the cardholder verification shall be successful: - TVR byte 3 bit 8 = 0 - CVM result shall be 1F 03 00 or '1F 03 02' The terminal shall neitherot prompt for PIN nor print request a signature receipt. 36 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC260 Integration/ Purchase with Cash Back Reference Documentation Test To ensure the terminal always performs cardholder verification and online authorization in case of Purchase with Cash Back. Terminal supports Cash Back [PPReq2011]: Section Purchase with Cash Back, page 4-4 The total transaction amount (including Cash Back) must be the smallest possible amount. The card supports Online PIN, Signature and No CVM. The network simulator returns the responses 00 (successful). The terminal must request an ARQC. - The TVR shall indicate that the CVM was successful: TVR byte 3 bit 8 =0. - The CVM result shall be either 42 03 xx or 1E 03 xx. The network simulator shall receive a 0100 (or 0200) message. - DE 03 (Processing code) - subfield 1 = '09' - OK/NOK - DE 54 (Additional Amount) contains the cash back amount - OK/NOK - DE 55 - PDSSE 9C (Transaction type) = '09' - OK/NOK - DE 55 SE- PDS 9F02 (Amount, Authorized) contains the same amount as the DE 04 which shall be the total transaction amount - OK/NOK - DE 55 SE- PDS 9F03 (Amount, Other) contains the Cash Back amount - OK/NOK The terminal shall approve the transaction. PayPass M-TIP Test Case User Guide 09 April 2013 37

Test Cases 3.4 Maestro PayPass M/Chip Test Cases The test cases described in this section apply to terminals that accept Maestro PayPass. TC401 - Integration/capabilities No PayPass Mag Stripe Reference Documentation Test To ensure that the terminal terminates the transaction if the PayPass Maestro card indicates that it does not support PayPass M/Chip. Terminal supports Maestro PayPass [PPReq2011]: Section PayPass Acceptance page 4-1 Transaction amount is below the Contactless Transaction Limit. The card indicates in the AIP that it does not support PayPass M/Chip. The terminal shall terminate the transaction. The terminal should prompt for a contact or swipe transaction ([PPReq2011] section Subsequent Contact Transactions page 4-15). TC410 - Integration/CVM Online PIN above the CVM Required Limit (Maestro PayPass in soft limit markets) Reference Documentation Test To ensure the terminal correctly performs Online PIN above the CVM Required Limit. Terminal supports Maestro in a Maestro PayPass soft limit market. [PPReq2011]: Section holder Verification p 4-12 Transaction amount is above the CVM Required Limit and below the Contactless Transaction Limit. The network simulator validates the authorization message and returns 00 (successful). The card CVM list indicates Online PIN. The cardholder verification shall be successful: - TVR byte 3 bit 8 = 0 (holder verification was successful) - TVR byte 3 bit 3 = 1 (Online PIN entered) - CVM result shall be 42 03 00 The terminal shall request an ARQC. The terminal shall prompt for PIN. The terminal shall approve the transaction. 38 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC411 - Integration/CVM nocvm above the CVM Required Limit (soft limit market) Reference Documentation Test To ensure that transactions attempted above the CVM Required Limit with cards issued outside a Maestro PayPass soft limit market (i.e.: not supporting Online PIN in the CVM list) are declined by the terminal. Terminal supports Maestro and the CVM Required Limit is lower than the Contactless Transaction Limit. [PPReq2011]: Section holder Verification page 4-12 Transaction amount is above the CVM Required Limit and below the Contactless Transaction Limit. The network simulator validates the authorization message and returns the responses 00 (successful). The card CVM list indicates nocvm. The cardholder verification shall fail: - TVR byte 3 bit 3 = 0 (Online PIN NOT entered) - TVR byte 3 bit 8 = 1 (holder verification failed) - CVM result shall be 3F 00 01 The terminal does not ask to enter PIN. The terminal requests an AAC as per the TACs defined in [PPReq2011]. TC412 - Integration/CVM No CVM below the CVM Required Limit Reference Documentation Test To ensure that Maestro PayPass terminals support No CVM for transactions less than or equal to the CVM Required Limit. Terminal supports Maestro [PPReq2011]: Section holder Verification page 4-12 Transaction amount is equal to the Maestro CVM Required Limit. The card CVM list only includes the nocvm method. The terminal shall approve the transaction. The cardholder verification shall be successful: - TVR byte 3 bit 8 = 0 - CVM result shall be 1F 03 00 or '1F 03 02' PayPass M-TIP Test Case User Guide 09 April 2013 39

Test Cases 3.5 PayPass Mag Stripe Test Cases The test cases described in this section apply to terminals that accept Master PayPass Mag Stripe. TC601 - Interoperability various uncommon data/length Reference Documentation Test To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Terminal supports Master PayPass Interoperability test no specific reference The transaction amount must be below the Contactless Transaction Limit. The network simulator returns the responses 00 (successful). The card returns the data defined below. Case 1: Track1 (tag 56 ) with maximum length (48 bytes) Case 2: Track2 ( 9F6B ) with maximum length (37 digits) Case 3: Track1 discretionary data (tag 56 ) with minimum length (3 bytes) Case 4: Track2 discretionary data (tag 9F6B ) with minimum length (3 digits) In all cases the terminal shall approve the transaction. TC611 - Integration Service Code checking Reference Documentation Test To ensure that the terminal correctly completes the PayPass Mag Stripe transaction whatever the Service Code value encoded in the card. Terminal supports Master PayPass [PPReq2011]: Section Service Codes page 4-9 The transaction amount is below the Contactless Transaction Limit. The card indicates in the AIP that it does not support PayPass M/Chip. The network simulator returns the responses 00 (successful). Case 1: card returns a service code 101 Case 2: card returns a service code 205 Case 3: card returns a service code 502 Case 4: card returns a service code 817 The terminal shall approve the transaction. 40 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC612 - Integration ATC in discretionary data Reference Documentation Test To ensure that the terminal correctly copies the ATC in the PayPass Track 1 and/or Track 2 and pass the values to the network. Terminal supports Master PayPass Integration/regression test no specific reference The transaction amount is below the Contactless Transaction Limit. The card indicates in the AIP that it does not support PayPass M/Chip. The card is tapped several times on the reader so several ATC values are tested. The network simulator returns the responses 00 (successful). The terminal shall approve all transactions and pass the correct PayPass Track 1 and/or Track 2 values to the network correctly. TC613 - Integration Issuer response: unsuccessful Reference Documentation Test To ensure the PayPass terminal correctly manages the Issuer response 51 (Insufficient funds/over credit limit). Terminal supports Master PayPass [CustomerIntfce] Section DE 39 - Response Code The transaction amount must be below the Contactless Transaction Limit. The network simulator returns 51 (Insufficient funds/over credit limit). The terminal shall decline the transaction upon reception of the network response. PayPass terminals should prompt for a contact transaction when a PayPass transaction is declined by the card, terminal, or issuer, or if it fails to complete for any other reason other than a communication error. ([PPReq2011] section Subsequent Contact Transactions ) page 4-15. PayPass M-TIP Test Case User Guide 09 April 2013 41

Test Cases TC614 - Integration Traditional Mag Stripe Reference Documentation Test To ensure the terminal still performs correctly a traditional Mag Stripe transaction when it contains or is connected to a PayPass reader. Terminal supports Master PayPass Integration test no specific reference The transaction amount must be below the Contactless Transaction Limit. The card is swiped in the terminal The network simulator returns the responses 00 (successful). The network simulator shall receive the following: DE 22 SE subfield 1 = 90 (POS entry mode: traditional Mag stripe) DE 61 subfield SE 11 = 2 or 3 or 5 or 7 or 8 (card data terminal input capability: traditional Mag stripe) The terminal shall approve the transaction. TC615 Integration Track 1 and Track 2 data are processed independently Reference Documentation Test To ensure that a terminal processes Track 1 Data as Track 1 and Track 2 Data as Track 2 during PayPass - Mag Stripe transactions. Terminal is online capable [PPReq2011]: Section Track Data Consistency, page 4-9 The transaction amount is below the Contactless Transaction Limit. The card indicates in the AIP that it does not support PayPass M/Chip. The card data is such that the Track1 discretionary data and the Track2 discretionary data generated by the terminal are different. The terminal shall approve the transaction and pass the correct PayPass Track 1 and/or Track 2 values to the network correctly. 42 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC616 - Integration Track1 data not fully populated Reference Documentation Test To ensure the PayPass terminal correctly behaves when the cardholder name is not fully populated in the Track 1. Terminal supports Master PayPass [PPReq2011]: Section holder Name, page 4-9 The transaction amount must be below the Contactless Transaction Limit. The holder Name value returned in the Track1 data object is " /". The Terminal shall approve the transaction. TC681 Integration/Mobile Non-[PayPass3.0] terminal vs Mobile device (Mag-Stripe) Reference Documentation Test To ensure the terminal not supporting [PayPass3.0] correctly completes the Mag-Stripe transaction with a Mobile. Terminal supports Master PayPass and does not support [PayPass3.0] Integration test no specific reference The transaction amount must be below the Contactless Transaction Limit. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). The device returns the UDOL requesting the MSI tag in addition of the Unpredictable Number. The network simulator returns the response 00 (successful). The terminal shall approve the transaction. PayPass M-TIP Test Case User Guide 09 April 2013 43

Test Cases TC682 Integration/Mobile On-Device cardholder verification not requested Reference Documentation To ensure the [PayPass3.0] terminal correctly completes the Mag-Stripe transaction with a Mobile not requesting On-Device cardholder verification. Terminal supports Master PayPass and [PayPass3.0]. Integration test no specific reference AIP byte 2 bit 8 is not set ("EMV NOT supported"). The device does not request On-Device cardholder verification. The network simulator returns the response 00 (successful). Case 1: AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). The terminal is such that the CVM Required Limit is greater than zero. The transaction amount must be below the CVM Required Limit. Test Case 2: AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). The terminal is such that the CVM Required Limit is lower than the Contactless Transaction Limit (On-device CVM). The terminal is such that Kernel indicates 'On-Device holder Verification not supported'. The transaction amount must be above the CVM Required Limit and below the Contactless Transaction Limit (On-device CVM). Case 3: AIP byte 1 bit 2 is not set ("On-device cardholder verification NOT supported"). The transaction amount must be below the Contactless Transaction Limit (On-device CVM). The terminal shall approve the transaction. 44 PayPass M-TIP Test Case User Guide 09 April 2013

Test Cases TC683 - Integration/Mobile On-Device cardholder verification requested Reference Documentation Test To ensure the terminal correctly completes the Mag-Stripe transaction with a Mobile requesting On-Device cardholder verification. Terminal supports Master PayPass and [PayPass3.0]. Integration test no specific reference AIP byte 2 bit 8 is not set ("EMV NOT supported"). The device requests On-Device cardholder verification. The network simulator returns the response 00 (successful). Case 1: AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). The terminal is such that the CVM Required Limit is lower than the Contactless Transaction Limit (On-device CVM). The terminal is such that the Kernel indicates 'On-Device holder Verification supported'. The transaction amount must be above the CVM Required Limit and below the Contactless Transaction Limit (On-device CVM). Case 2: AIP byte 1 bit 2 is not set ("On-device cardholder verification NOT supported"). The terminal is such that the CVM Required Limit is greater than zero. The transaction amount must be below the CVM Required Limit. Case 3: AIP byte 1 bit 2 is not set ("On-device cardholder verification NOT supported"). The terminal is such that the CVM Required Limit is zero. The terminal shall display "Please see phone" (or equivalent). PayPass M-TIP Test Case User Guide 09 April 2013 45

Test Cases TC684 - Integration/Mobile PIN verification successful Reference Documentation Test To ensure the terminal correctly completes the Mag-Stripe transaction with a Mobile indicating 'PIN verification successful'. Terminal supports Master PayPass and [PayPass3.0]. Integration test no specific reference AIP byte 2 bit 8 is not set ("EMV NOT supported"). The device must indicate a successful PIN verification. The network simulator returns the response 00 (successful). Case 1: AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). The terminal is such that the CVM Required Limit is lower than the Contactless Transaction Limit (On-device CVM). The transaction amount must be above the CVM Required Limit and below the Contactless Transaction Limit (On-device CVM). Case 2: AIP byte 1 bit 2 is not set ("On-device cardholder verification NOT supported"). The terminal is such that the CVM Required Limit is greater than zero. The transaction amount must be below the CVM Required Limit. Case 3: AIP byte 1 bit 2 is not set ("On-device cardholder verification NOT supported"). The terminal is such that the CVM Required Limit is zero. The terminal shall approve the transaction. 46 PayPass M-TIP Test Case User Guide 09 April 2013

4 Test Scenarios for M-TIP Subset 8 This chapter lists the PayPass M/Chip M-TIP Test Scenarios. 4.1 M-TIP Subset 8 card details PINs Below are the M-TIP Subset 8 Master card details: Name version PIN PPC MCD 01 v2.0 or v2.1 4315 PPC MCD 02 v2.0 or v2.1 4315 PPC MCD 03 v2.0 or v2.1 4315 PPC MCD 04 v2.0 or v2.12 4315 PPC MCD 06 v2.0 or v2.1 4315 PPC MCD 07 v2.0 or v2.1 4315 PPC MCD 09 v2.0 or v2.1 4315 PPC MCD 10 v2.0 or v2.1 4315 PPC MCD 11 v2.2 4315 PPC MCD 12 v2.0 or v2.1 4315 PPC MCD 4A v1.0 4315 PPC MCD 4B v1.0 4315 PPC MCD 50 v1.0 4315 PPC MAP 01 v2.0 or v2.1 4315 PPC MAP 03 v2.0 or v2.1 4315 PPC MAP 04 v2.0 or v2.1 4315 PPC MAP 06 v2.0 or v2.1 431555 PPC MAP 07 v2.0 or v2.1 43155 PPC MAP 08 v2.0 or v2.1 4315 PPC MAP 10 v2.0 or v2.1 4315 PayPass M-TIP Test Case User Guide 09 April 2013 47

Below are the M-TIP Subset 8 Maestro card details: Name version PIN MP01 v2.0 or v2.1 4315 MP11 v2.0 or v2.1 4315 MP12 v2.0 or v2.1 4315 MP13 v2.0 or v2.1 4315 MP14 v2.0 or v2.1 4315 MP15 v2.0 or v2.1 4315 MP16 v2.0 or v2.1 4315 MP17 v2.0 or v2.1 4315 MP18 v2.0 or v2.12 4315 MP19 v2.0 or v2.1 4315 MP20 v2.0 or v2.1 4315 MP4A v1.0 4315 MP4B v1.0 4315 MP50 v1.0 4315 MP71 v2.0 or v2.1 4315 MP72 v2.0 or v2.1 4315 MP91 v2.2 4315 MP92 v2.0 or v2.1 4315 MP93 v2.0 or v2.1 4315 MP94 v2.0 or v2.1 4315 Below are the M-TIP Subset 8 combo card details: Name version PIN Combo01 v1.0 4315 Combo11 v1.0 4315 Keys The RSA and DES keys generated for these test cards are Master test keys. There are three lengths and one exponent value for RSA keys in this set, in accordance with Master policy for debit/credit products. 48 PayPass M-TIP Test Case User Guide 09 April 2013

4.2 Using the Test s log feature All M-TIP Subset 8 cards have the ability to store the command and response exchanges between the terminal and the card. The stored exchanges can then be extracted from the card with the appropriate software. version The card version is returned in Select response as the value of Application Label tag: Application Label... (50 09) [MP01 v2 1] 4.3 Test Scenario Template Description Overview Below is an example of Test Scenario. This template is described here after. PPC MCD 02 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Cases of Discretionary Data inconsistency and IAD ( 9F10 ) with maximum length. [TC011-3 and 7] Terminal supports Master The Discretionary Data value in the track2 ( 57 ) is different from the value returned in the specific tag ( 9F20 ). The IAD ( 9F10 ) returned by the card has the maximum length. Please use the following test card: M-TIP Subset 8 PPC MCD 02 v2.0 or v2.1. Amount must be equal to the Contactless Transaction Limit*. If needed select the Master PayPass product. If needed, PIN value is 4315. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - Application Label indicates PPC MCD 02 v20" - OK/NOK - Amount is equal to the Master Contactless Transaction Limit - OK/NOK - The terminal approves the transaction - OK/NOK *: if the terminal supports [PayPass2.x] you must consider the limit mentioned in the M- TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. PayPass M-TIP Test Case User Guide 09 April 2013 49

Test Scenario Identification PPC MCD 02 Test 02 Scenario 01 "PPC MCD xx" identifies the card to be used. "Test yy" and "Scenario zz" identify the Test Scenario number. To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Cases of Discretionary Data inconsistency and IAD ( 9F10 ) with maximum length. [TC011-3 and 7] To ensure that the PayPass terminal correctly implements the Contactless Transaction Limit. Case of amount equal to the limit. [TC061-2] This cell lists all the Test Cases objectives tested in the current Test Scenario. The Test Case reference is given "[TC061-2]". Terminal supports Master This gives the conditions for the Test Scenario to be applicable. The Discretionary Data value in the track2 ( 57 ) is different from the value returned in the specific tag ( 9F20 ). The IAD ( 9F10 ) returned by the card has the maximum length. This lists the M-TIP card, if any, used in the test. Please use the following test card: M-TIP Subset 8 PPC MCD 02 v2.0 or v2.1. Amount must be equal to the Contactless Transaction Limit*. If needed select the Master PayPass product. If needed, PIN value is 4315. This lists the actions to be done by the user in order to perform the test. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). This gives the network simulator required for the test. 50 PayPass M-TIP Test Case User Guide 09 April 2013

- Application Label indicates PPC MCD 02 v20" - OK/NOK - Amount is equal to the Master Contactless Transaction Limit - OK/NOK - The terminal approves the transaction - OK/NOK This lists the conditions required in order to pass the test. During a M-TIP session, the user shall select "OK" or "NOK" in the test report before returning it to the service provider. *: if the terminal supports [PayPass2.x] you must consider the limit mentioned in the M- TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. Some Test Scenarios include a note in order to clarify some test details. PayPass M-TIP Test Case User Guide 09 April 2013 51

4.4 Test Scenarios for Master PayPass M/Chip PPC MCD 01 Test 01 Scenario 01 To ensure that the PayPass terminal supports the Full Grade network messages. [TC049-1] To ensure the PayPass terminal correctly manages the PayPass values in the authorization fields. Case of M/Chip transaction. [TC050-2] To ensure that a terminal transmits the Track2 Equivalent Data for a PayPass M/Chip transaction. Purchase with a card. [TC053-1] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55. [TC054-1] Terminal supports Master and is online capable and is not an ATM. This card has no specific feature. Please use the following test card: M-TIP Subset 8 PPC MCD 01 v2.0 or v2.1. Enter amount below the Contactless Transaction Limit. Possible amount values are: - 5.00 or 5 000 000-10.00 or 10 000 000-40.00 or 40 000 000-100.00 or 100 000 000 - or any other rounded value. If needed select the Master PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). 52 PayPass M-TIP Test Case User Guide 09 April 2013

- The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 01 v2 1" (or v2 0) - OK/NOK - Amount is below (and not equal to) the Contactless Transaction Limit - OK/NOK Network simulator checks: - DE 3 subfield 1 (transaction type code) = '00' (purchase) - OK/NOK - DE 22 subfield SE 1 = 07 (POS entry mode: contactless M/Chip) - OK/NOK - DE 23 = 001 (card sequence number) - OK/NOK - DE 35 contains 5413330089600010D14122010123409172 (both D and = are acceptable separators) OK/NOK - The terminal sends a DE 55 message to the network - OK/NOK - DE 55 - PDSE 9F03 ('amount other') either contains '000000000000' or is not present - OK/NOK - DE 55 - PDSE 9F34 (CVM Result) is present (effective 1 April 2017)* - Present/Not present/not required - DE 61 subfield SE 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK - Issuer simulator ARC = 00 (accepted) - OK/NOK *: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017. PayPass M-TIP Test Case User Guide 09 April 2013 53

PPC MCD 01 Test 01b Scenario 01 To ensure that the PayPass terminal supports the Full Grade network messages. [TC049-2] To ensure the PayPass terminal correctly manages the PayPass values in the authorization fields. Case of M/Chip transaction. [TC050-2] To ensure that a terminal transmits the Track2 Equivalent Data for a PayPass M/Chip transaction. Purchase with a card. [TC053-1] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55. [TC054-1] Terminal supports Master and is an ATM This card has no specific feature. Please use the following test card: M-TIP Subset 8 PPC MCD 01 v2.0 or v2.1. Enter amount below the Contactless Transaction Limit. Possible amount values are: - 5.00 or 5 000 000-10.00 or 10 000 000-40.00 or 40 000 000-100.00 or 100 000 000 - or any other rounded value. If needed select the Master PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 01 v2 1" (or v2 0) - OK/NOK - Amount is below (and not equal to) the Contactless Transaction Limit - OK/NOK Network simulator checks: - DE 3 subfield 1 (transaction type code) = '01' (withdrawal) - OK/NOK - DE 22 subfield 1 = 07 (POS entry mode: contactless M/Chip) - OK/NOK - DE 23 = 001 (card sequence number) - OK/NOK - DE 35 contains 5413330089600010D14122010123409172 (both D and = are acceptable separators) OK/NOK - DE 48 byte 1 (TCC) = 'Z' ('ATM Cash Disbursement') - OK/NOK - DE 55 SE 9F34 (CVM Result) is present (effective 1 April 2017)* - Present/Not present/not required - DE 61 subfield 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK - Issuer simulator ARC = 00 (accepted) - OK/NOK 54 PayPass M-TIP Test Case User Guide 09 April 2013

*: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017. PPC MCD 01 Test 02 Scenario 01 To ensure the PayPass terminal correctly manages the Issuer response 51 (insufficient funds). [TC043-1] Terminal supports Master and is online capable. This card has no specific feature. Please use the following test card: M-TIP Subset 8 PPC MCD 01 v2.0 or v2.1. Enter amount below the Contactless Transaction Limit. Possible amount values are: - 4.51 or 4 510 000-10.51 or 10 510 000-40.51 or 40 510 000-100.51 or 100 510 000 - or any value like *51* If needed select the Master PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message and returns the response 51 (insufficient funds). - The terminal declines the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 01 v2 1" (or v2 0) - OK/NOK Network simulator checks: - response is 51 (insufficient funds) - OK/NOK If a PayPass transaction fails, then a new transaction may be attempted using a different card read method supported by both the card and the terminal in the order of preference of: Contact EMV, Magnetic stripe (swipe) [PPReq2011] page 4-15. PayPass M-TIP Test Case User Guide 09 April 2013 55

PPC MCD 01 Test 03 Scenario 01 To ensure the PayPass terminal correctly manages the Issuer response 57 (Transaction not permitted). [TC043-2] Terminal supports Master and is online capable. This card has no specific feature. Please use the following test card: M-TIP Subset 8 PPC MCD 01 v2.0 or v2.1. Enter amount below the Contactless Transaction Limit. Possible amount values are: - 4.57 or 4 570 000-10.57 or 10 570 000-40.57 or 40 570 000-100.57 or 100 570 000 - or any value like *57* If needed select the Master PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message and returns the response 57 (Transaction not permitted). - The terminal declines the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 01 v2 1" (or v2 0) - OK/NOK Network simulator checks: - response is 57 (Transaction not permitted) - OK/NOK If a PayPass transaction fails, then a new transaction may be attempted using a different card read method supported by both the card and the terminal in the order of preference of: Contact EMV, Magnetic stripe (swipe) [PPReq2011] page 4-15. 56 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 01 Test 04 Scenario 01 To ensure the PayPass terminal correctly manages the Issuer responses 55 (wrong PIN). [TC052-1] Terminal supports Master and Online PIN and has a CVM Required Limit lower than the Contactless Transaction Limit. This card has no specific feature. Please use the following test card: M-TIP Subset 8 PPC MCD 01 v2.0 or v2.1. Enter amount above the CVM Required Limit and below the Contactless Transaction Limit. Possible amount values are: - 5.55 or 5 550 000-10.55 or 10 550 000-40.55 or 40 550 000-100.55 or 100 550 000 - or any value like *55* If needed select the Master PayPass product. The correct PIN value is 4315. (You do not need to enter an incorrect PIN to trigger the simulator response 55 (wrong PIN)). The network simulator validates the authorization message and returns the response 55 (wrong PIN). - The terminal declines the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 01 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) - OK/NOK Network simulator checks: - response is 55 (wrong PIN) - OK/NOK If a PayPass transaction fails, then a new transaction may be attempted using a different card read method supported by both the card and the terminal in the order of preference of: Contact EMV, Magnetic stripe (swipe) [PPReq2011] page 4-15. PayPass M-TIP Test Case User Guide 09 April 2013 57

PPC MCD 01 Test 05 Scenario 01 To ensure the PayPass terminal correctly manages the Issuer responses 75 (Allowable number of PIN tries exceeded). [TC052-2] Terminal supports Master and Online PIN and has a CVM Required Limit lower than the Contactless Transaction Limit. This card has no specific feature. Please use the following test card: M-TIP Subset 8 PPC MCD 01 v2.0 or v2.1. Enter amount above the CVM Required Limit and below the Contactless Transaction Limit. Possible amount values are: - 4.75 or 4 750 000-10.75 or 10 750 000-40.75 or 40 750 000-100.75 or 100 750 000 - or any value like *75* If needed select the Master PayPass product. The correct PIN value is 4315. (You do not need to enter an incorrect PIN to trigger the simulator response 75 (Allowable number of PIN tries exceeded)). The network simulator validates the authorization message and returns the response 75 (Allowable number of PIN tries exceeded). - The terminal declines the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 01 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) - OK/NOK Network simulator checks: - response is 75 (Allowable number of PIN tries exceeded) - OK/NOK If a PayPass transaction fails, then a new transaction may be attempted using a different card read method supported by both the card and the terminal in the order of preference of: Contact EMV, Magnetic stripe (swipe) [PPReq2011] page 4-15. 58 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 01 Test 06 Scenario 01 To ensure the PayPass terminal does not process the ICC response data erroneously returned by the issuer. [TC045] Terminal supports Master and is online capable. This card has no specific feature. Please use the following test card: M-TIP Subset 8 PPC MCD 01 v2.0 or v2.1. Enter amount below the Contactless Transaction Limit. Possible amount values are: - 5.99 or 5 990 000-10.99 or 10 990 000-40.99 or 40 990 000-100.99 or 100 990 000 - or any value like *99* If needed select the Master PayPass product. is let on the terminal until the transaction is completed or the ticket is printed. If needed, PIN value is 4315. The network simulator validates the authorization message and returns the following response: - DE 39 (Response code) = '00' (Approved) - DE 55 - PDSE 91 (Issuer Authentication Data) is present - DE 55 - PDSE 72 (Issuer Script Template 2) with one script identifier and 6 PIN Unblock commands followed by a PIN Change Unblock. - The transaction must successfully complete OK/NOK log checks: - Application Label indicates "PPC MCD 01 v2 1" (or v2 0) - OK/NOK - The terminal must not send any command to the card beyond the 1st Generate AC OK/NOK Network simulator checks: - response contains DE 55 - PDSE 91 and PDSE 72 - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 59

PPC MCD 01 Test 07 Scenario 01 To ensure that the PayPass terminal correctly implements the Contactless Transaction Limit. Case of amount just above the limit. Terminal supports [PayPass2.x]. [TC061-2] Terminal supports Master and [PayPass2.x]. Terminal allows the user to enter amounts greater than the Contactless Transaction Limit. This card has no specific feature. Please use the following test card: M-TIP Subset 8 PPC MCD 01 v2.0 or v2.1. - First step is to initialize the card log: Please run a successful transaction with any amount below the Contactless Transaction Limit and then ensure the transaction was correctly stored in the card log. - Second step is the test itself: Amount must be one minor unit above the Master Contactless Transaction Limit* (e.g.: 25.01 ) If needed select the Master PayPass product. Tap card on the PayPass reader even if it looks deactivated. - What amount did you enter in the first step transaction? - What amount did you enter in the second step transaction? log checks: - The card log for the second transaction is either empty or contains the log of the transaction performed at the first step (that is, the amount in the GenerateAC command is the amount used at the first step)** - OK/NOK *: You must consider the limit mentioned in the M-TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. **: When the test tool stores a new log for each single transaction, the log will be empty since the terminal must either not activate the PayPass reader or abort after the PPSE response (and the PPSE is not stored in the log). When the test tool manages a unique log file, the log will be the one from the previous transaction since a log is not created until the SelectADF is sent, which is never the case here. 60 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 01 Test 08 Scenario 01 To ensure that the PayPass terminal correctly implements the Contactless Transaction Limit. Case of amount above the limit. Terminal supports [PayPass3.0]. [TC061-3a] Terminal supports Master and [PayPass3.0] and allows to enter amounts greater than the Contactless Transaction Limit. This card has no specific feature. Please use the following test card: M-TIP Subset 8 PPC MCD 01 v2.0 or v2.1. - First step is to initialize the card log: Please run a successful transaction with any amount below the Contactless Transaction Limit and then ensure the transaction was correctly stored in the card log. - Second step is the test itself: Amount must be one minor unit above the Master Contactless Transaction Limit (e.g.: 25.01 ). If needed select the Master PayPass product. Tap card on the PayPass reader even if it looks deactivatedand follow the instructions. - What amount did you enter in the first step transaction? - What amount did you enter in the second step transaction? log checks: - The card log for the second transaction is either empty or contains the log of the transaction performed at the first step (that is, the amount in the GenerateAC command is the amount used at the first step)* or contains a transaction that aborts after the last Read Record response - OK/NOK- Application Label indicates "PPC MCD 01 v2 1" (or v2 0) - OK/NOK - The transactions aborts after the last Read Record response - OK/NOK *: In case the terminal does not activate the PayPass reader when the entered amount is above all the application Contactless Transaction Limits, the log will be: - empty, when the test tool stores a new log for each single transaction - the one from the previous transaction, when the test tool manages a unique log file. PayPass M-TIP Test Case User Guide 09 April 2013 61

PPC MCD 01 Test 09 Scenario 01 To ensure the terminal always performs cardholder verification and online authorization in case of Purchase with Cash Back [TC260] To ensure that a terminal transmits the Track2 Equivalent Data for a PayPass M/Chip transaction. Purchase with Cash Back. [TC053-3] Terminal supports Cash Back This card has no specific feature (Domestic and International Cash Back bits not set in the AUC) Please use the following test card: M-TIP Subset 8 PPC MCD 01 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal shall approve the transaction OK/NOK log checks: - Application Label indicates "PPC MCD 01 v2 1" (or v2 0) - OK/NOK - The terminal must request an ARQC - OK/NOK - The TVR shall indicate that the CVM was successful: TVR byte 3 bit 8 = 0 - OK/NOK - The CVM result shall be either 42 03 xx or 1E 03 xx - OK/NOK Network simulator checks: The network simulator shall receive a 0100 (or 0200) message with the following: - DE 3 (Processing code) - subfield 1 (transaction type code) = '09' - OK/NOK - DE 35 contains 5413330089600010D14122010123409172 (both D and = are acceptable separators) OK/NOK - DE 54 (Additional Amount) contains the cash back amount - OK/NOK - DE 55 - PDSE 9C (Transaction type) = '09' - OK/NOK - DE 55 - PDSE 9F02 (Amount, Authorized) contains the same amount as the DE 04 which shall be the total transaction amount - OK/NOK - DE 55 - PDSE 9F03 (Amount, Other) contains the Cash Back amount - OK/NOK Since the Domestic and International Cash Back bits are not set in the AUC, the bit Requested service not allowed for card product will be set in the TVR. 62 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 02 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Cases of Discretionary Data inconsistency and IAD ( 9F10 ) with maximum length. [TC011-3 and 7] To ensure that the PayPass terminal correctly implements the Contactless Transaction Limit. Case of amount equal to the limit. [TC061-1a] Terminal supports Master The terminal allows the user to enter amounts equal to the Contactless Transaction Limit. The Discretionary Data value in the track2 ( 57 ) is different from the value returned in the specific tag ( 9F20 ). The IAD ( 9F10 ) returned by the card has the maximum length. Please use the following test card: M-TIP Subset 8 PPC MCD 02 v2.0 or v2.1. Amount must be equal to the Contactless Transaction Limit*. If needed select the Master PayPass product. If needed, PIN value is 4315. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 02 v2 1" (or v2 0) - OK/NOK - Amount is equal to the Master Contactless Transaction Limit - OK/NOK *: if the terminal supports [PayPass2.x] you must consider the limit mentioned in the M- TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. PayPass M-TIP Test Case User Guide 09 April 2013 63

PPC MCD 02 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Cases of Discretionary Data inconsistency and IAD ( 9F10 ) with maximum length. [TC011-3 and 7] Terminal supports Master The terminal does not allow the user to enter amounts equal to the Contactless Transaction Limit. The Discretionary Data value in the track2 ( 57 ) is different from the value returned in the specific tag ( 9F20 ). The IAD ( 9F10 ) returned by the card has the maximum length. Please use the following test card: M-TIP Subset 8 PPC MCD 02 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 02 v2 1" (or v2 0) - OK/NOK 64 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 03 Test 01 Scenario 01 To ensure the PayPass terminal does not support offlinepin. Case of amount below the CVM Required Limit. [TC021-1] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 206 and amount is below the limit. [TC067-1] Terminal supports Master and has a CVM Required Limit greater than zero for the Master application. Terminal does not support refund. The first CVM method in the CVM list is OfflinePIN. The CVM list does not include Online PIN and Service Code contained in Track2 is 206 (Normal Authorization, PIN if pinpad present). Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. Enter any amount below the CVM Required Limit. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK - The amount is below the CVM Required Limit - OK/NOK - The terminal does not send any VerifyPIN command - OK/NOK - The CVM results byte 1 is different from '41' - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 65

PPC MCD 03 Test 02 Scenario 01 To ensure the PayPass terminal does not support offlinepin. Case of amount below the CVM Required Limit. [TC021-1] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 206 and amount is below the limit. [TC067-1] To ensure the PayPass terminal correctly performs refund. Case of [PayPass2.0]. [TC025-1] Terminal supports Master and has a CVM Required Limit greater than zero. Terminal supports refund and [PayPass2.0]. The first CVM method in the CVM list is OfflinePIN. The CVM list does not include Online PIN and Service Code contained in Track2 is 206 (Normal Authorization, PIN if pinpad present). - First step is to perform the purchase: Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. Enter any amount below the CVM Required Limit. If needed select the Master PayPass product. Please store the card log since it will be required after the subsequent refund transaction. - Second step is to perform the refund: Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. If requested, the refund amount must be the same as the purchase amount. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). 66 PayPass M-TIP Test Case User Guide 09 April 2013

Visual checks - first step (purchase): - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal approves the transaction - OK/NOK log checks - first step (purchase): First step is the purchase: - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK - The amount is below the CVM Required Limit - OK/NOK - The terminal does not send any VerifyPIN command - OK/NOK - The CVM results byte 1 is different from '41' - OK/NOK Visual checks - second step (refund): - The end of the transaction is out of scope. - At the end of the refund process, the terminal displays a message to inform the cardholder that refund has been done successfully - OK/NOK log checks - second step (refund): Second step is the refund: - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 67

PPC MCD 03 Test 03 Scenario 01 To ensure the PayPass terminal does not support offlinepin. Case of amount below the CVM Required Limit. [TC021-1] To ensure the terminal does not use the service code to require online authorization or Online PIN. Service Code is 206 and amount is below the limit. [TC067-1] To ensure the PayPass terminal correctly performs refund. Case of [PayPass2.1] or [PayPass3.0]. [TC025-2] Terminal supports Master and refund and ([PayPass2.1] or [PayPass3.0]). The CVM Required Limit equals the Contactless Transaction Limit. The first CVM method in the CVM list is OfflinePIN. The CVM list does not include Online PIN and Service Code contained in Track2 is 206 (Normal Authorization, PIN if pinpad present). - First step is to perform the purchase: Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. Enter any amount below the CVM Required Limit. If needed select the Master PayPass product. Please store the card log since it will be required after the subsequent refund transaction. - Second step is to perform the refund: Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. If requested, the refund amount must be the same as the purchase amount. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). 68 PayPass M-TIP Test Case User Guide 09 April 2013

Visual checks - first step (purchase): - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal approves the transaction - OK/NOK log checks - first step (purchase): First step is the purchase: - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK - The amount is below the CVM Required Limit - OK/NOK - The terminal does not send any VerifyPIN command - OK/NOK - The CVM results byte 1 is different from '41' - OK/NOK Second step is the refund: Visual checks second step (refund): - At the end of the refund process, the terminal displays a message to inform the cardholder that refund has been done successfully - OK/NOK log checks second step (refund): - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK - The terminal requests an AAC - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 69

PPC MCD 03 Test 04 Scenario 01 To ensure the PayPass terminal does not support offlinepin. Case of amount above the CVM Required Limit. [TC021-2] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 206. [TC067-2] To ensure the attended PayPass terminal correctly manages the cardholder verification. Case of Signature. [TC221-1] Terminal supports Master and is attended. It does not support refund. The CVM Required Limit is lower than the Contactless Transaction Limit. The first CVM method in the CVM list is OfflinePIN. The CVM list includes Signature. The CVM list does not include Online PIN and Service Code contained in Track2 is 206 (Normal Authorization, PIN if pinpad present). Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. Amount must be the lowest value above the CVM Required Limit* (e.g.: 25.01 ). If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal prints requests a signature for cardholder verification receipt - OK/NOK - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK - Amount is the lowest value above the CVM Required Limit - OK/NOK - The terminal does not send any VerifyPIN command - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM result is 5E 03 00 - OK/NOK *: if the terminal supports [PayPass2.x] you must consider the limit mentioned in the M- TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. 70 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 03 Test 05 Scenario 01 To ensure the PayPass terminal does not support offlinepin. Case of amount above the CVM Required Limit. [TC021-2] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 206. [TC067-2] To ensure the PayPass terminal correctly performs refund. Case of [PayPass2.0]. [TC025-1] To ensure the attended PayPass terminal correctly manages the cardholder verification. Case of Signature. [TC221-1] Terminal supports Master and is attended. It supports refund and [PayPass2.0]. The CVM Required Limit is lower than the Contactless Transaction Limit The first CVM method in the CVM list is OfflinePIN. The CVM list includes Signature. The CVM list does not include Online PIN and Service Code contained in Track2 is 206 (Normal Authorization, PIN if pinpad present). - First step is to perform the purchase: Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. Amount must be the lowest value above the CVM Required Limit* (e.g.: 25.01 ). If needed select the Master PayPass product. Please store the card log since it will be required after the subsequent refund transaction. - Second step is to perform the refund: Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. If requested, the refund amount must be the same as the purchase amount. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). PayPass M-TIP Test Case User Guide 09 April 2013 71

Visual checks first step (purchase): - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal prints requests a signature for cardholder verification receipt - OK/NOK - The terminal approves the transaction - OK/NOK log checks first step (purchase): First step is the purchase: - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK - Amount is the lowest value above the CVM Required Limit - OK/NOK - The terminal does not send any VerifyPIN command - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM result is 5E 03 00 - OK/NOK Visual checks second step (refund): - The end of the transaction is out of scope. - At the end of the refund process, the terminal displays a message to inform the cardholder that refund has been done successfully - OK/NOK log checks second step (refund): Second step is the refund: - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK *: if the terminal supports [PayPass2.x] you must consider the limit mentioned in the M- TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. 72 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 03 Test 06 Scenario 01 To ensure the PayPass terminal does not support offlinepin. [TC021-2] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 206. [TC067-2] To ensure the PayPass terminal correctly performs refund. Case of [PayPass2.1] or [PayPass3.0]. [TC025-2] To ensure the attended PayPass terminal correctly manages the cardholder verification. Case of Signature. [TC221-1] Terminal supports Master and is attended. It supports refund and ([PayPass2.1] or [PayPass3.0]). The CVM Required Limit is lower than the Contactless Transaction Limit The first CVM method in the CVM list is OfflinePIN. The CVM list includes Signature. The CVM list does not include Online PIN and Service Code contained in Track2 is 206 (Normal Authorization, PIN if pinpad present). - First step is to perform the purchase: Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. Amount must be the lowest value above the CVM Required Limit* (e.g.: 25.01 ). If needed select the Master PayPass product. Please store the card log since it will be required after the subsequent refund transaction. - Second step is to perform the refund: Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. If requested, the refund amount must be the same as the purchase amount. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). PayPass M-TIP Test Case User Guide 09 April 2013 73

Visual checks first step (purchase): - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal prints requests a signature for cardholder verification receipt - OK/NOK - The terminal approves the online transaction - OK/NOK log checks first step (purchase): First step is the purchase: - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK - Amount is the lowest value above the CVM Required Limit - OK/NOK - The terminal does not send any VerifyPIN command - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM result is 5E 03 00 - OK/NOK Visual checks second step (refund): - At the end of the refund process, the terminal displays a message to inform the cardholder that refund has been done successfully - OK/NOK log checks second step (refund): - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK - The terminal requests an AAC - OK/NOK *: if the terminal supports [PayPass2.x] you must consider the limit mentioned in the M- TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. 74 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 03 Test 07 Scenario 01 To ensure the PayPass terminal does not support offlinepin. [TC021-2] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 206. [TC067-2] To ensure the CAT1 terminal correctly manages the cardholder verification. Case of card supporting Signature. [TC222-1] Terminal supports Master and is a CAT1 or a CAT1/2. The first CVM method in the CVM list is OfflinePIN. The CVM list includes Signature. The CVM list does not include Online PIN and Service Code contained in Track2 is 206 (Normal Authorization, PIN if pinpad present). Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal does not print request any signature for cardholder verification ticket - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK - The terminal does not send any VerifyPIN command - OK/NOK - TVR byte 3 bit 8 = 1 (holder verification was NOT successful) - OK/NOK - CVM result is 3F 00 01 - OK/NOK Network simulator checks: - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 75

PPC MCD 03 Test 08 Scenario 01 To ensure the PayPass terminal does not support offlinepin. [TC021-2] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 206. [TC067-2] To ensure the CAT2 and CAT3 terminals correctly manage the cardholder verification. Case of card supporting Signature. [TC223-1] Terminal supports Master and is a CAT2 or a CAT3. The CVM Required Limit is lower than the Contactless Transaction Limit. The first CVM method in the CVM list is OfflinePIN. The CVM list includes Signature. The CVM list does not include Online PIN and Service Code contained in Track2 is 206 (Normal Authorization, PIN if pinpad present). Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal does not print request any signature for cardholder verification ticket - OK/NOK - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - The terminal does not send any VerifyPIN command - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM result is 1F 03 00 or '1F 03 02' - OK/NOK 76 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 03 Test 09 Scenario 01 To ensure the attended PayPass terminal correctly manages the cardholder verification. Case of Signature with gratuity. [TC221-2] Terminal supports Master and is attended and supports gratuity. The CVM Required Limit is lower than the Contactless Transaction Limit The first CVM method in the CVM list is OfflinePIN. The CVM list includes Signature. Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. The sum of transaction and gratuity amounts must be the lowest value above the CVM Required Limit* (e.g.: 25.01 ). If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal prints requests a signature for cardholder verification receipt - OK/NOK - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK - The sum of transaction and gratuity amounts is the lowest value above the CVM Required Limit - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM result is 5E 03 00 - OK/NOK *: if the terminal supports [PayPass2.x] you must consider the limit mentioned in the M- TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. PayPass M-TIP Test Case User Guide 09 April 2013 77

PPC MCD 03 Test 10 Scenario 01 To ensure the PayPass terminal does not support offlinepin. [TC021-2] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 206. [TC067-2] Terminal supports Master and is an ATM. The first CVM method in the CVM list is OfflinePIN. The CVM list does not include Online PIN and Service Code contained in Track2 is 206 (Normal Authorization, PIN if pinpad present). Please use the following test card: M-TIP Subset 8 PPC MCD 03 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal does not print request any signature for cardholder verification ticket - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 03 v2 1" (or v2 0) - OK/NOK - The terminal does not send any VerifyPIN command - OK/NOK - TVR byte 3 bit 8 = 1 (holder verification was NOT successful) - OK/NOK - CVM result is 3F 00 01 - OK/NOK Network simulator checks: - ARQC is successfully validated by the simulator - OK/NOK 78 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 04 Test 01 Scenario 01 To ensure that the PayPass terminal performs CDA correctly. [TC002-1] To ensure the PayPass terminal correctly supports different certification authority public key lengths. CA key length is 1984/248. [TC003-3] To ensure the PayPass terminal correctly supports the exponent 2^16+1. [TC004] Terminal supports Master and is offline capable and has a CVM Required Limit greater than zero for the Master application. The returned AIP indicates that the card supports CDA. ICC public key exponent is 2^16+1. Please use the following test card: M-TIP Subset 8 PPC MCD 04 v2.0 or v2.12. Enter any amount below the Floor Limit and the CVM Required Limit. If needed select the Master PayPass product. - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 04 v2 12" (or v2 0) - OK/NOK - Amount is below the Floor Limit and the CVM Required Limit - OK/NOK - TVR byte 1 bit 8 = 0 (ODA was performed) - OK/NOK - The terminal requests a TC with CDA ( 50 ) in the Generate AC - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 79

PPC MCD 04 Test 01 Scenario 02 To ensure that the PayPass terminal performs CDA correctly. [TC002-1] To ensure the PayPass terminal correctly supports different certification authority public key lengths. CA key length is 1984/248. [TC003-3] To ensure the PayPass terminal correctly supports the exponent 2^16+1. [TC004] Terminal supports Master and is offline capable and has a CVM Required Limit equal to zero for the Master application. The returned AIP indicates that the card supports CDA. ICC public key exponent is 2^16+1. Please use the following test card: M-TIP Subset 8 PPC MCD 04 v2.0 or v2.12. Enter any amount below the Floor Limit. If needed select the Master PayPass product. - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 04 v2 12" (or v2 0) - OK/NOK - Amount is below the Floor Limit - OK/NOK - TVR byte 1 bit 8 = 0 (ODA was performed) - OK/NOK - The terminal requests a TC with CDA ( 50 ) in the Generate AC - OK/NOK 80 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 04 Test 02 Scenario 01 To ensure the PayPass terminal correctly supports different certification authority public key lengths. CA key length is 1984/248. [TC003-3] To ensure the PayPass terminal correctly supports the exponent 2^16+1. [TC004] Terminal supports Master and CDA and [PayPass3.0] and is online-only The returned AIP indicates that the card supports CDA. ICC public key exponent is 2^16+1. Please use the following test card: M-TIP Subset 8 PPC MCD 04 v2.0 or v2.12. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 04 v2 12" (or v2 0) - OK/NOK - TVR byte 1 bit 8 = 0 (ODA was performed) - OK/NOK - The terminal requests an ARQC with CDA ( 90 ) in the Generate AC - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 81

PPC MCD 06 Test 01 Scenario 01 To ensure the PayPass terminal correctly supports different certification authority public key lengths. Case of 1408/176. [TC003-2] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of SDA signed record having maximum length. [TC011-8] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 226. [TC067-4] To ensure that the PayPass terminal performs SDA correctly. [TC201] Terminal supports Master and is offline capable. Terminal supports SDA. The card returns a record with the maximum length (254 bytes). supports SDA only. The Service Code contained in Track2 is 226 (Issuer Authorization, PIN if pinpad present). CA key length is 1408/176. Please use the following test card: M-TIP Subset 8 PPC MCD 06 v2.0 or v2.1. Enter an amount below the Floor Limit. If needed select the Master PayPass product. - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 06 v2 1" (or v2 0) - OK/NOK - Amount is below the Floor Limit - OK/NOK - TVR byte 1 bit 8 = 0 (ODA was performed) - OK/NOK - TVR byte 1 bit 7 = 0 (SDA was successful) - OK/NOK - The terminal requests a TC without CDA 40 - OK/NOK 82 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 06 Test 02 Scenario 01 To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 226. [TC067-4] Terminal supports Master and is online-only or does not support SDA. The Service Code contained in Track2 is 226 (Issuer Authorization, PIN if pinpad present). Please use the following test card: M-TIP Subset 8 PPC MCD 06 v2.0 or v2.1. Enter an amount below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 06 v2 1" (or v2 0) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 83

PPC MCD 07 Test 01 Scenario 01 To ensure the PayPass terminal correctly manages the extended AIDs. Case of AID extended with D056 01. [TC065-1] Terminal supports Master. Terminal does not support receipt printing or the CVM Required Limit equals the Contactless Transaction Limit. The card has an extended AID A0 00 00 00 04 10 10 D056 01. Please, use the following test card: TIP Subset 8 PPC MCD 07 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - The terminal selects the AID A0 00 00 00 04 10 10 D056 01 - OK/NOK - Application Label indicates "PPC MCD 07 v2 1" (or v2 0) - OK/NOK 84 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 07 Test 02 Scenario 01 To ensure the PayPass terminal correctly manages the extended AIDs. Case of AID extended with D056 01. [TC065-1] To ensure that the PayPass terminal is able to print a cardholder receipt. Case above CVM required Limit [TC024-2] Terminal supports Master. Terminal supports receipt printing and the CVM Required Limit is lower than the Contactless Transaction Limit. The card has an extended AID A0 00 00 00 04 10 10 D056 01. Please, use the following test card: TIP Subset 8 PPC MCD 07 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK - The terminal prints a cardholder receipt without requesting it - OK/NOK log checks: - The terminal selects the AID A0 00 00 00 04 10 10 D056 01 - OK/NOK - Application Label indicates "PPC MCD 07 v2 1" (or v2 0) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 85

PPC MCD 09 Test 01 Scenario 01 To ensure the PayPass terminal correctly manages the extended AIDs. Case of AID extended with C123456789. [TC065-2] Terminal supports Master and is online capable. The card has an extended AID A0 00 00 00 04 10 10 C123456789. : the cards always returns an ARQC. Please use the following test card: M-TIP Subset 8 PPC MCD 09 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - The terminal selects the AID A0 00 00 00 04 10 10 C123456789 - OK/NOK - Application Label indicates "PPC MCD 09 v2 1" (or v2 0) - OK/NOK Network simulator checks: - ARQC is successfully validated by the simulator - OK/NOK 86 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 09 Test 02 Scenario 01 To ensure the offline-only PayPass terminal correctly behaves when the card erroneously sends an ARQC. [TC005] To ensure the PayPass terminal correctly manages the extended AIDs. Case of AID extended with C123456789. [TC065-2] Terminal supports Master and is offline-only. The card has an extended AID A0 00 00 00 04 10 10 C123456789. The cards always returns an ARQC. Please use the following test card: M-TIP Subset 8 PPC MCD 09 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. - The terminal terminates the transaction upon reception of the ARQC - OK/NOK log checks: - The terminal selects the AID A0 00 00 00 04 10 10 C123456789 - OK/NOK - Application Label indicates "PPC MCD 09 v2 1" (or v2 0) - OK/NOK - the card returns an ARQC - OK/NOK PayPass terminals should prompt for a contact transaction when a PayPass transaction is declined by the card, terminal, or issuer, or if it fails to complete for any other reason other than a communication error [PPReq2011] section Subsequent Contact Transactions page 4-15. PayPass M-TIP Test Case User Guide 09 April 2013 87

PPC MCD 10 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Unrecognized CVM. [TC011-6] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of tag 9F6E. [TC011-11] To ensure that a terminal has its application version number for PayPass - M/Chip set to 0002. [TC062] Terminal supports Master. The card returns an unrecognized CVM in the CVM list. The card returns the tag 9F6E in a Read Record (PayPass Third Party data). The card Application Version Number is set to 0002. Please use the following test card: M-TIP Subset 8 PPC MCD 10 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 10 v2 1" (or v2 0) - OK/NOK - TVR byte 2 bit 8 = 0 (ICC & terminal have same application versions) - OK/NOK - TVR byte 3 bit 7 = 1 (Unrecognized CVM) - OK/NOK 88 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 11 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when the card does not support any offline data authentication method. Amount below the Floor Limit and the CVM Required Limit. [TC001-1a] To ensure the PayPass terminal transmits transaction mandatory data to the network even if it is not requested by the card in the CDOL1. [TC046] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55 [TC054-3] To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-1] Terminal supports Master and is offline and online capable and has a CVM Required Limit greater than zero for the Master application. The returned AIP indicates that SDA and CDA are not supported. The card does not request Terminal Country Code (tag 9F1A ), Transaction Date (tag 9A ), Transaction Type (tag 9C ) Transaction Currency Code (tag 5F2A ) and CVM Results (tag '9F34') in the CDOL1. The card returns a Third Party Data indicating a device type 'card'. Please use the following test card: M-TIP Subset 8 PPC MCD 11 v2.2. Enter any amount below the Floor Limit and the CVM Required Limit. If needed select the Master PayPass product. The network simulator validates the authorization message (not the ARQC) and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 11 v2 2" - OK/NOK - Amount must be below the Floor Limit and the CVM Required Limit.- OK/NOK - The terminal requests an ARQC - OK/NOK - TVR byte 1 bit 8 = 1 (ODA was not performed) - OK/NOK Network simulator checks: - DE 48 SE s23 value is '00' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required - DE 55 PDSE 5F2A (Transaction Currency Code) is present and value is correct - OK/NOK - PDS 9F1A (Terminal Country Code) is present and value is correct - OK/NOK - DE 55 PDSE 9A (Transaction Date) is present and value is correct - OK/NOK - DE 55 PDSE 9C (Transaction Type) value is '00' (goods and services) - OK/NOK - DE 55 SE 9F1A (Terminal Country Code) is present and value is correct - OK/NOK - DE 55 - PDSE 9F34 (CVM Result) is present in the authorization message (effective 1 April 2017)** - Present/Not present/not required PayPass M-TIP Test Case User Guide 09 April 2013 89

*: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 SEsubelement 23), if present on the card or non-card form factor. **: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017. 90 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 11 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when the card does not support any offline data authentication method. Amount below the Floor Limit. [TC001-1b] To ensure the PayPass terminal transmits transaction mandatory data to the network even if it is not requested by the card in the CDOL1. [TC046] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55 [TC054-3] To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-1] Terminal supports Master and is offline and online capable and has a CVM Required Limit equal to zero for the Master application. The returned AIP indicates that SDA and CDA are not supported. The card does not request Terminal Country Code (tag 9F1A ), Transaction Date (tag 9A ), Transaction Type (tag 9C ), Transaction Currency Code (tag 5F2A ) and CVM Results (tag '9F34') in the CDOL1. The card returns a Third Party Data indicating a device type 'card'. Please use the following test card: M-TIP Subset 8 PPC MCD 11 v2.2. Enter any amount below the Floor Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message (not the ARQC) and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 11 v2 2" - OK/NOK - Amount must be below the Floor Limit - OK/NOK - The terminal requests an ARQC - OK/NOK - TVR byte 1 bit 8 = 1 (ODA was not performed) - OK/NOK Network simulator checks: - DE 48 SE s23 value is '00' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required - DE 55 PDSE 5F2A (Transaction Currency Code) is present and value is correct - OK/NOK - DE 55 PDSE 9A (Transaction Date) is present and value is correct - OK/NOK - DE 55 PDSE 9C (Transaction Type) value is '00' (goods and services) - OK/NOK - DE 55 PDSE 9F1A (Terminal Country Code) is present and value is correct - OK/NOK - DE 55 - PDSE 9F34 (CVM Result) is present (effective 1 April 2017)** - Present/Not present/not required *: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 SE 23), if present on the card or non-card form factor. **: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017. PayPass M-TIP Test Case User Guide 09 April 2013 91

92 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 11 Test 03 Scenario 01 To ensure the PayPass terminal correctly behaves when the card does not support any offline data authentication method. Amount above the Floor Limit. [TC001-2] To ensure the PayPass terminal transmits transaction mandatory data to the network even if it is not requested by the card in the CDOL1. [TC046] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55 [TC054-3] To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-1] Terminal supports Master and is online capable. The Floor Limit is lower than the Contactless Transaction Limit. The returned AIP indicates that SDA and CDA are not supported. The card does not request Terminal Country Code (tag 9F1A ), Transaction Date (tag 9A ), Transaction Type (tag 9C ), Transaction Currency Code (tag 5F2A ) and CVM Results (tag '9F34') in the CDOL1. The card returns a Third Party Data indicating a device type 'card'. Please use the following test card: M-TIP Subset 8 PPC MCD 11 v2.2. Enter any amount above the Floor Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message (not the ARQC) and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 11 v2 2" - OK/NOK - Amount is above the Floor Limit - OK/NOK - TVR byte 1 bit 8 = 1 (ODA was not performed) - OK/NOK Network simulator checks: - DE 48 SE s23 value is '00' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required - DE 55 PDSE 5F2A (Transaction Currency Code) is present and value is correct - OK/NOK - DE 55 PDSE 9A (Transaction Date) is present and value is correct - OK/NOK - DE 55 PDSE 9C (Transaction Type) value is '00' (goods and services) or '01' (cash ATM) or '17' (funds withdrawal) - OK/NOK - DE 55 PDSE 9F1A (Terminal Country Code) is present and value is correct - OK/NOK - DE 55 - PDSE 9F34 (CVM Result) is present in the authorization message (effective 1 April 2017)** - Present/Not present/not required *: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 subelement SE 23), if present on the card or non-card form factor. **: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017. PayPass M-TIP Test Case User Guide 09 April 2013 93

PPC MCD 11 Test 04 Scenario 01 To ensure the PayPass terminal correctly behaves when the card does not support any offline data authentication method. Case of offline-only terminal. [TC001-3] Terminal supports Master and is offline-only. The returned AIP indicates that SDA and CDA are not supported. Please use the following test card: M-TIP Subset 8 PPC MCD 11 v2.2. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. log checks: - Application Label indicates "PPC MCD 11 v2 2" - OK/NOK - TVR byte 1 bit 8 = 1 (ODA was not performed) - OK/NOK - The terminal requests an AAC - OK/NOK PayPass terminals should prompt for a contact transaction when a PayPass transaction is declined by the card, terminal, or issuer, or if it fails to complete for any other reason other than a communication error [PPReq2011] section Subsequent Contact Transactions page 4-15. 94 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 12 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Service Code discrepancy. [TC011-2] Terminal supports Master. It is attended not supporting Online PIN. The CVM Required Limit is lower than the Contactless Transaction Limit. The Service Code returned in the track2 ( 57 ) is different from the one in the specific tag ( 5F30 ). The card supports Online PIN then nocvm ( 1F 03 ). Please use the following test card: M-TIP Subset 8 PPC MCD 12 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 12 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 95

PPC MCD 12 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Service Code discrepancy. [TC011-2] To ensure the PayPass terminal correctly manages the Online PIN verification, when supported. Case of 4 digits PIN. [TC051-1] To ensure the attended PayPass terminal correctly manages the cardholder verification. Case of Online PIN supported. [TC221-3] Terminal supports Master and is attended supporting Online PIN. The CVM Required Limit is lower than the Contactless Transaction Limit. The Service Code returned in the track2 ( 57 ) is different from the one in the specific tag ( 5F30 ). The card supports Online PIN ( 42 03 ) then nocvm. Please use the following test card: M-TIP Subset 8 PPC MCD 12 v2.0 or v2.1. Amount must be the lowest value above the CVM Required Limit* (e.g.: 25.01 ). If needed select the Master PayPass product. PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal prompts for PIN - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 12 v2 1" (or v2 0) - OK/NOK - Amount is the lowest value above the CVM Required Limit - OK/NOK - The terminal requests an ARQC - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) - OK/NOK - CVM result must be 42 03 00 - OK/NOK Network simulator checks: - DE 52 is present in authorization request - OK/NOK - The network simulator displays the correct PIN value: PIN Validation, PIN = xxxx where xxxx is the PIN entered OK/NOK - ARQC is successfully validated by the simulator - OK/NOK *: if the terminal supports [PayPass2.x] you must consider the limit mentioned in the M- TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. 96 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 12 Test 03 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Service Code discrepancy. [TC011-2] To ensure the PayPass terminal correctly manages the Online PIN verification, when supported. Case of 4 digits PIN. [TC051-1] Terminal supports Master and is an ATM. The Service Code returned in the track2 ( 57 ) is different from the one in the specific tag ( 5F30 ). The card supports Online PIN ( 42 03 ) then nocvm. Please use the following test card: M-TIP Subset 8 PPC MCD 12 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal prompts for PIN - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 12 v2 1" (or v2 0) - OK/NOK - The terminal requests an ARQC - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) - OK/NOK - CVM result must be 42 03 00 - OK/NOK Network simulator checks: - DE 52 is present in authorization request - OK/NOK - The network simulator displays the correct PIN value: PIN Validation, PIN = xxxx where xxxx is the PIN entered OK/NOK - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 97

PPC MCD 12 Test 04 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Service Code discrepancy. [TC011-2] To ensure the PayPass terminal correctly manages the Online PIN verification, when supported. Case of 4 digits PIN. [TC051-1] To ensure the CAT1 PayPass terminal correctly manages the cardholder verification above the CVM Required Limit. Case of Online PIN supported. [TC222-2] Terminal supports Master and is a CAT1 or a CAT1/2. The Service Code returned in the track2 ( 57 ) is different from the one in the specific tag ( 5F30 ). The card supports Online PIN ( 42 03 ) then nocvm. Please use the following test card: M-TIP Subset 8 PPC MCD 12 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal prompts for PIN - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 12 v2 1" (or v2 0) - OK/NOK - The terminal requests an ARQC - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) - OK/NOK - CVM result must be 42 03 00 - OK/NOK Network simulator checks: - DE 52 is present in authorization request - OK/NOK - The network simulator displays the correct PIN value: PIN Validation, PIN = xxxx where xxxx is the PIN entered OK/NOK - ARQC is successfully validated by the simulator - OK/NOK 98 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 12 Test 05 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Service Code discrepancy. [TC011-2] To ensure the CAT2 and CAT3 PayPass terminals correctly manage the cardholder verification. Case of card supporting Online PIN. [TC223-2] Terminal supports Master and is a CAT2 or a CAT3. The CVM Required limit is lower than the Contactless Transaction Limit. The Service Code returned in the track2 ( 57 ) is different from the one in the specific tag ( 5F30 ). The card supports Online PIN then nocvm ( 1F 03 ). Please use the following test card: M-TIP Subset 8 PPC MCD 12 v2.0 or v2.1. Enter any amount above the CVM Required limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does neitherot prompt for PIN nor request print a signature receipt - OK/NOK - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 12 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM result must be 1F 03 00 or '1F 03 02' - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 99

PPC MCD 12 Test 06 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Service Code discrepancy. [TC011-2] Terminal supports Master. The CVM Required Limit equals the Contactless Transaction Limit. The Service Code returned in the track2 ( 57 ) is different from the one in the specific tag ( 5F30 ). Please use the following test card: M-TIP Subset 8 PPC MCD 12 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 12 v2 1" (or v2 0) - OK/NOK 100 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 4A Test 01 Scenario 01 To ensure the terminal correctly completes the transaction with a Mobile. Amount below the CVM Required Limit. [TC038-1] To ensure the PayPass terminal correctly manages the PayPass values in the existing authorization fields. [TC050-2] To ensure that a terminal transmits the Track2 Equivalent Data for a PayPass M/Chip transaction. Purchase with a mobile. [TC053-2] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55 (effective 1 April 2017).[TC054-2] To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-3] Terminal supports [PayPass3.0] and Master and is online capable. The terminal is such that the CVM Required Limit is greater than zero. The terminal is such that the Kernel indicates 'On-Device holder Verification supported' and the Contactless Transaction Limit (On-device CVM) is not zero. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). - A first transaction is performed where the card requests On-Device cardholder verification: Please use the following test card: M-TIP Subset 8 PPC MCD 4A v1.0. Enter any amount below the CVM Required Limit and below the Contactless Transaction Limit (On-device CVM). If needed select the Master PayPass product. - A second transaction is performed where the Mobile indicates that the Mobile PIN was successfully verified: Please use the following test card: M-TIP Subset 8 PPC MCD 4B v1.0. If needed, the transaction amount must be the same as in the previous transaction. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). PayPass M-TIP Test Case User Guide 09 April 2013 101

Visual checks first transaction: - The terminal displays "Please see phone" (or equivalent) - OK/NOK log checks first transaction: - Application Label indicates "PPC MCD 4A v1 0" - OK/NOK Visual checks second transaction: - The terminal approves the online transaction - OK/NOK log checks second transaction: - Application Label indicates "PPC MCD 4B v1 0" - OK/NOK - In GenAC command, the CVM results value must be '3F 00 02' - OK/NOK Network simulator checks second transaction: The following data must be observed on the 0100 or 0200 message: - DE 22 subfield SE 1 = 07 (POS entry mode: contactless M/Chip) - OK/NOK - DE 23 = 001 (card sequence number) - OK/NOK - DE 35 contains 5413330089600408D25122010123409172 (both D and = are acceptable separators) OK/NOK - DE 48 SEs 23 value is '01' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required - The terminal sends a DE 55 message to the network - OK/NOK - DE 55 - PDSE 9F03 ('amount other') either contains '000000000000' or is not present - OK/NOK - DE 55 - PDSE 9F34 (CVM Results) must be present (effective 1 April 2017)** - Present/Not present/not required - DE 61 subfield SE 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK - Issuer simulator ARC = 00 (accepted) - OK/NOK *: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 subelement SE 23), if present on the card or non-card form factor. **: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017 102 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 4A Test 02 Scenario 01 To ensure the terminal correctly completes the transaction with a Mobile. Amount above the CVM Required Limit. [TC038-2] To ensure the PayPass terminal correctly manages the PayPass values in the existing authorization fields. [TC050-2] To ensure that a terminal transmits the Track2 Equivalent Data for a PayPass M/Chip transaction. Purchase with a mobile. [TC053-2] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55 (effective 1 April 2017).[TC054-2] To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-3] Terminal supports [PayPass3.0] and Master and is online capable. The terminal is such that the CVM Required Limit is lower than the Contactless Transaction Limit (On-device CVM). The terminal is such that the Kernel indicates 'On-Device holder Verification supported'. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). - A first transaction is performed where the card requests On-Device cardholder verification: Please use the following test card: M-TIP Subset 8 PPC MCD 4A v1.0. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit (On-device CVM). If needed select the Master PayPass product. - A second transaction is performed where the Mobile indicates that the Mobile PIN was successfully verified: Please use the following test card: M-TIP Subset 8 PPC MCD 4B v1.0. If needed, the transaction amount must be the same as in the previous transaction. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). PayPass M-TIP Test Case User Guide 09 April 2013 103

Visual checks first transaction: - The terminal displays "Please see phone" (or equivalent) - OK/NOK log checks first transaction: - Application Label indicates "PPC MCD 4A v1 0" - OK/NOK Visual checks second transaction: - The terminal approves the online transaction - OK/NOK log checks second transaction: - Application Label indicates "PPC MCD 4B v1 0" - OK/NOK - In GenAC command, the CVM results value must be '01 00 02' - OK/NOK Network simulator checks second transaction: The following data must be observed on the 0100 or 0200 message: - DE 22 SE subfield 1 = 07 (POS entry mode: contactless M/Chip) - OK/NOK - DE 23 = 001 (card sequence number) - OK/NOK - DE 35 contains 5413330089600408D25122010123409172 (both D and = are acceptable separators) OK/NOK - DE 48 SE s23 value is '01' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required - The terminal sends a DE 55 message to the network - OK/NOK - DE 55 - PDSE 9F03 ('amount other') either contains '000000000000' or is not present - OK/NOK - DE 55 - PDSE 9F34 (CVM Results) must be present (effective 1 April 2017)** - Present/Not present/not required - DE 61 subfield SE 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK - Issuer simulator ARC = 00 (accepted) - OK/NOK *: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 subelement SE 23), if present on the card or non-card form factor. **: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017 104 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 4A Test 03 Scenario 01 To ensure the terminal correctly completes the transaction with a Mobile. Amount below the CVM Required Limit. [TC038-1] Terminal supports [PayPass3.0] and Master and is offline-only. The terminal is such that the CVM Required Limit is greater than zero. The terminal is such that the Kernel indicates 'On-Device holder Verification supported' and the Contactless Transaction Limit (On-device CVM) is not zero. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). - A first transaction is performed where the card requests On-Device cardholder verification: Please use the following test card: M-TIP Subset 8 PPC MCD 4A v1.0. Enter any amount below the CVM Required Limit and below the Contactless Transaction Limit (On-device CVM). If needed select the Master PayPass product. - A second transaction is performed where the Mobile indicates that the Mobile PIN was successfully verified: Please use the following test card: M-TIP Subset 8 PPC MCD 4B v1.0. If needed, the transaction amount must be the same as in the previous transaction. If needed select the Master PayPass product. Visual checks first transaction: - The terminal displays "Please see phone" (or equivalent) - OK/NOK log checks first transaction: - Application Label indicates "PPC MCD 4A v1 0" - OK/NOK Visual checks second transaction: - The terminal approves the offline transaction - OK/NOK log checks second transaction: - Application Label indicates "PPC MCD 4B v1 0" - OK/NOK - In GenAC command, the CVM results value must be '3F 00 02' - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 105

PPC MCD 4A Test 04 Scenario 01 To ensure the terminal correctly completes the transaction with a Mobile. Amount above the CVM Required Limit. [TC038-2] Terminal supports [PayPass3.0] and Master and is offline-only. The terminal is such that the CVM Required Limit is lower than the Contactless Transaction Limit (On-device CVM). The terminal is such that the Kernel indicates 'On-Device holder Verification supported'. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). - A first transaction is performed where the card requests On-Device cardholder verification: Please use the following test card: M-TIP Subset 8 PPC MCD 4A v1.0. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit (On-device CVM). If needed select the Master PayPass product. - A second transaction is performed where the Mobile indicates that the Mobile PIN was successfully verified: Please use the following test card: M-TIP Subset 8 PPC MCD 4B v1.0. If needed, the transaction amount must be the same as in the previous transaction. If needed select the Master PayPass product. Visual checks first transaction: - The terminal displays "Please see phone" (or equivalent) - OK/NOK log checks first transaction: - Application Label indicates "PPC MCD 4A v1 0" - OK/NOK Visual checks second transaction: - The terminal approves the offline transaction - OK/NOK log checks second transaction: - Application Label indicates "PPC MCD 4B v1 0" - OK/NOK - In GenAC command, the CVM results value must be '01 00 02' - OK/NOK 106 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 4B Test 01 Scenario 01 To ensure the PayPass terminal correctly implements the Contactless Transaction Limit [TC061-1b] Terminal supports [PayPass3.0] and Master and is online capable. The terminal is such that it allows to enter amounts equal to the Contactless Transaction Limit (On-device CVM). The terminal is such that the Kernel indicates 'On-Device holder Verification supported'. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). Please use the following test card: M-TIP Subset 8 PPC MCD 4B v1.0. Amount is equal to the Contactless Transaction Limit (On-device CVM). If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 4B v1 0" - OK/NOK - Amount equals the Contactless Transaction Limit (On-device CVM) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 107

PPC MCD 4B Test 01 Scenario 02 To ensure the PayPass terminal correctly implements the Contactless Transaction Limit [TC061-1b] Terminal supports [PayPass3.0] and Master and is offline only. The terminal is such that it allows to enter amounts equal to the Contactless Transaction Limit (On-device CVM). The terminal is such that the Kernel indicates 'On-Device holder Verification supported'. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). Please use the following test card: M-TIP Subset 8 PPC MCD 4B v1.0. Amount is equal to the Contactless Transaction Limit (On-device CVM). If needed select the Master PayPass product. - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 4B v1 0" - OK/NOK - Amount equals the Contactless Transaction Limit (On-device CVM) - OK/NOK 108 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 4B Test 02 Scenario 01 To ensure the PayPass terminal correctly implements the Contactless Transaction Limit [TC061-3b] Terminal supports [PayPass3.0] and Master and On Device holder Verification and allows to enter amounts greater than the Contactless Transaction Limit (On Device CVM). AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). Please use the following test card: M-TIP Subset 8 PPC MCD 4B v1.0. - First step is to initialize the card log: Please run a successful transaction with any amount below the Contactless Transaction Limit (On-device CVM) and then ensure the transaction was correctly stored in the card log. - Second step is the test itself: Amount is equal to one minor unit above the Contactless Transaction Limit (On-device CVM) (e.g.:25.01 ). If needed select the Master PayPass product. Tap card on the PayPass reader even if it looks deactivatedand follow the instructions. - What amount did you enter in the first step transaction? - What amount did you enter in the second step transaction? log checks: - The card log for the second transaction is either empty or contains the log of the transaction performed at the first step (that is, the amount in the GenerateAC command is the amount used at the first step)* or contains a transaction that aborts after the last Read Record response - OK/NOK- Application Label indicates "PPC MCD 4B v1 0" - OK/NOK - Amount is one minor unit above the Contactless Transaction Limit (On-device CVM) - OK/NOK - The terminal shall abort after the last ReadRecord response - OK/NOK *: In case the terminal does not activate the PayPass reader when the entered amount is above all the application Contactless Transaction Limits, the log will be: - empty, when the test tool stores a new log for each single transaction - the one from the previous transaction, when the test tool manages a unique log file. PayPass M-TIP Test Case User Guide 09 April 2013 109

PPC MCD 4B Test 03 Scenario 01 To ensure the terminal not supporting "On-device cardholder verification" correctly completes the transaction with a Mobile. [TC037] To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-2] Terminal supports Master and is online capable and does not support [PayPass3.0] or the "Kernel " indicates "On-device cardholder verification NOT supported" AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). Please use the following test card: M-TIP Subset 8 PPC MCD 4B v1.0. Amount must be below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 4B v1 0" - OK/NOK Network simulator checks: - DE 48 SE s23 value is '01' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required *: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 subelement SE 23), if present on the card or non-card form factor. 110 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 4B Test 04 Scenario 01 To ensure the terminal not supporting "On-device cardholder verification" correctly completes the transaction with a Mobile. [TC037] Terminal supports Master and is offline only and does not support [PayPass3.0] or the "Kernel " indicates "On-device cardholder verification NOT supported" AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). Please use the following test card: M-TIP Subset 8 PPC MCD 4B v1.0. Amount must be below the Contactless Transaction Limit. If needed select the Master PayPass product. - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 4B v1 0" - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 111

PPC MCD 50 Test 01 Scenario 01 To ensure the terminal correctly completes the payment transaction when the card supports Data Storage.[TC026-1] Terminal supports Master and not IDS. The card requests the tags '9F5C' and '9F40' in the PDOL. The card returns the Application Capabilities Information '01 05 00' (DS version 1, field off request, CDA over AAC, Undefined SDS **). The card returns the DS ID. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). The card returns the DSDOL. Please use the following test card: M-TIP Subset 8 PPC MCD 50 v1.0. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 50 v1 0" - OK/NOK 112 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MCD 50 Test 02 Scenario 01 To ensure the terminal correctly completes the payment transaction when the card supports Data Storage. Case of volatile slot. [TC026-3] Terminal supports Master and IDS. The card requests the tags '9F5C' and '9F40' in the PDOL. The card returns the Application Capabilities Information '01 05 00' (DS version 1, field off request, CDA over AAC, Undefined SDS **). The card returns the DS ID. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). The card returns the DSDOL. Whatever the DS Requested Operator ID provided in the GetPO command, the card returns AIP, AFL, '9F5F 01 40' (volatile slot), '9F7F' (DS Unpredictable Number), '9F7D 08 00 00' (DS Summary 1). When the GenAC command includes the DSDOL data then Summary2 and Summary3 are included in the SDAD. Summary2=Summary1. Summary3<>Summary2. Please use the following test card: M-TIP Subset 8 PPC MCD 50 v1.0. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MCD 50 v1 0" - OK/NOK - In the GetPO response, the card returns AIP, AFL, '9F5F 01 40' (volatile slot), '9F7F' (DS Unpredictable Number), '9F7D 08 00 00' (DS Summary 1) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 113

PPC MAP 01 Test 01 Scenario 01 To ensure the PayPass terminal correctly supports different certification authority public key lengths. Case of 1152/144. [TC003-1] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of CDA record having maximum length. [TC011-9] To ensure that the PayPass terminal does not prompt for a contact transaction when the service code indicates a chip is present on the card. Service Code is 220. [TC066] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 220. [TC067-3] Terminal supports Master and is offline capable. The card returns a record with the maximum length (254 bytes). supports CDA. The Service Code contained in Track2 is 220 (Issuer Authorization, PIN required) CVM list does not include Online PIN. CA key length is 1152/144. Please use the following test card: M-TIP Subset 8 PPC MAP 01 v2.0 or v2.1. Enter any amount equal to the Floor Limit. If needed select the Master PayPass product. - The terminal must not prompt for a contact transaction - OK/NOK - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 01 v2 1" (or v2 0) - OK/NOK - Amount must be equal to the Floor Limit - OK/NOK - TVR byte 1 bit 8 = 0 (ODA was performed) - OK/NOK - TVR byte 1 bit 3 = 0 (CDA was successful) - OK/NOK 114 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 01 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of CDA record having maximum length. [TC011-9] To ensure that the PayPass terminal does not prompt for a contact transaction when the service code indicates a chip is present on the card. Service Code is 220. [TC066] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 220. [TC067-3] Terminal supports Master and is online-only and is not an ATM. It does not support [PayPass3.0] or does not support CDA The card returns a record with the maximum length (254 bytes). The Service Code contained in Track2 is 220 (Issuer Authorization, PIN required) CVM list does not include Online PIN. Please use the following test card: M-TIP Subset 8 PPC MAP 01 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal must not prompt for a contact transaction - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 01 v2 1" (or v2 0) - OK/NOK Network simulator checks: - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 115

PPC MAP 01 Test 03 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of CDA record having maximum length. [TC011-9] To ensure the ATM correctly performs holder Verification. To ensure the Terminal Contactless Floor Limit is set to zero. [TC034-1] To ensure that the PayPass terminal does not prompt for a contact transaction when the service code indicates a chip is present on the card. Service Code is 220. [TC066] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 220. [TC067-3] Terminal supports Master and is an ATM. It does not support [PayPass3.0] or does not support CDA The card returns a record with the maximum length (254 bytes). The Service Code contained in Track2 is 220 (Issuer Authorization, PIN required) CVM list does not include Online PIN. Please use the following test card: M-TIP Subset 8 PPC MAP 01 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does neitherot prompt for PIN nor requestprint a signature receipt - OK/NOK - The terminal does not prompt for a contact transaction - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 01 v2 1" (or v2 0) - OK/NOK - TVR byte 3 bit 8 = 1 (CVM failed) - OK/NOK - TVR byte 4 bit 8 = 1is set (floor limit exceeded) - OK/NOK - CVM Result shall be 3F 00 01 - OK/NOK Network simulator checks: - ARQC is successfully validated by the simulator - OK/NOK 116 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 01 Test 04 Scenario 01 To ensure the PayPass terminal correctly supports different certification authority public key lengths. Case of 1152/144. [TC003-1] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of CDA record having maximum length. [TC011-9] To ensure that the PayPass terminal does not prompt for a contact transaction when the service code indicates a chip is present on the card. Service Code is 220. [TC066] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 220. [TC067-3] Terminal supports Master and [PayPass3.0] and CDA and is online-only and is not an ATM. The card returns a record with the maximum length (254 bytes). The Service Code contained in Track2 is 220 (Issuer Authorization, PIN required) CVM list does not include Online PIN. Please use the following test card: M-TIP Subset 8 PPC MAP 01 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal must not prompt for a contact transaction - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 01 v2 1" (or v2 0) - OK/NOK - TVR byte 1 bit 8 = 0 (ODA was performed) - OK/NOK - TVR byte 1 bit 3 = 0 (CDA was successful) - OK/NOK Network simulator checks: - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 117

PPC MAP 01 Test 05 Scenario 01 To ensure the PayPass terminal correctly supports different certification authority public key lengths. Case of 1152/144. [TC003-1] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of CDA record having maximum length. [TC011-9] To ensure the ATM correctly performs holder Verification. To ensure the Terminal Contactless Floor Limit is set to zero. [TC034-1] To ensure that the PayPass terminal does not prompt for a contact transaction when the service code indicates a chip is present on the card. Service Code is 220. [TC066] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 220. [TC067-3] Terminal supports Master and [PayPass3.0] and CDA and is an ATM. The card returns a record with the maximum length (254 bytes). The Service Code contained in Track2 is 220 (Issuer Authorization, PIN required) CVM list does not include Online PIN. Please use the following test card: M-TIP Subset 8 PPC MAP 01 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does neitherot prompt for PIN nor requestprint a signature receipt - OK/NOK - The terminal must not prompt for a contact transaction - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 01 v2 1" (or v2 0) - OK/NOK - TVR byte 1 bit 8 = 0 (ODA was performed) - OK/NOK - TVR byte 1 bit 3 = 0 (CDA was successful) - OK/NOK - TVR byte 3 bit 8 = 1 (CVM failed) - OK/NOK - TVR byte 4 bit 8 = 1is set (floor limit exceeded) - OK/NOK - CVM Result shall be 3F 00 01 - OK/NOK Network simulator checks: - ARQC is successfully validated by the simulator - OK/NOK 118 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 04 Test 01 Scenario 01 To ensure the PayPass terminal transmits the PAN sequence number coming from the chip and not from the Track2 equivalent data item. [TC047] To ensure the attended PayPass terminal correctly manages the cardholder verification. Case of nocvm. [TC221-4] Terminal supports Master and is attended and online capable. It supports nocvm above the CVM Required Limit. The PAN sequence number value from the tag 5F34 is different from the one in the Track2 equivalent data item. The card supports nocvm only ( 1F 03 ). Please use the following test card: M-TIP Subset 8 PPC MAP 04 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does neitherot prompt for PIN nor requestprint a signature receipt - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 04 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM result shall be 1F 03 00 or '1F 03 02' - OK/NOK Network simulator checks: - DE 23 (card sequence number) in authorization request message = '049' - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 119

PPC MAP 04 Test 01b Scenario 01 To ensure the attended PayPass terminal correctly manages the cardholder verification. Case of nocvm. [TC221-4] Terminal supports Master and is attended and offline-only. It supports nocvm above the CVM Required Limit. The card supports nocvm only ( 1F 03 ). Please use the following test card: M-TIP Subset 8 PPC MAP 04 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. - The terminal does neitherot prompt for PIN nor print a request signature receipt - OK/NOK - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 04 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM result shall be 1F 03 00 or '1F 03 02' - OK/NOK 120 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 04 Test 02 Scenario 01 To ensure the PayPass terminal transmits the PAN sequence number coming from the chip and not from the Track2 equivalent data item. [TC047] To ensure the CAT2 and CAT3 PayPass terminals correctly manage the cardholder verification above the CVM Required Limit. Case of card supporting nocvm only. [TC223-3] Terminal supports Master and is a CAT2 online capable. The CVM Required limit is lower than the Contactless Transaction Limit. The PAN sequence number value from the tag 5F34 is different from the one in the Track2 equivalent data item. The card supports nocvm only ( 1F 03 ). Please use the following test card: M-TIP Subset 8 PPC MAP 04 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does neitherot prompt for PIN nor request print a signature receipt - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 04 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM result shall be 1F 03 00 or '1F 03 02' - OK/NOK Network simulator checks: - DE 23 (card sequence number) in authorization request message = '049' - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 121

PPC MAP 04 Test 02b Scenario 01 To ensure the CAT2 and CAT3 PayPass terminals correctly manage the cardholder verification above the CVM Required Limit. Case of card supporting nocvm only. [TC223-3] Terminal supports Master and is a CAT2 offline-only. The CVM Required limit is lower than the Contactless Transaction Limit. The card supports nocvm only ( 1F 03 ). Please use the following test card: M-TIP Subset 8 PPC MAP 04 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. - The terminal does neitherot prompt for PIN nor print a request signature receipt - OK/NOK - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 04 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM result shall be 1F 03 00 or '1F 03 02' - OK/NOK 122 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 04 Test 03 Scenario 01 To ensure the PayPass terminal transmits the PAN sequence number coming from the chip and not from the Track2 equivalent data item. [TC047] To ensure the CAT1 PayPass terminals correctly manage the cardholder verification. Case of card supporting nocvm only. [TC222-3] Terminal supports Master and is a CAT1 or a CAT1/2. The PAN sequence number value from the tag 5F34 is different from the one in the Track2 equivalent data item. The card supports nocvm only ( 1F 03 ). Please use the following test card: M-TIP Subset 8 PPC MAP 04 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does neitherot prompt for PIN nor requestprint a signature receipt - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 04 v2 1" (or v2 0) - OK/NOK - TVR byte 3 bit 8 = 1 (holder verification was NOT successful) - OK/NOK - CVM result shall be 3F 00 01 - OK/NOK Network simulator checks: - DE 23 (card sequence number) in authorization request message = '049' - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 123

PPC MAP 04 Test 04 Scenario 01 To ensure the CAT2 and CAT3 PayPass terminals correctly manage the cardholder verification above the CVM Required Limit. Case of card supporting nocvm only. [TC223-3] Terminal supports Master and is a CAT3. The CVM Required limit is lower than the Contactless Transaction Limit. The card supports nocvm only ( 1F 03 ). Please use the following test card: M-TIP Subset 8 PPC MAP 04 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. - The terminal does neitherot prompt for PIN nor print a request signature receipt - OK/NOK - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 04 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM result shall be 1F 03 00 or '1F 03 02' - OK/NOK 124 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 04 Test 05 Scenario 01 To ensure the PayPass terminal transmits the PAN sequence number coming from the chip and not from the Track2 equivalent data item. [TC047] Terminal supports Master and is attended and online capable. The CVM Required Limit equals the Contactless Transaction Limit. The PAN sequence number value from the tag 5F34 is different from the one in the Track2 equivalent data item. Please use the following test card: M-TIP Subset 8 - PPC MAP 04 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 04 v2 1" (or v2 0) - OK/NOK Network simulator checks: - DE 23 (card sequence number) in authorization request message = '049' - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 125

PPC MAP 04 Test 06 Scenario 01 To ensure the PayPass terminal transmits the PAN sequence number coming from the chip and not from the Track2 equivalent data item. [TC047] To ensure the attended PayPass terminal correctly manages the cardholder verification. Case of nocvm not supported. [TC221-5] Terminal supports Master and is attended and online capable. It does not support nocvm above the Master CVM Required Limit. The CVM Required Limit is lower than the Contactless Transaction Limit. The PAN sequence number value from the tag 5F34 is different from the one in the Track2 equivalent data item. The card supports nocvm only ( 1F 03 ). Please use the following test card: M-TIP Subset 8 PPC MAP 04 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does neitherot prompt for PIN nor requestprint a signature receipt - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 04 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 8 = 1 (holder verification failed) - OK/NOK - CVM result shall be 3F 00 01 - OK/NOK Network simulator checks: - DE 23 (card sequence number) in authorization request message = '049' - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK 126 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 04 Test 06b Scenario 01 To ensure the attended PayPass terminal correctly manages the cardholder verification. Case of nocvm not supported. [TC221-5] Terminal supports Master and is attended and offline-only. It does not support nocvm above the Master CVM Required Limit. The CVM Required Limit is lower than the Contactless Transaction Limit. The card supports nocvm only ( 1F 03 ). Please use the following test card: M-TIP Subset 8 PPC MAP 04 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. - The terminal does neitherot prompt for PIN nor requestprint a signature receipt - OK/NOK - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 04 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 8 = 1 (holder verification failed) - OK/NOK - CVM result shall be 3F 00 01 - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 127

PPC MAP 04 Test 07 Scenario 01 To ensure the PayPass terminal transmits the PAN sequence number coming from the chip and not from the Track2 equivalent data item. [TC047] Terminal supports Master and is an ATM The PAN sequence number value from the tag 5F34 is different from the one in the Track2 equivalent data item. The card supports nocvm only ( 1F 03 ). Please use the following test card: M-TIP Subset 8 PPC MAP 04 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 04 v2 1" (or v2 0) - OK/NOK Network simulator checks: - DE 23 (card sequence number) = '049' - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK 128 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 06 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of maximum Track2 length. [TC011-5] Terminal supports Master and is offline-only. The Track2 data (tag 57 ) has the maximum length (37 digits). Please use the following test card: M-TIP Subset 8 PPC MAP 06 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 06 v2 1" (or v2 0) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 129

PPC MAP 06 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of maximum Track2 length. [TC011-5] To ensure the PayPass terminal correctly manages the Issuer response 00 (successful). [TC042] Terminal supports Master and is online capable. It does not support Online PIN. The Track2 data (tag 57 ) has the maximum length (37 digits). Please use the following test card: M-TIP Subset 8 PPC MAP 06 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 06 v2 1" (or v2 0) - OK/NOK Network simulator checks: - DE 35 contains '5413330089601067D14122020123409172999 (both D and = are acceptable separators) - OK/NOK - DE 55 subfield SE 9F27 value shall be the same as returned by the card to the first GENERATE AC OK/NOK - ARQC is successfully validated by the simulator - OK/NOK 130 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 06 Test 03 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of maximum Track2 length. [TC011-5] To ensure the PayPass terminal correctly manages the Issuer response 00 (successful). [TC042] To ensure the PayPass terminal correctly manages the Online PIN verification, when supported. Case of 6 digits PIN. [TC051-3] Terminal supports Master and Online PIN and is not an ATM. The CVM Required Limit is lower than the Contactless Transaction Limit. The Track2 data (tag 57 ) has the maximum length (37 digits). The card has a 6 digits PIN (431555). Please use the following test card: M-TIP Subset 8 PPC MAP 06 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. PIN value is 431555. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal prompts for PIN - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 06 v2 1" (or v2 0) - OK/NOK - Amount above the CVM Required Limit - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) - OK/NOK Network simulator checks: - DE 35 contains '5413330089601067D14122020123409172999 (both D and = are acceptable separators) - OK/NOK - DE 55 subfield SE 9F27 value in the network log shall be the same as returned by the card to the first GENERATE AC OK/NOK - The network simulator displays the correct PIN value: PIN Validation, PIN = xxxx where xxxx is the PIN entered OK/NOK - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 131

PPC MAP 06 Test 04 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of maximum Track2 length. [TC011-5] To ensure the ATM correctly performs holder Verification. To ensure the Terminal Contactless Floor Limit is set to zero. [TC034-2] To ensure the PayPass terminal correctly manages the Issuer response 00 (successful). [TC042] To ensure the PayPass terminal correctly manages the Online PIN verification, when supported. Case of 6 digits PIN. [TC051-3] Terminal supports Master and is an ATM. The CVM Required Limit is lower than the Contactless Transaction Limit. The Track2 data (tag 57 ) has the maximum length (37 digits). The card has a 6 digits PIN (431555). Please use the following test card: M-TIP Subset 8 PPC MAP 06 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. PIN value is 431555. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal prompts for PIN - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 06 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - The terminal requests an ARQC- OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) - OK/NOK - TVR byte 4 bit 8 = 1 (floor limit exceeded) - OK/NOK - CVM result is 42 03 00 - OK/NOK Network simulator checks: - DE 35 contains '5413330089601067D14122020123409172999 (both D and = are acceptable separators) - OK/NOK - DE 55 subfield SE 9F27 value in the network log shall be the same as returned by the card to the first GENERATE AC OK/NOK - The network simulator displays the correct PIN value: PIN Validation, PIN = xxxx where xxxx is the PIN entered OK/NOK - ARQC is successfully validated by the simulator - OK/NOK 132 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 07 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Track1 maximum length. [TC011-4] To ensure that the PayPass terminal is able to print a cardholder receipt. Case below the CVM Required Limit.[TC024-1] To ensure the PayPass terminal is able to perform PayPass transactions below or equal to the defined limit, when applicable. To ensure the PayPass terminal completes CVM processing when the amount is below or equal to the defined limit. [TC033] Terminal supports Master and receipt printing. It has a CVM Required Limit greater than zero for the Master application. The Track1 discretionary data (tag 9F1F ) has the maximum length (48 bytes). The card contains ( 4203 5E03 1F03 ) in the CVM list. Please use the following test card: M-TIP Subset 8 PPC MAP 07 v2.0 or v2.1. Enter any amount below the CVM Required Limit. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK - The terminal is able to print a cardholder receipt below the CVM Required Limit in case the cardholder requests it - OK/NOK log checks: - Application Label indicates "PPC MAP 07 v2 1" (or v2 0) - OK/NOK - Amount is below the CVM Required Limit - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM Result must indicate either 420300 or 5E0300 or 1F0300 or 1F0302 - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 133

PPC MAP 07 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Track1 maximum length. [TC011-4] Terminal supports Master and not Online PIN and has a CVM Required Limit equal to zero. Terminal does not support [PayPass3.0] or does not support CDA or is offline-only or the floor limit is above the Contactless Transaction Limit. The Track1 discretionary data (tag 9F1F ) has the maximum length (48 bytes). Please use the following test card: M-TIP Subset 8 PPC MAP 07 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 07 v2 1" (or v2 0) - OK/NOK 134 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 07 Test 03 Scenario 01 To ensure that the PayPass terminal performs CDA correctly. [TC002-2] To ensure the PayPass terminal correctly supports different certification authority public key lengths. [TC003-2] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Track1 maximum length. [TC011-4] Terminal supports Master and not Online PIN and has a CVM Required Limit equal to zero. Terminal supports [PayPass3.0] and CDA and has a floor limit lower than the Contactless Transaction Limit. The Track1 discretionary data (tag 9F1F ) has the maximum length (48 bytes). Please use the following test card: M-TIP Subset 8 PPC MAP 07 v2.0 or v2.1. Enter any amount above the floor limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 07 v2 1" (or v2 0) - OK/NOK - The terminal shall request an ARQC with CDA ( 90 ) - OK/NOK - TVR byte 1 = '00' (CDA successful) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 135

PPC MAP 07 Test 04 Scenario 01 To ensure that the PayPass terminal performs CDA correctly. [TC002-2] To ensure the PayPass terminal correctly supports different certification authority public key lengths. [TC003-2] Terminal supports Master and not Online PIN and has a CVM Required Limit greater than zero. Terminal supports [PayPass3.0] and CDA and has a floor limit lower than the Contactless Transaction Limit. The card supports CDA. Please use the following test card: M-TIP Subset 8 PPC MAP 07 v2.0 or v2.1. Enter any amount above the floor limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 07 v2 1" (or v2 0) - OK/NOK - The terminal shall request an ARQC with CDA ( 90 ) - OK/NOK - TVR byte 1 = '00' (CDA successful) - OK/NOK 136 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 07 Test 05 Scenario 01 To ensure the PayPass terminal correctly manages the Online PIN verification, when supported. Case of 5 digits PIN. [TC051-2] Terminal supports Master and Online PIN and has a CVM Required Limit greater than zero for the Master application. Terminal does not support [PayPass3.0] or does not support CDA. The card has a 5 digits PIN (43155). Please use the following test card: M-TIP Subset 8 PPC MAP 07 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. PIN value is 43155. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal prompts for PIN - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 07 v2 1" (or v2 0) - OK/NOK - Amount above the CVM Required Limit - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) - OK/NOK Network simulator checks: - The network simulator displays the correct PIN value: PIN Validation, PIN = xxxx where xxxx is the PIN entered OK/NOK - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 137

PPC MAP 07 Test 06 Scenario 01 To ensure that the PayPass terminal performs CDA correctly. [TC002-2] To ensure the PayPass terminal correctly supports different certification authority public key lengths. [TC003-2] To ensure the PayPass terminal correctly manages the Online PIN verification, when supported. Case of 5 digits PIN. [TC051-2] Terminal supports Master and Online PIN and has a CVM Required Limit greater than zero for the Master application. Terminal supports [PayPass3.0] and CDA. The card has a 5 digits PIN (43155). Please use the following test card: M-TIP Subset 8 PPC MAP 07 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. PIN value is 43155. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal prompts for PIN - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 07 v2 1" (or v2 0) - OK/NOK - Amount above the CVM Required Limit - OK/NOK - The terminal shall request an ARQC with CDA ( 90 ) - OK/NOK - TVR byte 1 = '00' (CDA successful) - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) - OK/NOK Network simulator checks: - The network simulator displays the correct PIN value: PIN Validation, PIN = xxxx where xxxx is the PIN entered OK/NOK - ARQC is successfully validated by the simulator - OK/NOK 138 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 07 Test 07 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Track1 maximum length. [TC011-4] To ensure the PayPass terminal correctly manages the Online PIN verification, when supported. Case of 5 digits PIN. [TC051-2] Terminal supports Master and Online PIN and has a CVM Required Limit equal to zero for the Master application. Terminal does not support [PayPass3.0] or does not support CDA. The Track1 discretionary data (tag 9F1F ) has the maximum length (48 bytes). The card has a 5 digits PIN (43155). Please use the following test card: M-TIP Subset 8 PPC MAP 07 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. PIN value is 43155. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal prompts for PIN - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 07 v2 1" (or v2 0) - OK/NOK - TVR byte 3 bit 3 = 1(Online PIN entered) - OK/NOK Network simulator checks: - The network simulator displays the correct PIN value: PIN Validation, PIN = xxxx where xxxx is the PIN entered OK/NOK - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 139

PPC MAP 07 Test 08 Scenario 01 To ensure that the PayPass terminal performs CDA correctly. [TC002-2] To ensure the PayPass terminal correctly supports different certification authority public key lengths. [TC003-2] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Track1 maximum length. [TC011-4] To ensure the PayPass terminal correctly manages the Online PIN verification, when supported. Case of 5 digits PIN. [TC051-2] Terminal supports Master and Online PIN and has a CVM Required Limit equal to zero for the Master application. Terminal supports [PayPass3.0] and CDA. The Track1 discretionary data (tag 9F1F ) has the maximum length (48 bytes). The card has a 5 digits PIN (43155). Please use the following test card: M-TIP Subset 8 PPC MAP 07 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. PIN value is 43155. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal prompts for PIN - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 07 v2 1" (or v2 0) - OK/NOK - The terminal shall request an ARQC with CDA ( 90 ) - OK/NOK - TVR byte 1 = '00' (CDA successful) - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) - OK/NOK Network simulator checks: - The network simulator displays the correct PIN value: PIN Validation, PIN = xxxx where xxxx is the PIN entered OK/NOK - ARQC is successfully validated by the simulator - OK/NOK 140 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 07 Test 09 Scenario 01 To ensure the PayPass terminal correctly manages the gratuities, when supported. [TC041] Terminal supports Master and is online capable and supports gratuity. Please use the following test card: M-TIP Subset 8 PPC MAP 07 v2.0 or v2.1. Enter any amount and a gratuity amount. The transaction amount plus the gratuity amount must be below the Contactless Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 07 v2 1" (or v2 0) - OK/NOK Network simulator checks: - DE 4 contains the sum of initial amount and gratuity - OK/NOK - DE 55 SE 9F02 ('Amount authorized') contains the sum of initial amount and gratuity - OK/NOK - DE 55 SE 9F03 ('Amount, other') contains zeroes or is absent - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 141

PPC MAP 07 Test 10 Scenario 01 To ensure the PayPass terminal correctly manages the gratuities, when supported. [TC041] Terminal supports Master and is offline-only and supports gratuity. Please use the following test card: M-TIP Subset 8 PPC MAP 07 v2.0 or v2.1. Enter any amount and a gratuity amount. The transaction amount plus the gratuity amount must be below the Contactless Transaction Limit. If needed select the Master PayPass product. - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 07 v2 1" (or v2 0) - OK/NOK 142 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 07 Test 11 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Track1 maximum length. [TC011-4] To ensure the PayPass terminal is able to perform PayPass transactions below or equal to the defined limit, when applicable. To ensure the PayPass terminal completes CVM processing when the amount is below or equal to the defined limit. [TC033] Terminal supports Master and has a CVM Required Limit greater than zero. Terminal does not support receipt printing. The Track1 discretionary data (tag 9F1F ) has the maximum length (48 bytes). The card contains ( 4203 5E03 1F03 ) in the CVM list. Please use the following test card: M-TIP Subset 8 PPC MAP 07 v2.0 or v2.1. Enter any amount below the CVM Required Limit and below the Floor Limit. If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 07 v2 1" (or v2 0) - OK/NOK - Amount is below the CVM Required Limit - OK/NOK - Amount is below the Floor Limit - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM Result must indicate either 420300 or 5E0300 or 1F0300 or 1F0302 - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 143

PPC MAP 10 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of tag 88. [TC011-1] To ensure the PayPass terminal correctly behaves when the CDOL1 includes tags being forbidden in the DE 55. [TC012] To ensure the PayPass terminal does not transmit the PAN sequence number when it is not returned by the card. [TC048] Terminal supports Master and is online capable. The card returns the unknown tag 88 in PPSE response. The card requests 9F21 (Transaction Time) and 9F40 (Additional Terminal Capabilities) in CDOL1. This data is forbidden in DE 55. The card does not return any PAN sequence number. Please use the following test card: M-TIP Subset 8 PPC MAP 10 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 10 v2 1" (or v2 0) - OK/NOK Network simulator checks: - The Terminal does not send the tags 9F21 and 9F40 to the network - OK/NOK - The Terminal does not send the PAN sequence number (DE 23) to the network - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK 144 PayPass M-TIP Test Case User Guide 09 April 2013

PPC MAP 10 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of tag 88. [TC011-1] Terminal supports Master and is offline-only. The card returns the unknown tag 88 in PPSE response. Please use the following test card: M-TIP Subset 8 PPC MAP 10 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "PPC MAP 10 v2 1" (or v2 0) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 145

Combo01 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Third Party data with length 5. [TC011-10] To ensure the terminal always selects the highest priority application without cardholder assistance. [TC070-1] Terminal supports Master and not IDS returns the PayPass Third Party data ( 9F6E ) with length 5. contains 2 applications returned in the following order: Maestro, priority 03 Master, priority 02 Please use the following test card: M-TIP Subset 8 Combo01 v1.0. Enter any amount below the Contactless Transaction Limit. If needed, PIN value is 4315. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - The terminal automatically selects the Master application - OK/NOK - Application Label indicates "Combo01 v1 0" - OK/NOK 146 PayPass M-TIP Test Case User Guide 09 April 2013

Combo01 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Third Party data with length 5. [TC011-10] To ensure the terminal correctly completes the payment transaction when the card supports Data Storage. Case of slot not available. [TC026-2] To ensure the terminal always selects the highest priority application without cardholder assistance. [TC070-1] Terminal supports Master and IDS returns the PayPass Third Party data ( 9F6E ) with length 5. contains 2 applications returned in the following order: Maestro, priority 03 Master, priority 02 Whatever the DS Requested Operator ID (different from zero) provided in the GetPO command, the card returns AIP, AFL, '9F5F 01 00' ("no slot available"). Please use the following test card: M-TIP Subset 8 Combo01 v1.0. Enter any amount below the Contactless Transaction Limit. If needed, PIN value is 4315. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - The terminal automatically selects the Master application - OK/NOK - Application Label indicates "Combo01 v1 0" - OK/NOK - The card returns '9F5F 01 00' ("no slot available") in the GetPO response - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 147

Combo11 Test 01 Scenario 01 To ensure the terminal always selects the highest priority application without cardholder assistance. [TC070-3] Terminal supports Master and not Maestro. contains 2 applications returned in the following order: Master, priority 15 Maestro, priority 06 Please use the following test card: M-TIP Subset 8 Combo11 v1.0. Enter any amount below the Contactless Transaction Limit. If needed, PIN value is 4315. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - The terminal automatically selects the Master application - OK/NOK - Application Label indicates "Combo11 v1 0" - OK/NOK 148 PayPass M-TIP Test Case User Guide 09 April 2013

4.5 Test Scenarios for Maestro PayPass M/Chip MP01 Test 01 Scenario 01 To ensure the PayPass terminal correctly manages the Issuer response 00 (successful). [TC042] To ensure the PayPass terminal supports the Full Grade network messages. [TC049-1] To ensure the PayPass terminal correctly manages PayPass values in the existing authorization fields. Case of M/Chip transaction. [TC050-2] To ensure that a terminal transmits the Track2 Equivalent Data for a PayPass M/Chip transaction. [TC053-1] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55 [TC054-1] Terminal supports Maestro and is online capable and is not an ATM. This card has no specific feature. Please use the following test card: M-TIP Subset 8 MP01 v2.0 or v2.1. Enter amount below the CVM Required Limit (if not zero). Possible amount values are: - 5.00 or 5 000 000-10.00 or 10 000 000-40.00 or 40 000 000-100.00 or 100 000 000 - or any other rounded value. If needed select the Maestro PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). PayPass M-TIP Test Case User Guide 09 April 2013 149

- The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "MP01 v2 1" (or v2 0) - OK/NOK - Amount is below (and not equal to) the CVM Required Limit - OK/NOK Network simulator checks: - DE 3 subfield 1 (transaction type code) = '00' (purchase) - OK/NOK - DE 22 SE subfield 1 = 07 (POS entry mode: contactless M/Chip) - OK/NOK - DE 23 = 001 (card sequence number) - OK/NOK - DE 35 contains 6799998900000060018D1412201012345678 (both D and = are acceptable separators) OK/NOK - The terminal sends a DE 55 message to the network - OK/NOK - DE 55 - PDSE 9F03 ('amount other') either contains '000000000000' or is not present - OK/NOK - DE 55 subfield SE 9F27 value in the network log shall be the same as returned by the card to the first GENERATE AC OK/NOK - DE 55 - PDSE 9F34 ('CVM Result') is present (effective 1 April 2017)* - Present/Not present/not required - DE 61 subfield SE 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - Issuer simulator ARC = 00 (accepted) - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK *: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017. 150 PayPass M-TIP Test Case User Guide 09 April 2013

MP01 Test 01b Scenario 01 To ensure the PayPass terminal correctly manages the Issuer response 00 (successful). [TC042] To ensure the PayPass terminal supports the Full Grade network messages. [TC049-2] To ensure the PayPass terminal correctly manages PayPass values in the existing authorization fields. Case of M/Chip transaction. [TC050-2] To ensure that a terminal transmits the Track2 Equivalent Data for a PayPass M/Chip transaction. [TC053-1] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55 [TC054-1] Terminal supports Maestro and is an ATM. This card has no specific feature. Please use the following test card: M-TIP Subset 8 MP01 v2.0 or v2.1. Enter amount below the CVM Required Limit (if not zero). Possible amount values are: - 5.00 or 5 000 000-10.00 or 10 000 000-40.00 or 40 000 000-100.00 or 100 000 000 - or any other rounded value. The network simulator validates the authorization message and returns the response 00 (accepted). PayPass M-TIP Test Case User Guide 09 April 2013 151

- The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "MP01 v2 1" (or v2 0) - OK/NOK - Amount is below (and not equal to) the CVM Required Limit - OK/NOK Network simulator checks: - DE 3 subfield 1 (transaction type code) = '01' (withdrawal) - OK/NOK - DE 22 subfield 1 = 07 (POS entry mode: contactless M/Chip) - OK/NOK - DE 23 = 001 (card sequence number) - OK/NOK - DE 35 contains 6799998900000060018D1412201012345678 (both D and = are acceptable separators) OK/NOK - DE 48 byte 1 (TCC) = 'Z' ('ATM Cash Disbursement') - OK/NOK - DE 55 SE 9F03 ('amount other') either contains '000000000000' or is not present - OK/NOK - DE 55 SE 9F27 value in the network log shall be the same as returned by the card to the first GENERATE AC OK/NOK - DE 55 SE 9F34 (CVM Result') is present in the authorization message (effective 1 April 2017)* - Present/Not present/not required - DE 61 subfield 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - Issuer simulator ARC = 00 (accepted) - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK *: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017. 152 PayPass M-TIP Test Case User Guide 09 April 2013

MP01 Test 02 Scenario 01 To ensure the PayPass terminal correctly manages the Issuer response 51 (insufficient funds). [TC043-1] Terminal supports Maestro and is online capable. This card has no specific feature. Please use the following test card: M-TIP Subset 8 MP01 v2.0 or v2.1. Enter amount below the CVM Required Limit (if not zero). Possible amount values are: - 5.51 or 5 510 000-10.51 or 10 510 000-40.51 or 40 510 000-100.51 or 100 510 000 - or any value like *51*. If needed select the Maestro PayPass product. The network simulator validates the authorization message and returns the response 51 (insufficient funds). - The terminal declines the online transaction - OK/NOK log checks: - Application Label indicates "MP01 v2 1" (or v2 0) - OK/NOK Network simulator checks: - response is 51 (insufficient funds) - OK/NOK PayPass terminals should prompt for a contact transaction when a PayPass transaction is declined by the card, terminal, or issuer, or if it fails to complete for any other reason other than a communication error. [PPReq2011] page 4-15 PayPass M-TIP Test Case User Guide 09 April 2013 153

MP01 Test 03 Scenario 01 To ensure the PayPass terminal correctly manages the Issuer response 57 (Transaction not permitted). [TC043-2] Terminal supports Maestro and is online capable. This card has no specific feature. Please use the following test card: M-TIP Subset 8 MP01 v2.0 or v2.1. Enter amount below the CVM Required Limit (if not zero). Possible amount values are: - 5.57 or 5 570 000-10.57 or 10 570 000-40.57 or 40 570 000-100.57 or 100 570 000 - or any value like *57*. If needed select the Maestro PayPass product. The network simulator validates the authorization message and returns the response 57 (Transaction not permitted). - The terminal declines the online transaction - OK/NOK log checks: - Application Label indicates "MP01 v2 1" (or v2 0) - OK/NOK Network simulator checks: - response is 57 (Transaction not permitted) - OK/NOK PayPass terminals should prompt for a contact transaction when a PayPass transaction is declined by the card, terminal, or issuer, or if it fails to complete for any other reason other than a communication error. [PPReq2011] page 4-15 154 PayPass M-TIP Test Case User Guide 09 April 2013

MP01 Test 04 Scenario 01 To ensure the PayPass terminal does not process the ICC response data erroneously returned by the issuer. [TC045] Terminal supports Maestro and is online capable. This card has no specific feature. Please use the following test card: M-TIP Subset 8 MP01 v2.0 or v2.1. Enter amount below the CVM Required Limit (if not zero). Possible amount values are: - 5.99 or 5 990 000-10.99 or 10 990 000-40.99 or 40 990 000-100.99 or 100 990 000 - or any value like *99*. If needed select the Maestro PayPass product. is let on the terminal until the transaction is completed or the ticket is printed. The network simulator validates the authorization message and returns the following response: - DE 39 (Response code) = '00' (Approved) - DE 55 - PDS 91 (Issuer Authentication Data) is present - DE 55 - PDS 72 (Issuer Script Template 2) with one script identifier and 6 PIN Unblock commands followed by a PIN Change Unblock. - The transaction must successfully complete - OK/NOK log checks: - Application Label indicates "MP01 v2 1" (or v2 0) - OK/NOK - The terminal must not send any command to the card beyond the 1st Generate AC- OK/NOK Network simulator checks: - response contains DE 55 - PDSE 91 and PDSE 72 - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 155

MP01 Test 05 Scenario 01 To ensure that the PayPass terminal correctly implements the Contactless Transaction Limit. Case of amount just above the limit. Terminal supports [PayPass2.x]. [TC061-2] Terminal supports Maestro and [PayPass2.x]. Terminal allows the user to enter amounts greater than the Contactless Transaction Limit. This card has no specific feature. Please use the following test card: M-TIP Subset 8 MP01 v2.0 or v2.1. - First step is to initialize the card log: Please run a successful transaction with any amount below the CVM Required Limit and then ensure the transaction was correctly stored in the card log. - Second step is the test itself: Amount must be one minor unit above the Maestro Contactless Transaction Limit* (e.g.: 25.01 ) If needed select the Maestro PayPass product. Tap card on the PayPass reader even if it looks deactivated. - What amount did you enter in the first step transaction? - What amount did you enter in the second step transaction? log checks: - The card log for the second transaction is either empty or contains the log of the transaction performed at the first step( that is, the amount in the GenerateAC command is the amount used at the first step)** - OK/NOK *: You must consider the limit mentioned in the M-TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. **: When the test tool stores a new log for each single transaction, the log will be empty since the terminal must either not activate the PayPass reader or abort after the PPSE response (and the PPSE is not stored in the log). When the test tool manages a unique log file, the log will be the one from the previous transaction since a log is not created until the SelectADF is sent, which is never the case here. 156 PayPass M-TIP Test Case User Guide 09 April 2013

MP01 Test 06 Scenario 01 To ensure that the PayPass terminal correctly implements the Contactless Transaction Limit. Case of amount above the limit. Terminal supports [PayPass3.0]. [TC061-3a] Terminal supports Maestro and [PayPass3.0]. Terminal allows the user to enter amounts greater than the Contactless Transaction Limit. This card has no specific feature. Please use the following test card: M-TIP Subset 8 MP01 v2.0 or v2.1. - First step is to initialize the card log: Please run a successful transaction with any amount below the Contactless Transaction Limit and then ensure the transaction was correctly stored in the card log. - Second step is the test itself: Amount must be one minor unit above the Maestro Contactless Transaction Limit* (e.g.: 25.01 ). If needed select the Maestro PayPass product. Tap card on the PayPass reader even if it looks deactivatedand follow the instructions. - What amount did you enter in the first step transaction? - What amount did you enter in the second step transaction? log checks: - The card log for the second transaction is either empty or contains the log of the transaction performed at the first step (that is, the amount in the GenerateAC command is the amount used at the first step)* or contains a transaction that aborts after the last Read Record response - OK/NOK- Application Label indicates "MP01 v2 1" (or v2 0) - OK/NOK - The transactions aborts after the last Read Record response - OK/NOK *: In case the terminal does not activate the PayPass reader when the entered amount is above all the application Contactless Transaction Limits, the log will be: - empty, when the test tool stores a new log for each single transaction - the one from the previous transaction, when the test tool manages a unique log file. PayPass M-TIP Test Case User Guide 09 April 2013 157

MP01 Test 07 Scenario 01 To ensure that transactions attempted above the CVM Required Limit with cards issued outside a Maestro PayPass soft limit market (i.e.: not supporting Online PIN in the CVM list) are declined by the terminal. [TC411] Terminal supports Maestro and is not an ATM and the CVM Required Limit is lower than the Contactless Transaction Limit. CVM list is nocvm only. Please use the following test card: M-TIP Subset 8 - MP01 v2.0 or v2.1. Amount must be above the Maestro CVM Required Limit and below the Contactless Transaction Limit. If needed select the Maestro PayPass product. - Terminal does not ask to enter PIN OK/NOK log checks: - Application Label indicates "MP01 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 3 = 0 (Online PIN not entered) OK/NOK - TVR byte 3 bit 8 = 1 (holder verification failed) OK/NOK - CVM results is 3F 00 01' OK/NOK - Terminal requests an AAC as per the TACs defined in [PPReq2011] OK/NOK 158 PayPass M-TIP Test Case User Guide 09 April 2013

MP01 Test 08 Scenario 01 To ensure the ATM correctly performs holder Verification. To ensure the Terminal Contactless Floor Limit is set to zero. [TC034-1] Terminal supports Maestro and is an ATM. CVM list is nocvm only. Please use the following test card: M-TIP Subset 8 - MP01 v2.0 or v2.1. Amount must be below the Contactless Transaction Limit. If needed select the Maestro PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - Terminal does not ask to enter PIN OK/NOK log checks: - Application Label indicates "MP01 v2 1" (or v2 0) - OK/NOK - TVR byte 3 bit 3 = 0 (Online PIN not entered) OK/NOK - TVR byte 3 bit 8 = 1 (holder verification failed) OK/NOK - TVR byte 4 bit 8 = 1 (floor limit exceeded) OK/NOK - CVM results is 3F 00 01' OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 159

MP11 Test 01 Scenario 01 To ensure the PayPass terminal does not support offlinepin. Case of amount below the CVM Required Limit. [TC021-1] Terminal supports Maestro and not refund and the CVM Required Limit is greater than zero. CVM list indicates 1) Offline PIN 2) Offline Encrypted PIN 3) Signature 4) Online PIN 5) nocvm. Please use the following test card: M-TIP Subset 8 MP11 v2.0 or v2.1. Enter any amount below the CVM Required Limit. If needed select the Maestro PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP11 v2 1" (or v2 0) - OK/NOK - Amount is below the CVM Required Limit - OK/NOK - The terminal does not send any VerifyPIN command - OK/NOK - CVM result byte 1 is different from 41 - OK/NOK 160 PayPass M-TIP Test Case User Guide 09 April 2013

MP11 Test 02 Scenario 01 To ensure the PayPass terminal does not support offlinepin. Case of amount below the CVM Required Limit. [TC021-1] To ensure the PayPass terminal correctly performs refund. [TC025-1] Terminal supports Maestro and refund and [PayPass2.0]. CVM list indicates 1) Offline PIN 2) Offline Encrypted PIN 3) Signature 4) Online PIN 5) nocvm. - First step is to perform the purchase: Please use the following test card: M-TIP Subset 8 MP11 v2.0 or v2.1. Enter an amount equal to the CVM Required Limit**. If needed select the Maestro PayPass product. Please store the card log since it will be required after the subsequent refund transaction. - Second step is to perform the refund: Please use the following test card: M-TIP Subset 8 MP11 v2.0 or v2.1. If requested, the refund amount must be the same as the purchase amount. If needed select the Maestro PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). Visual checks first step (purchase): - The terminal approves the transaction - OK/NOK log checks first step (purchase): - Application Label indicates "MP11 v2 1" (or v2 0) - OK/NOK - Amount is equal to the CVM Required Limit - OK/NOK - The terminal does not send any VerifyPIN command - OK/NOK - CVM result byte 1 is different from 41 - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK Visual checks second step (refund): - The end of the transaction is out of scope. - At the end of the refund process, the terminal displays a message to inform the cardholder that refund has been done successfully - OK/NOK log checks second step (refund): - Application Label indicates "MP11 v2 1" (or v2 0) - OK/NOK **: if the terminal supports [PayPass2.x] you must consider the limit mentioned in the M- TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. PayPass M-TIP Test Case User Guide 09 April 2013 161

MP11 Test 03 Scenario 01 To ensure the PayPass terminal does not support offlinepin. Case of amount below the CVM Required Limit. [TC021-1] To ensure the PayPass terminal correctly performs refund. [TC025-2] Terminal supports Maestro and refund and ([PayPass2.1] or [PayPass3.0]). CVM list indicates 1) Offline PIN 2) Offline Encrypted PIN 3) Signature 4) Online PIN 5) nocvm. - First step is to perform the purchase: Please use the following test card: M-TIP Subset 8 MP11 v2.0 or v2.1. Enter an amount equal to the CVM Required Limit**. If needed select the Maestro PayPass product. Please store the card log since it will be required after the subsequent refund transaction. - Second step is to perform the refund: Please use the following test card: M-TIP Subset 8 MP11 v2.0 or v2.1. If requested, the refund amount must be the same as the purchase amount. If needed select the Maestro PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). Visual checks first step (purchase): - The terminal approves the transaction - OK/NOK log checks first step (purchase): - Application Label indicates "MP11 v2 1" (or v2 0) - OK/NOK - Amount is equal to the CVM Required Limit - OK/NOK - The terminal does not send any VerifyPIN command - OK/NOK - CVM result byte 1 is different from 41 - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK Visual checks second step (refund): - At the end of the refund process, the terminal displays a message to inform the cardholder that refund has been done successfully - OK/NOK log checks second step (refund): - Application Label indicates "MP11 v2 1" (or v2 0) - OK/NOK - The terminal requests an AAC - OK/NOK **: if the terminal supports [PayPass2.x] or [PayPass3.0] you must consider the limit mentioned in the M-TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] or [PayPass3.0] terminals. 162 PayPass M-TIP Test Case User Guide 09 April 2013

MP12 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of maximum Track2 length. [TC011-5] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of tag 9F6E. [TC011-10] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 206 and amount is below the limit. [TC067-1] Terminal supports Maestro and the CVM Required Limit is greater than zero. The Track2 data (tag 57 ) has the maximum length (37 digits). The card returns the tag 9F6E (PayPass Third Party data). The CVM list does not include Online PIN and Service Code contained in Track2 is 206 (Normal Authorization, PIN if pinpad present). Please use the following test card: M-TIP Subset 8 MP12 v2.0 or v2.1. Enter amount below the CVM Required Limit. If needed select the Maestro PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP12 v2 1" (or v2 0) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 163

MP12 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of maximum Track2 length. [TC011-5] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of tag 9F6E. [TC011-10] Terminal supports Maestro and the CVM Required Limit is zero. The Track2 data (tag 57 ) has the maximum length (37 digits). The card returns the tag 9F6E (PayPass Third Party data). Please use the following test card: M-TIP Subset 8 MP12 v2.0 or v2.1. Enter amount below the Contactless Transaction Limit. If needed select the Maestro PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP12 v2 1" (or v2 0) - OK/NOK 164 PayPass M-TIP Test Case User Guide 09 April 2013

MP12 Test 03 Scenario 01 To ensure the PayPass terminal correctly manages the gratuities, when supported. [TC041] Terminal supports Maestro and is online capable and supports gratuity. Please use the following test card: M-TIP Subset 8 MP12 v2.0 or v2.1. Enter any amount and a gratuity amount. The transaction amount plus the gratuity amount must be below the CVM Required Limit. If needed select the Maestro PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "MP12 v2 1" (or v2 0) - OK/NOK - the sum of the transaction amount plus the gratuity amount is below the CVM Required Limit - OK/NOK Network simulator checks: - DE 4 contains the sum of initial amount and gratuity - OK/NOK - DE 55 SE 9F02 ('Amount authorized') contains the sum of initial amount and gratuity - OK/NOK - DE 55 SE 9F03 ('Amount, other') contains zeroes or is absent - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 165

MP12 Test 04 Scenario 01 To ensure the PayPass terminal correctly manages the gratuities, when supported. [TC041] Terminal supports Maestro and is offline-only and supports gratuity. Please, use the following test card: TIP Subset 8 MP12 v2.0 or v2.1. Enter any amount and a gratuity amount. The transaction amount plus the gratuity amount must be below the CVM Required Limit. If needed select the Maestro PayPass product. - The terminal offers to enter the gratuity amount before tapping - OK/NOK - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "MP12 v2 1" (or v2 0) - OK/NOK 166 PayPass M-TIP Test Case User Guide 09 April 2013

MP13 Test 01 Scenario 01 To ensure that the PayPass terminal performs CDA correctly. [TC002-1] To ensure the PayPass terminal correctly supports different certification authority public key lengths. Case of 1152/144. [TC003-1] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of CDA record having maximum length. [TC011-9] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 220. [TC067-3] Terminal supports Maestro and is offline capable. The card returns a record with the maximum length (254 bytes). supports CDA. The Service Code contained in Track2 is 220 (Issuer Authorization, PIN required) CA key length is 1152/144. Please use the following test card: M-TIP Subset 8 MP13 v2.0 or v2.1. Enter amount below the contactless Floor Limit and below the CVM Required Limit. If needed select the Maestro PayPass product. - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "MP13 v2 1" (or v2 0) - OK/NOK - TVR byte 1 bit 8 = 0 (ODA was performed) - OK/NOK - TVR byte 1 bit 3 = 0 (CDA was successful) - OK/NOK - The terminal sends a TC with CDA ( 50 ) in the Generate AC - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 167

MP13 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of CDA record having maximum length. [TC011-9] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 220. [TC067-3] Terminal supports Maestro and is online-only. The card returns a record with the maximum length (254 bytes). The Service Code contained in Track2 is 220 (Issuer Authorization, PIN required) Please use the following test card: M-TIP Subset 8 MP13 v2.0 or v2.1. Enter amount below the CVM Required Limit (if not zero). If needed select the Maestro PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "MP13 v2 1" (or v2 0) - OK/NOK Network simulator checks: - ARQC is successfully validated by the simulator - OK/NOK 168 PayPass M-TIP Test Case User Guide 09 April 2013

MP14 Test 01 Scenario 01 To ensure the PayPass terminal correctly supports different certification authority public key lengths. Case of 1408/176. [TC003-2] To ensure the PayPass terminal correctly supports the exponent 2^16+1. [TC004] To ensure that the PayPass terminal does not use the service code in order to require online authorization or Online PIN. Service Code is 226. [TC067-4] Terminal supports Maestro and is offline capable. The card returns a record with the maximum length (254 bytes). The Service Code contained in Track2 is 226 (Issuer Authorization, PIN if pinpad present). CA key length is 1408/176. ICC public key exponent is 2^16+1. Please use the following test card: M-TIP Subset 8 MP14 v2.0 or v2.1. Enter any amount below CVM Required Limit. If needed select the Maestro PayPass product. - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "MP14 v2 1" (or v2 0) - OK/NOK - Amount must be below the CVM Required Limit - OK/NOK - TVR byte 1 bit 8 = 0 (ODA was performed) - OK/NOK - TVR byte 1 bit 3 = 0 (CDA was successful) - OK/NOK - The terminal sends a TC with CDA ( 50 ) in the Generate AC - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 169

MP14 Test 02 Scenario 01 To ensure the PayPass terminal correctly supports different certification authority public key lengths. Case of 1408/176. [TC003-2] To ensure the PayPass terminal correctly supports the exponent 2^16+1. [TC004] Terminal supports Maestro and is online-only and supports CDA. The card returns a record with the maximum length (254 bytes). CA key length is 1408/176. ICC public key exponent is 2^16+1. Please use the following test card: M-TIP Subset 8 MP14 v2.0 or v2.1. Enter any amount below the CVM Required Limit (if not zero). If needed select the Maestro PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal does not prompt for any PIN to be entered - OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "MP14 v2 1" (or v2 0) - OK/NOK - Amount must be below the CVM Required Limit - OK/NOK - TVR byte 1 bit 8 = 0 (ODA was performed) - OK/NOK - TVR byte 1 bit 3 = 0 (CDA was successful) - OK/NOK - The terminal sends an ARQC with CDA ( 90 ) in the Generate AC - OK/NOK 170 PayPass M-TIP Test Case User Guide 09 April 2013

MP15 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of IAD ( 9F10 ) with maximum length. [TC011-7] To ensure the PayPass terminal transmits the PAN sequence number coming from the chip and not from the Track2 equivalent data item. [TC047] Terminal supports Maestro and is online capable. The IAD ( 9F10 ) returned by the card has the maximum length. The PAN sequence number value from the tag 5F34 is different from the one in the Track2 equivalent data item. Please use the following test card: M-TIP Subset 8 MP15 v2.0 or v2.1. Enter amount below the CVM Required Limit (if not zero). If needed select the Maestro PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP15 v2 1" (or v2 0) - OK/NOK Network simulator checks: - DE 23 (card sequence number) = '049' - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 171

MP15 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of IAD ( 9F10 ) with maximum length. [TC011-7] Terminal supports Maestro and is offline-only. The IAD ( 9F10 ) returned by the card has the maximum length. Please use the following test card: M-TIP Subset 8 MP15 v2.0 or v2.1. Enter any amount below the CVM Required Limit. If needed select the Maestro PayPass product. - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "MP15 v2 1" (or v2 0) - OK/NOK 172 PayPass M-TIP Test Case User Guide 09 April 2013

MP16 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Discretionary Data inconsistency. [TC011-3] To ensure that the PayPass terminal correctly implements the Contactless Contactless Transaction Limit. Case of amount equal to the limit. [TC061-1a] Terminal supports Maestro. The terminal allows the user to enter amounts equal to the Contactless Transaction Limit. The Discretionary Data value in the track2 ( 57 ) is different from the value returned in the specific tag ( 9F20 ). Please use the following test card: M-TIP Subset 8 MP16 v2.0 or v2.1. Amount must be equal to the Contactless Transaction Limit*. If needed select the Maestro PayPass product. If needed, PIN value is 4315. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP16 v2 1" (or v2 0) - OK/NOK - Amount is equal to the Maestro Contactless Transaction Limit - OK/NOK *: if the terminal supports [PayPass2.x] you must consider the limit mentioned in the M- TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. PayPass M-TIP Test Case User Guide 09 April 2013 173

MP16 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Discretionary Data inconsistency. [TC011-3] To ensure the PayPass terminal does not support offlinepin. Amount above the CVM Required Limit. [TC021-2] To ensure the PayPass terminal correctly manages the Online PIN verification, when supported. Case of 4 digits PIN. [TC051-1] To ensure the terminal correctly performs Online PIN above the CVM Required Limit. [TC410] Terminal supports Maestro and not receipt printing. The CVM Required Limit is lower than the Contactless Transaction Limit. The Discretionary Data value in the track2 ( 57 ) is different from the value returned in the specific tag ( 9F20 ). The card supports Online PIN ( 42 03 ) then nocvm. Please use the following test card: M-TIP Subset 8 - MP16 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit and different from *55* and *75*. If needed select the Maestro PayPass product. PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). - Terminal asks to enter PIN OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "MP16 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit OK/NOK - The terminal does not send any VerifyPIN command OK/NOK - The terminal requests an ARQC - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) OK/NOK - CVM results is 42 03 00' OK/NOK Network simulator checks: - DE 52 is present - OK/NOK - The network simulator displays the correct PIN value: PIN Validation, PIN = xxxx where xxxx is the card PIN - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK 174 PayPass M-TIP Test Case User Guide 09 April 2013

MP16 Test 03 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Discretionary Data inconsistency. [TC011-3] To ensure the PayPass terminal does not support offlinepin. Amount above the CVM Required Limit. [TC021-2] To ensure that the PayPass terminal is able to print a cardholder receipt. Amount above the CVM Required Limit. [TC024-2] To ensure the PayPass terminal correctly manages the Online PIN verification, when supported. Case of 4 digits PIN. [TC051-1] To ensure the terminal correctly performs Online PIN above the CVM Required Limit. [TC410] Terminal supports Maestro and receipt printing. The CVM Required Limit is lower than the Contactless Transaction Limit. The Discretionary Data value in the track2 ( 57 ) is different from the value returned in the specific tag ( 9F20 ). The card supports Online PIN ( 42 03 ) then nocvm. Please use the following test card: M-TIP Subset 8 - MP16 v2.0 or v2.1. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit and different from *55* and *75*. If needed select the Maestro PayPass product. PIN value is 4315. The network simulator validates the authorization message and returns the response 00 (accepted). - Terminal asks to enter PIN OK/NOK - The terminal approves the online transaction - OK/NOK - The terminal prints a cardholder receipt - OK/NOK log checks: - Application Label indicates "MP16 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit OK/NOK - The terminal does not send any VerifyPIN command OK/NOK - The terminal requests an ARQC - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) OK/NOK - CVM results is 42 03 00' OK/NOK Network simulator checks: - DE 52 is present - OK/NOK - The network simulator displays the correct PIN value: PIN Validation, PIN = xxxx where xxxx is the card PIN - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 175

MP16 Test 03b Scenario 01 To ensure the PayPass terminal correctly manages the Issuer response 55 (wrong PIN). [TC052-1] Terminal supports Maestro. The CVM Required Limit is lower than the Contactless Transaction Limit. The card supports Online PIN ( 42 03 ) then nocvm. Please use the following test card: M-TIP Subset 8 - MP16 v2.0 or v2.1. Enter amount above the CVM Required Limit and below the Contactless Transaction Limit. Possible amount values are: - 5.55 or 5 550 000-10.55 or 10 550 000-40.55 or 40 550 000-100.55 or 100 550 000 - or any value like *55* If needed select the Maestro PayPass product. The correct PIN value is 4315. (You do not need to enter an incorrect PIN to trigger the simulator response 55 (wrong PIN)). The network simulator validates the authorization message and returns the response 55 (wrong PIN). - The terminal declines the online transaction - OK/NOK log checks: - Application Label indicates "MP16 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) - OK/NOK Network simulator checks: - response is 55 (wrong PIN) - OK/NOK PayPass terminals should prompt for a contact transaction when a PayPass transaction is declined by the card, terminal, or issuer, or if it fails to complete for any other reason other than a communication error.([ppreq2011] page 4-15) 176 PayPass M-TIP Test Case User Guide 09 April 2013

MP16 Test 04 Scenario 01 To ensure the PayPass terminal correctly manages the Issuer responses 75 (Allowable number of PIN tries exceeded). [TC052-2] Terminal supports Maestro. The CVM Required Limit is lower than the Contactless Transaction Limit. The card supports Online PIN ( 42 03 ) then nocvm. Please use the following test card: M-TIP Subset 8 MP16 v2.0 or v2.1. Enter amount above the CVM Required Limit and below the Contactless Transaction Limit. Possible amount values are: - 4.75 or 4 750 000-10.75 or 10 750 000-40.75 or 40 750 000-100.75 or 100 750 000 - or any value like *75* If needed select the Maestro PayPass product. The correct PIN value is 4315. (You do not need to enter an incorrect PIN to trigger the simulator response 75 (Allowable number of PIN tries exceeded)). The network simulator validates the authorization message and returns the response 75 (Allowable number of PIN tries exceeded). - The terminal declines the online transaction - OK/NOK log checks: - Application Label indicates "MP16 v2 1" (or v2 0) - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) - OK/NOK Network simulator checks: - response is 75 (Allowable number of PIN tries exceeded) - OK/NOK PayPass terminals should prompt for a contact transaction when a PayPass transaction is declined by the card, terminal, or issuer, or if it fails to complete for any other reason other than a communication error.([ppreq2011] page 4-15) PayPass M-TIP Test Case User Guide 09 April 2013 177

MP16 Test 05 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Discretionary Data inconsistency. [TC011-3] Terminal supports Maestro. The terminal does not allow the user to enter amounts equal to the Contactless Transaction Limit. The CVM Required Limit equals the Contactless Transaction Limit The Discretionary Data value in the track2 ( 57 ) is different from the value returned in the specific tag ( 9F20 ). Please use the following test card: M-TIP Subset 8 MP16 v2.0 or v2.1. Amount must be below the Contactless Transaction Limit and different from *55* and *75*. If needed select the Maestro PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP16 v2 1" (or v2 0) - OK/NOK 178 PayPass M-TIP Test Case User Guide 09 April 2013

MP17 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives unexpected data value or length from the card. Case of ServiceCode discrepancy. [TC011-2] To ensure the PayPass terminal correctly behaves when it receives unexpected data value or length from the card. Case of Unrecognized CVM. [TC011-6] Terminal supports Maestro and is not an ATM. The card returns an unrecognized CVM in the CVM list. The Service Code returned in the track2 ( 57 ) is different from the one in the specific tag ( 5F30 ). Please, use the following test card: TIP Subset 8 MP17 v2.0 or v2.1. Enter amount below the CVM Required limit (if not zero). If needed select the Maestro PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP17 v2 1" (or v2 0) - OK/NOK - TVR byte 3 bit 7 = 1 (Unrecognized CVM) - OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) - OK/NOK - CVM result must be 1F 03 00 or '1F 03 02' - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 179

MP17 Test 01 Scenario 02 To ensure the PayPass terminal correctly behaves when it receives unexpected data value or length from the card. Case of ServiceCode discrepancy. [TC011-2] To ensure the PayPass terminal correctly behaves when it receives unexpected data value or length from the card. Case of Unrecognized CVM. [TC011-6] Terminal supports Maestro and is an ATM. The CVM list includes an unrecognized CVM followed by nocvm. The Service Code returned in the track2 ( 57 ) is different from the one in the specific tag ( 5F30 ). Please, use the following test card: TIP Subset 8 MP17 v2.0 or v2.1. Enter amount below the Contactless Transaction limit. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "MP17 v2 1" (or v2 0) - OK/NOK - TVR byte 3 bit 7 = 1 (Unrecognized CVM) - OK/NOK - TVR byte 3 bit 8 = 1 (holder verification was NOT successful) - OK/NOK 180 PayPass M-TIP Test Case User Guide 09 April 2013

MP18 Test 01 Scenario 01 To ensure the PayPass terminal correctly supports different certification authority public key lengths. CA key length is 1984/248. [TC003-3] Terminal supports Maestro and is offline capable. The returned AIP indicates that the card supports CDA. CA key length is 1984/248 Please use the following test card: M-TIP Subset 8 MP18 v2.0 or v2.12. Enter any amount below the CVM Required Limit and below the floor limit. If needed select the Maestro PayPass product. - The terminal approves the offline or online transaction - OK/NOK log checks: - Application Label indicates "MP18 v2 12" (or v2 0) - OK/NOK - TVR byte 1 bit 8 = 0 (ODA was performed) - OK/NOK - The terminal requests a TC with CDA ( 50 ) in the Generate AC - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 181

MP18 Test 02 Scenario 01 To ensure that the PayPass terminal performs CDA correctly. Amount above the Floor Limit. [TC002-2] To ensure the PayPass terminal correctly supports different certification authority public key lengths. CA key length is 1984/248. [TC003-3] Terminal supports Maestro and [PayPass3.0] and CDA and is online capable and the floor limit is lower than the CVM Required Limit. The returned AIP indicates that the card supports CDA. CA key length is 1984/248 Please use the following test card: M-TIP Subset 8 MP18 v2.0 or v2.12. Enter any amount above the floor limit and below the CVM Required Limit. If needed select the Maestro PayPass product. The network simulator returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "MP18 v2 12" (or v2 0) - OK/NOK - TVR byte 1 bit 8 = 0 (ODA was performed) - OK/NOK - The terminal requests an ARQC with CDA ( 90 ) in the Generate AC - OK/NOK 182 PayPass M-TIP Test Case User Guide 09 April 2013

MP19 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when the CDOL1 includes tags being forbidden in the DE 55. [TC012] To ensure the PayPass terminal does not transmit the PAN sequence number when it is not returned by the card. [TC048] To ensure that the PayPass terminal does not prompt for a contact transaction when the service code indicates a chip is present on the card. Service Code is 220. [TC066] Terminal supports Maestro and is online capable. The card requests 9F21 (Transaction Time) and 9F40 (Additional Terminal Capabilities) in CDOL1. This data is forbidden in DE 55. The card does not return any PAN sequence number. The service code included in the Track2 ( 220 ) indicates that a chip is present on the card. Please use the following test card: M-TIP Subset 8 MP19 v2.0 or v2.1. Enter amount below the CVM Required Limit (if not zero). If needed select the Maestro PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK - The terminal must not prompt for a contact transaction - OK/NOK log checks: - Application Label indicates "MP19 v2 1" (or v2 0) - OK/NOK Network simulator checks: - The Terminal does not send the tags 9F21 and 9F40 to the network - OK/NOK - The Terminal does not send the PAN sequence number (DE 23) to the network - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 183

MP19 Test 02 Scenario 01 To ensure that the PayPass terminal does not prompt for a contact transaction when the service code indicates a chip is present on the card. Service Code is 220. [TC066] Terminal supports Maestro and is offline-only. The service code included in the Track2 ( 220 ) indicates that a chip is present on the card. Please use the following test card: M-TIP Subset 8 MP19 v2.0 or v2.1. Enter any amount below the CVM Required Limit. If needed select the Maestro PayPass product. - The terminal approves the offline transaction - OK/NOK - The terminal must not prompt for a contact transaction - OK/NOK log checks: - Application Label indicates "MP19 v2 1" (or v2 0) - OK/NOK 184 PayPass M-TIP Test Case User Guide 09 April 2013

MP20 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of tag 88. [TC011-1] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Track1 maximum. [TC011-4] To ensure that a terminal has its application version number for PayPass - M/Chip set to 0002. [TC062] Terminal supports Maestro and the CVM Required Limit equals zero. The card returns the unknown tag 88 in PPSE response. The Track1 discretionary data (tag 9F1F ) has the maximum length (48 bytes). The card Application Version Number is set to 0002. Please use the following test card: M-TIP Subset 8 MP20 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Maestro PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP20 v2 1" (or v2 0) - OK/NOK - TVR byte 2 bit 8 = 0 (ICC & terminal have same application versions) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 185

MP20 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of tag 88. [TC011-1] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Track1 maximum. [TC011-4] To ensure that the PayPass terminal is able to print a cardholder receipt. [TC024-1] To ensure that a terminal has its application version number for PayPass - M/Chip set to 0002. [TC062] To ensure that Maestro PayPass terminals support No CVM for transactions less than or equal to the CVM Required Limit. [TC412] Terminal supports Maestro and receipt printing and the CVM Required Limit is greater than zero. The card returns the unknown tag 88 in PPSE response. The Track1 discretionary data (tag 9F1F ) has the maximum length (48 bytes). The card Application Version Number is set to 0002. Please use the following test card: M-TIP Subset 8 MP20 v2.0 or v2.1. Enter amount below the CVM Required Limit. If needed select the Maestro PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK - The terminal is able to print a cardholder receipt below the CVM Required Limit in case the cardholder requests it - OK/NOK log checks: - Application Label indicates "MP20 v2 1" (or v2 0) - OK/NOK - TVR byte 2 bit 8 = 0 (ICC & terminal have same application versions) - OK/NOK - TVR byte 3 bit 8 = 0 (cardholder verification successful) - OK/NOK - CVM result is '1F 03 00' or '1F 03 02' - OK/NOK 186 PayPass M-TIP Test Case User Guide 09 April 2013

MP20 Test 03 Scenario 01 To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of tag 88. [TC011-1] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Track1 maximum. [TC011-4] To ensure that a terminal has its application version number for PayPass - M/Chip set to 0002. [TC062] To ensure that Maestro PayPass terminals support No CVM for transactions less than or equal to the CVM Required Limit. [TC412] Terminal supports Maestro and not receipt printing and the CVM Required Limit is greater than zero. The card returns the unknown tag 88 in PPSE response. The Track1 discretionary data (tag 9F1F ) has the maximum length (48 bytes). The card Application Version Number is set to 0002. Please use the following test card: M-TIP Subset 8 MP20 v2.0 or v2.1. Enter amount below the CVM Required Limit. If needed select the Maestro PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP20 v2 1" (or v2 0) - OK/NOK - TVR byte 2 bit 8 = 0 (ICC & terminal have same application versions) - OK/NOK - TVR byte 3 bit 8 = 0 (cardholder verification successful) - OK/NOK - CVM result is '1F 03 00' or '1F 03 02' - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 187

MP4A Test 01 Scenario 01 To ensure the terminal correctly completes the transaction with a Mobile. Amount below the CVM Required Limit. [TC038-1] To ensure the PayPass terminal correctly manages the PayPass values in the existing authorization fields. [TC050-2] To ensure that a terminal transmits the Track2 Equivalent Data for a PayPass M/Chip transaction. Purchase with a mobile. [TC053-2] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55 (effective 1 April 2017).[TC054-2]To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-3] Terminal supports [PayPass3.0] and Maestro and is online capable. The terminal is such that the CVM Required Limit is greater than zero. The terminal is such that the Kernel indicates 'On-Device holder Verification supported' and the Contactless Transaction Limit (On-device CVM) is not zero. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). - A first transaction is performed where the card requests On-Device cardholder verification: Please use the following test card: M-TIP Subset 8 MP4A v1.0. Enter any amount below the CVM Required Limit and below the Contactless Transaction Limit (On-device CVM). If needed select the Maestro PayPass product. - A second transaction is performed where the Mobile indicates that the Mobile PIN was successfully verified: Please use the following test card: M-TIP Subset 8 MP4B v1.0. If needed, the transaction amount must be the same as in the previous transaction. If needed select the Maestro PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). 188 PayPass M-TIP Test Case User Guide 09 April 2013

Visual checks first transaction: - The terminal displays "Please see phone" (or equivalent) - OK/NOK log checks first transaction: - Application Label indicates "MP4A v1 0" - OK/NOK Visual checks second transaction: - The terminal approves the online transaction - OK/NOK log checks second transaction: - Application Label indicates "MP4B v1 0" - OK/NOK - In GenAC command, the CVM results value must be '3F 00 02' - OK/NOK Network simulator checks second transaction: The following data must be observed on the 0100 or 0200 message: - DE 22 SE subfield 1 = 07 (POS entry mode: contactless M/Chip) - OK/NOK - DE 23 = 001 (card sequence number) - OK/NOK - DE 35 contains 6799998900000060406D2512201012345678 (both D and = are acceptable separators) OK/NOK - DE 48 SE s23 value is '01' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required - The terminal sends a DE 55 message to the network - OK/NOK - DE 55 - PDSE 9F03 ('amount other') either contains '000000000000' or is not present - OK/NOK - DE 55 - PDSE 9F34 (CVM Results) must be present (effective 1 April 2017)** - Present/Not present/not required - DE 61 subfield SE 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK - Issuer simulator ARC = 00 (accepted) - OK/NOK *: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 SE 23), if present on the card or non-card form factor. **: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017 PayPass M-TIP Test Case User Guide 09 April 2013 189

MP4A Test 02 Scenario 01 To ensure the terminal correctly completes the transaction with a Mobile. Amount above the CVM Required Limit. [TC038-2] To ensure the PayPass terminal correctly manages the PayPass values in the existing authorization fields. [TC050-2] To ensure that a terminal transmits the Track2 Equivalent Data for a PayPass M/Chip transaction. Purchase with a mobile. [TC053-2] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55 (effective 1 April 2017).[TC054-2]To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-3] Terminal supports [PayPass3.0] and Maestro and is online capable. The terminal is such that the CVM Required Limit is lower than the Contactless Transaction Limit (On-device CVM). The terminal is such that the Kernel indicates 'On-Device holder Verification supported'. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). - A first transaction is performed where the card requests On-Device cardholder verification: Please use the following test card: M-TIP Subset 8 MP4A v1.0. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit (On-device CVM). If needed select the Maestro PayPass product. - A second transaction is performed where the Mobile indicates that the Mobile PIN was successfully verified: Please use the following test card: M-TIP Subset 8 MP4B v1.0. If needed, the transaction amount must be the same as in the previous transaction. If needed select the Maestro PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). 190 PayPass M-TIP Test Case User Guide 09 April 2013

Visual checks first transaction: - The terminal displays "Please see phone" (or equivalent) - OK/NOK log checks first transaction: - Application Label indicates "MP4A v1 0" - OK/NOK Visual checks second transaction: - The terminal approves the online transaction - OK/NOK log checks second transaction: - Application Label indicates "MP4B v1 0" - OK/NOK - In GenAC command, the CVM results value must be '01 00 02' - OK/NOK Network simulator checks second transaction: The following data must be observed on the 0100 or 0200 message: - DE 22 subfield 1 = 07 (POS entry mode: contactless M/Chip) - OK/NOK - DE 23 = 001 (card sequence number) - OK/NOK - DE 35 contains 6799998900000060406D2512201012345678 (both D and = are acceptable separators) OK/NOK - DE 48 SE 23 value is '01' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required - The terminal sends a DE 55 message to the network - OK/NOK - DE 55 SE 9F03 ('amount other') either contains '000000000000' or is not present - OK/NOK - DE 55 SE 9F34 (CVM Results) must be present (effective 1 April 2017)** - Present/Not present/not required - DE 61 subfield 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - ARQC is successfully validated by the simulator - OK/NOK - Issuer simulator ARC = 00 (accepted) - OK/NOK *: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 SE 23), if present on the card or non-card form factor. **: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017 PayPass M-TIP Test Case User Guide 09 April 2013 191

MP4A Test 03 Scenario 01 To ensure the terminal correctly completes the transaction with a Mobile. Amount below the CVM Required Limit. [TC038-1] Terminal supports [PayPass3.0] and Maestro and is offline-only. The terminal is such that the CVM Required Limit is greater than zero. The terminal is such that the Kernel indicates 'On-Device holder Verification supported' and the Contactless Transaction Limit (On-device CVM) is not zero. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). - A first transaction is performed where the card requests On-Device cardholder verification: Please use the following test card: M-TIP Subset 8 MP4A v1.0. Enter any amount below the CVM Required Limit and below the Contactless Transaction Limit (On-device CVM). If needed select the Maestro PayPass product. - A second transaction is performed where the Mobile indicates that the Mobile PIN was successfully verified: Please use the following test card: M-TIP Subset 8 MP4B v1.0. If needed, the transaction amount must be the same as in the previous transaction. If needed select the Maestro PayPass product. Visual checks first transaction: - The terminal displays "Please see phone" (or equivalent) - OK/NOK log checks first transaction: - Application Label indicates "MP4A v1 0" - OK/NOK Visual checks second transaction: - The terminal approves the offnline transaction - OK/NOK log checks second transaction: - Application Label indicates "MP4B v1 0" - OK/NOK - In GenAC command, the CVM results value must be '3F 00 02' - OK/NOK 192 PayPass M-TIP Test Case User Guide 09 April 2013

MP4A Test 04 Scenario 01 To ensure the terminal correctly completes the transaction with a Mobile. Amount above the CVM Required Limit. [TC038-2] Terminal supports [PayPass3.0] and Maestro and is offline-only. The terminal is such that the CVM Required Limit is lower than the Contactless Transaction Limit (On-device CVM). The terminal is such that the Kernel indicates 'On-Device holder Verification supported'. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). - A first transaction is performed where the card requests On-Device cardholder verification: Please use the following test card: M-TIP Subset 8 MP4A v1.0. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit (On-device CVM). If needed select the Maestro PayPass product. - A second transaction is performed where the Mobile indicates that the Mobile PIN was successfully verified: Please use the following test card: M-TIP Subset 8 MP4B v1.0. If needed, the transaction amount must be the same as in the previous transaction. If needed select the Maestro PayPass product. Visual checks first transaction: - The terminal displays "Please see phone" (or equivalent) - OK/NOK log checks first transaction: - Application Label indicates "MP4A v1 0" - OK/NOK Visual checks second transaction: - The terminal approves the offnline transaction - OK/NOK log checks second transaction: - Application Label indicates "MP4B v1 0" - OK/NOK - In GenAC command, the CVM results value must be '01 00 02' - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 193

MP4B Test 01 Scenario 01 To ensure the PayPass terminal correctly implements the Contactless Transaction Limit [TC061-1b] Terminal supports [PayPass3.0] and Maestro and is online capable. The terminal is such that it allows to enter amounts equal to the Contactless Transaction Limit (On-device CVM). The terminal is such that the Kernel indicates 'On-Device holder Verification supported'. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). Please use the following test card: M-TIP Subset 8 MP4B v1.0. Amount is equal to the Contactless Transaction Limit (On-device CVM). If needed select the Maestro PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "MP4B v1 0" - OK/NOK - Amount equals the Contactless Transaction Limit (On-device CVM) - OK/NOK 194 PayPass M-TIP Test Case User Guide 09 April 2013

MP4B Test 01 Scenario 02 To ensure the PayPass terminal correctly implements the Contactless Transaction Limit [TC061-1b] Terminal supports [PayPass3.0] and Maestro and is offline only. The terminal is such that it allows to enter amounts equal to the Contactless Transaction Limit (On-device CVM). The terminal is such that the Kernel indicates 'On-Device holder Verification supported'. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). Please use the following test card: M-TIP Subset 8 MP4B v1.0. Amount is equal to the Contactless Transaction Limit (On-device CVM). If needed select the Maestro PayPass product. - The terminal approves the offline transaction - OK/NOK log checks: - Application Label indicates "MP4B v1 0" - OK/NOK - Amount equals the Contactless Transaction Limit (On-device CVM) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 195

MP4B Test 02 Scenario 01 To ensure the PayPass terminal correctly implements the Contactless Transaction Limit [TC061-3b] Terminal supports [PayPass3.0] and Maestro. Terminal allows to enter amounts greater than the Contactless Transaction Limit (On Device CVM) and is unattended. The terminal is such that the Kernel indicates 'On-Device holder Verification supported'. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). Please use the following test card: M-TIP Subset 8 MP4B v1.0. - First step is to initialize the card log: Please run a successful transaction with any amount below the Contactless Transaction Limit (On-device CVM) and then ensure the transaction was correctly stored in the card log. - Second step is the test itself: Amount is equal to one minor unit above the Contactless Transaction Limit (On-device CVM) (e.g.:25.01 ). If needed select the Maestro PayPass product. Tap card on the PayPass reader even if it looks deactivatedand follow the instructions. - What amount did you enter in the first step transaction? - What amount did you enter in the second step transaction? log checks: - The card log for the second transaction is either empty or contains the log of the transaction performed at the first step (that is, the amount in the GenerateAC command is the amount used at the first step)* or contains a transaction that aborts after the last Read Record response - OK/NOK- Application Label indicates "MP4B v1 0" - OK/NOK - The terminal shall abort after the last ReadRecord response - OK/NOK *: In case the terminal does not activate the PayPass reader when the entered amount is above all the application Contactless Transaction Limits, the log will be: - empty, when the test tool stores a new log for each single transaction - the one from the previous transaction, when the test tool manages a unique log file. 196 PayPass M-TIP Test Case User Guide 09 April 2013

MP4B Test 03 Scenario 01 To ensure the terminal not supporting "On-device cardholder verification" correctly completes the transaction with a Mobile. [TC037] To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-2] Terminal supports Maestro and is online capable and does not support [PayPass3.0] or the "Kernel " indicates "On-device cardholder verification NOT supported" AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). Please use the following test card: M-TIP Subset 8 MP4B v1.0. Amount must be below the CVM Required Limit (if not zero). If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP4B v1 0" - OK/NOK Network simulator checks: - DE 48 SE 23 value is '01' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required *: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 SE 23), if present on the card or non-card form factor. PayPass M-TIP Test Case User Guide 09 April 2013 197

MP4B Test 04 Scenario 01 To ensure the terminal not supporting "On-device cardholder verification" correctly completes the transaction with a Mobile. [TC037] Terminal supports Maestro and is offline only and does not support [PayPass3.0] or the "Kernel " indicates "On-device cardholder verification NOT supported" AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). Please use the following test card: M-TIP Subset 8 MP4B v1.0. Amount must be below the CVM Required Limit. If needed select the Master PayPass product. - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP4B v1 0" - OK/NOK 198 PayPass M-TIP Test Case User Guide 09 April 2013

MP50 Test 01 Scenario 01 To ensure the terminal correctly completes the payment transaction when the card supports Data Storage.[TC026-1] Terminal supports Maestro and not IDS. The card requests the tags '9F5C' and '9F40' in the PDOL. The card returns the Application Capabilities Information '01 05 00' (DS version 1, field off request, CDA over AAC, Undefined SDS **). The card returns the DS ID. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). The card returns the DSDOL. Please use the following test card: M-TIP Subset 8 MP50 v1.0. Enter any amount below the CVM Required Limit (if not zero). If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP50 v1 0" - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 199

MP50 Test 02 Scenario 01 To ensure the terminal correctly completes the payment transaction when the card supports Data Storage.[TC026-3] Terminal supports Maestro and IDS. The card requests the tags '9F5C' and '9F40' in the PDOL. The card returns the Application Capabilities Information '01 05 00' (DS version 1, field off request, CDA over AAC, Undefined SDS **). The card returns the DS ID. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is set ("EMV supported"). The card returns the DSDOL. Whatever the DS Requested Operator ID provided in the GetPO command, the card returns AIP, AFL, '9F5F 01 40' (volatile slot), '9F7F' (DS Unpredictable Number), '9F7D 08 00 00' (DS Summary 1). When the GenAC command includes the DSDOL data then Summary2 and Summary3 are included in the SDAD. Summary2=Summary1. Summary3<>Summary2. Please use the following test card: M-TIP Subset 8 MP50 v1.0. Enter any amount below the CVM Required Limit (if not zero). If needed select the Master PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - Application Label indicates "MP50 v1 0" - OK/NOK - In the GetPO response, the card returns AIP, AFL, '9F5F 01 40' (volatile slot), '9F7F' (DS Unpredictable Number), '9F7D 08 00 00' (DS Summary 1) - OK/NOK 200 PayPass M-TIP Test Case User Guide 09 April 2013

MP71 Test 01 Scenario 01 To ensure the PayPass terminal correctly manages the extended AIDs. Case of AID extended with D056 02. [TC065-1] Terminal supports Maestro. The Maestro application has an extended AID A0 00 00 00 04 30 60 D056 02. Please use the following test card: M-TIP Subset 8 MP71 v2.0 or v2.1. Enter amount below the CVM Required Limit (if not zero). If needed select the Maestro PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - The terminal selects the AID A0 00 00 00 04 30 60 D056 02 - OK/NOK - Application Label indicates "MP71 v2 1" (or v2 0) - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 201

MP72 Test 01 Scenario 01 To ensure the PayPass terminal correctly manages the extended AIDs. Case of AID extended with C12345 6789. [TC065-2] Terminal supports Maestro and is offline-only. The Maestro application has an extended AID A0 00 00 00 04 30 60 C12345 6789. Please use the following test card: M-TIP Subset 8 MP72 v2.0 or v2.1. Enter any amount below the CVM Required Limit. If needed select the Maestro PayPass product. log checks: - The terminal selects the AID A0 00 00 00 04 30 60 C12345 6789 - OK/NOK - Application Label indicates "MP72 v2 1" (or v2 0) - OK/NOK - The terminal requests a TC or an AAC* - OK/NOK * the terminal will decline as per the TAC settings in case it does not support SDA. MP72 Test 02 Scenario 01 To ensure the PayPass terminal correctly manages the extended AIDs. Case of AID extended with C12345 6789. [TC065-2] Terminal supports Maestro and is online capable. The card has an extended AID A0 00 00 00 04 30 60 C12345 6789. Please use the following test card: M-TIP Subset 8 MP72 v2.0 or v2.1. Enter any amount below the CVM Required Limit (if not zero). If needed select the Maestro PayPass product. In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the offline or online transaction - OK/NOK log checks: - The terminal selects the AID A0 00 00 00 04 30 60 C12345 6789 - OK/NOK - Application Label indicates "MP72 v2 1" (or v2 0) - OK/NOK 202 PayPass M-TIP Test Case User Guide 09 April 2013

MP91 Test 01 Scenario 01 To ensure the PayPass terminal correctly behaves when the card does not support any offline data authentication method. Amount below the Floor Limit and the CVM Required Limit. [TC001-1a] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. [TC011-11] To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-1] Terminal supports Maestro and is offline and online capable. The returned AIP indicates that SDA and CDA are not supported. The card returns the PayPass Third Party data ( 9F6E ) with length 32. The card returns a Third Party Data indicating a device type 'card'. Please use the following test card: M-TIP Subset 8 MP91 v2.2. Enter any amount below the Floor Limit and below the CVM Required Limit. If needed select the Maestro PayPass product. The network simulator validates the authorization message (not the ARQC) and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates MP91 v2 2 - OK/NOK - Amount must be below the Floor Limit - OK/NOK - The terminal requests an ARQC - OK/NOK - TVR byte 1 bit 8 = 1 (ODA not performed) - OK/NOK Network simulator checks: - DE 48 SE 23 value is '00' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required *: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 SE 23), if present on the card or non-card form factor. PayPass M-TIP Test Case User Guide 09 April 2013 203

MP91 Test 02 Scenario 01 To ensure the PayPass terminal correctly behaves when the card does not support any offline data authentication method. Amount above the Floor Limit. [TC001-2] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. [TC011-11] To ensure the PayPass terminal transmits transaction mandatory data to the network even if it is not requested by the card in the CDOL1. [TC046] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55 [TC054-3] To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-1] Terminal supports Maestro and is online capable. The Floor Limit is lower than the Contactless Transaction Limit. The CVM Required Limit equals the Contactless Transaction Limit. The returned AIP indicates that SDA and CDA are not supported. The card returns the PayPass Third Party data ( 9F6E ) with length 32. The card does not request Terminal Country Code (tag 9F1A ), Transaction Date (tag 9A ), Transaction Type (tag 9C ), Transaction Currency Code (tag 5F2A ) and CVM Results (tag '9F34') in the CDOL1. The card returns a Third Party Data indicating a device type 'card'. Please use the following test card: M-TIP Subset 8 MP91 v2.2. Enter any amount above the Floor Limit and below the Contactless Transaction Limit. If needed select the Maestro PayPass product. If needed, PIN value is 4315. The network simulator validates the authorization message (not the ARQC) and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "MP91 v2 2" - OK/NOK - Amount is above the Floor Limit - OK/NOK - TVR byte 1 bit 8 = 1 (ODA not performed) - OK/NOK Network simulator checks: - DE 48 SE 23 value is '00' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required - DE 55 SE 5F2A (Transaction Currency Code) is present and value is correct - OK/NOK - DE 55 SE 9A (Transaction Date) is present and value is correct - OK/NOK - DE 55 SE 9C (Transaction Type) value is '00' (goods and services) - OK/NOK - DE 55 SE 9F1A (Terminal Country Code) is present and value is correct - OK/NOK - DE 55 SE 9F34 (CVM Result) is present in the authorization message (effective 1 April 2017)** - Present/Not present/not required 204 PayPass M-TIP Test Case User Guide 09 April 2013

*: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 SE 23), if present on the card or non-card form factor **: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017. PayPass M-TIP Test Case User Guide 09 April 2013 205

MP91 Test 03 Scenario 01 To ensure the PayPass terminal correctly behaves when the card does not support any offline data authentication method. Amount above the Floor Limit. [TC001-2] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. [TC011-11] To ensure the PayPass terminal transmits transaction mandatory data to the network even if it is not requested by the card in the CDOL1. [TC046] To ensure the PayPass terminal correctly transmits the CVM Results in the authorization message containing DE 55 [TC054-3] To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-1] Terminal supports Maestro and is online capable and the CVM Required Limit is lower than the Contactless Transaction Limit. The returned AIP indicates that SDA and CDA are not supported. The card returns the PayPass Third Party data ( 9F6E ) with length 32. The card does not request Terminal Country Code (tag 9F1A ), Transaction Date (tag 9A ), Transaction Type (tag 9C ), Transaction Currency Code (tag 5F2A ) and CVM Results (tag '9F34') in the CDOL1. The card returns a Third Party Data indicating a device type 'card'. Please use the following test card: M-TIP Subset 8 MP91 v2.2. Amount must be above the CVM Required Limit and below the Contactless Transaction Limit*. If needed select the Maestro PayPass product. PIN value is 4315. The network simulator validates the authorization message (not the ARQC) and returns the response 00 (accepted). 206 PayPass M-TIP Test Case User Guide 09 April 2013

- Terminal asks to enter PIN OK/NOK - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "MP91 v2 2" - OK/NOK - Amount is above the CVM Required Limit - OK/NOK - TVR byte 1 bit 8 = 1 (ODA not performed) - OK/NOK - TVR byte 3 bit 3 = 1 (Online PIN entered) OK/NOK - TVR byte 3 bit 8 = 0 (holder verification was successful) OK/NOK Network simulator checks: - DE 48 SE 23 value is '00' (effective 19 April 2013 in US region and 18 October 2013 in Canada)** - OK/NOK/Not required - DE 55 SE 5F2A (Transaction Currency Code) is present and value is correct - OK/NOK - DE 55 SE 9A (Transaction Date) is present and value is correct - OK/NOK - DE 55 SE 9C (Transaction Type) value is '00' (goods and services) or '01' (cash ATM) - OK/NOK - DE 55 SE 9F1A (Terminal Country Code) is present and value is correct - OK/NOK - DE 55 SE 9F34 (CVM Result) is present in the authorization message (effective 1 April 2017)*** - Present/Not present/not required *: if the terminal supports [PayPass2.x] you must consider the limit mentioned in the M- TIP Questionnaire, NOT the one personalized in the PayPass reader. Both values are indeed different in [PayPass2.x] terminals. **: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 SE 23), if present on the card or non-card form factor. ***: Acquirers must include the CVM Results (tag 9F34 ) in all authorization messages containing DE 55 effective 1 April 2017. PayPass M-TIP Test Case User Guide 09 April 2013 207

MP91 Test 04 Scenario 01 To ensure the PayPass terminal correctly behaves when the card does not support any offline data authentication method. Case of offline-only terminal. [TC001-3] Terminal supports Maestro and is offline-only. The returned AIP indicates that SDA and CDA are not supported. Please use the following test card: M-TIP Subset 8 MP91 v2.2. Enter any amount below the Contactless Transaction Limit. If needed select the Maestro PayPass product. log checks: - Application Label indicates "MP91 v2 2" - OK/NOK - TVR byte 1 bit 8 = 1 (ODA not performed) - OK/NOK - The terminal requests an AAC - OK/NOK MP92 Test 01 Scenario 01 To ensure that the terminal terminates the transaction if the PayPass Maestro card indicates that it does not support PayPass M/Chip. [TC401] Terminal supports Maestro. The card indicates in the AIP that it does not support PayPass M/Chip. Please use the following test card: M-TIP Subset 8 MP92 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Maestro PayPass product. log checks: - Application Label indicates "MP92 v2 1" (or v2 0) - OK/NOK - The terminal terminates the transaction upon reception of the GetPO response - OK/NOK 208 PayPass M-TIP Test Case User Guide 09 April 2013

MP94 Test 01 Scenario 01 To ensure the offline-only PayPass terminal correctly behaves when the card erroneously sends an ARQC. [TC005] Terminal supports Maestro and is offline-only. The cards always returns an ARQC. Please use the following test card: M-TIP Subset 8 MP94 v2.0 or v2.1. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. - The terminal terminates the transaction - OK/NOK log checks: - Application Label indicates "MP94 v2 1" (or v2 0) - OK/NOK - The card returns an ARQC - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 209

Combo01 Test 11 Scenario 01 To ensure the terminal always selects the highest priority application without cardholder assistance. [TC070-4] Terminal supports Maestro and not Master. contains 2 applications returned in the following order: Maestro, priority 03 Master, priority 02 Please use the following test card: M-TIP Subset 8 Combo01 v1.0. Enter any amount below the CVM Required Limit (if not zero). In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - The terminal automatically selects the Maestro application - OK/NOK - Application Label indicates "Combo01 v1 0" - OK/NOK 210 PayPass M-TIP Test Case User Guide 09 April 2013

Combo11 Test 11 Scenario 01 To ensure the terminal always selects the highest priority application without cardholder assistance. [TC070-2] Terminal supports Maestro and not IDS contains 2 applications returned in the following order: Master, priority 15 Maestro, priority 06 Please use the following test card: M-TIP Subset 8 Combo11 v1.0. Enter any amount below the CVM Required Limit (if not zero). In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - The terminal automatically selects the Maestro application - OK/NOK - Application Label indicates "Combo11 v1 0" - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 211

Combo11 Test 12 Scenario 01 To ensure the terminal correctly completes the payment transaction when the card supports Data Storage. Case of slot not available. [TC026-2] To ensure the terminal always selects the highest priority application without cardholder assistance. [TC070-2] Terminal supports Maestro and IDS contains 2 applications returned in the following order: Master, priority 15 Maestro, priority 06 Whatever the DS Requested Operator ID (different from zero) provided in the GetPO command, the card returns AIP, AFL, '9F5F 01 00' ("no slot available"). Please use the following test card: M-TIP Subset 8 Combo11 v1.0. Enter any amount below the CVM Required Limit (if not zero). In case of online transaction, the network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the transaction - OK/NOK log checks: - The terminal automatically selects the Maestro application - OK/NOK - Application Label indicates "Combo11 v1 0" - OK/NOK - The card returns '9F5F 01 00' ("no slot available") in the GetPO response - OK/NOK 212 PayPass M-TIP Test Case User Guide 09 April 2013

Test Scenarios for M-TIP Subset 6 5 Test Scenarios for M-TIP Subset 6 This chapter lists the PayPass Mag Stripe M-TIP Test Scenarios. that the Subset 6 is also used during Network Interface Validation (NIV) tests of PayPass Mag Stripe terminals. However the current document is M-TIP focused so the Subset 6 will sometimes be referred to as "M-TIP Subset 6". 5.1 M-TIP Subset 6 card details PINs Below are the M-TIP Subset 6 card details: Name version PIN ID 351 / MCC 351 v1.0 or v1.1 5001 ID 352 / MCC 352 v1.0 or v1.1 7584 ID 353 / MCC 353 v1.2 6614 ID 354 / MCC 354 v1.0 or v1.1 8024 ID 355 / MCC 355 v1.0 or v1.1 7815 ID 356 / MCC 356 v1.0 or v1.1 1045 ID 371A / MCC 371A v1.0 3718 ID 371B / MCC 371B v1.0 3718 ID 372 / MCC 372 v1.0 ID 373 / MCC 373 v1.0 ID 374 / MCC 374 v1.0 ID 406 / MCC 406 v1.2 8045 PayPass M-TIP Test Case User Guide 09 April 2013 213

Test Scenarios for M-TIP Subset 6 5.2 Using the Test s ID 356 (or MCC 356) This card ensures that the terminal correctly includes the ATC value in the calculation of the PayPass Track1 and Track2. Three ATC values are possible on this card. Each ATC value is linked to a readrecord and a CVC3 value. Tool providers may implement 3 different cards to meet this objective. Other tool providers may implement a single card supporting only 3 ATC values. If so the ATC values would increment according to the round-robin principle. Therefore the fourth transaction will be the same as the first one. Transaction #1 (ATC#1, record#1, CVC3#1) Transaction #2 (ATC#2, record#2, CVC3#2) Transaction #3 (ATC#3, record#3, CVC3#3) Figure 1: ID 356 increments according to round-robin principle 5.3 Test Scenario Template Description Please see "Test Scenarios for M-TIP Subset 6" above. 214 PayPass M-TIP Test Case User Guide 09 April 2013

Test Scenarios for M-TIP Subset 6 5.4 Test Scenarios for PayPass Mag Stripe PayPass M-TIP Test Case User Guide 09 April 2013 215

Test Scenarios for M-TIP Subset 6 ID 351 Test 01 Scenario 01 To ensure the PayPass terminal correctly manages PayPass values in the existing authorization fields. Case of PayPass Mag Stripe. [TC050-1] To ensure the PayPass terminal correctly performs refund. Case of PayPass Mag Stripe. [TC025-3] To ensure that the terminal correctly completes the PayPass Mag Stripe transaction whatever the Service Code value encoded in the card. Case of 101. [TC611-1] Terminal supports PayPass Master and supports refund. Service Code: '101' (international, MagStripe-only, no restrictions). - First step is to perform the purchase: Please use the following test card: M-TIP Subset 6 ID 351 (or MCC 351) v1.0 or v1.1. Enter amount below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 5001. After this test, provide information displayed on the receipt or on the LCD/LED display. - Second step is to perform the refund: Please use the following test card: M-TIP Subset 6 ID 351 (or MCC 351) v1.0 or v1.1. If requested, the refund amount must be the same as the purchase amount. If needed select the Master PayPass product. The network simulator returns the response 00 (accepted). Visual checks first step (purchase): - The terminal approves the online transaction - OK/NOK Network simulator checks first step (purchase): The following data must be observed on the 0100 or 0200 message: - DE 22 subfield 1 = 91 (POS entry mode: contactless Mag stripe) - OK/NOK - DE 61 subfield 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value: - Track 1: B5413330056003511^CUST IMP MC 351/^1412101067750500 OK/NOK/Not Applicable - Track 2: 5413330056003511D1412101067750500 (both D and = are acceptable separators) OK/NOK/ Not Applicable Visual checks second step (refund): - At the end of the refund process, the terminal displays a message to inform the cardholder that refund has been done successfully - OK/NOK 216 PayPass M-TIP Test Case User Guide 09 April 2013

Test Scenarios for M-TIP Subset 6 ID 351 Test 02 Scenario 01 To ensure the PayPass terminal correctly manages PayPass values in the existing authorization fields. Case of PayPass Mag Stripe. [TC050-1] To ensure that the terminal correctly completes the PayPass Mag Stripe transaction whatever the Service Code value encoded in the card. Case of 101. [TC611-1] Terminal supports PayPass Master and does not support refund. Service Code: '101' (international, MagStripe-only, no restrictions). Please use the following test card: M-TIP Subset 6 ID 351 (or MCC 351) v1.0 or v1.1. Enter amount below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 5001. At the end of this test, provide information displayed on the transaction receipt or on the LCD/LED display. The network simulator returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK Network simulator checks: The following data must be observed on the 0100 or 0200 message: - DE 22 subfield 1 = 91 (POS entry mode: contactless Mag stripe) - OK/NOK - DE 61 subfield 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value as shown below: - Track 1: B5413330056003511^CUST IMP MC 351/^1412101067750500 OK/NOK/Not Applicable - Track 2: 5413330056003511D1412101067750500 (both D and = are acceptable separators) OK/NOK/ Not Applicable PayPass M-TIP Test Case User Guide 09 April 2013 217

Test Scenarios for M-TIP Subset 6 ID 351 Test 03 Scenario 01 To ensure the terminal still performs correctly a traditional Mag Stripe transaction when it contains or is connected to a PayPass reader. [TC614] Terminal supports Master and traditional Mag Stripe. Service Code: '101' (international, MagStripe-only, no restrictions). Please use the following test card: M-TIP Subset 6 ID 351 (or MCC 351) v1.0 or v1.1. Enter amount below the Contactless Transaction Limit. If needed select the Master PayPass product. Swipe card in the terminal and follow the instructions. If needed, PIN value is 5001. At the end of this test, provide information displayed on the transaction receipt or on the LCD/LED display. The network simulator returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK Network simulator checks: The following data must be observed on the 0100 or 0200 message: - DE 22 subfield 1 = 90 (POS entry mode: traditional Mag stripe) - OK/NOK - DE 61 subfield 11 = 2 or '3' or 5 or 7 or 8 (card data terminal input capability: traditional Mag stripe) - OK/NOK - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value as shown below: - Track 1: B5413330056003511^CUST IMP MC 351/^1412101000000000 OK/NOK/Not Applicable - Track 2: 5413330056003511D1412101000000000 (both D and = are acceptable separators) OK/NOK/ Not Applicable 218 PayPass M-TIP Test Case User Guide 09 April 2013

Test Scenarios for M-TIP Subset 6 ID 352 Test 01 Scenario 01 To ensure the PayPass terminal correctly manages PayPass values in the existing authorization fields. Case of PayPass Mag Stripe. [TC050-1] To ensure that the terminal correctly completes the PayPass Mag Stripe transaction whatever the Service Code value encoded in the card. Case of 205. [TC611-2] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Track1 and Track2 having maximum length. [TC601-1 and 2] To ensure that a terminal processes Track 1 Data as Track 1 and Track 2 Data as Track 2 during PayPass - Mag Stripe transactions. [TC615] Terminal supports PayPass Master. Service Code: '205' (international, chip, PIN required). Please use the following test card: M-TIP Subset 6 ID 352 (or MCC 352) v1.0 or v1.1. Amount must be equal to 000000000100 or 000000010000. If needed select the Master PayPass product. If needed, PIN value is 7584. At the end of this test, provide information displayed on the transaction receipt or on the LCD/LED display. The network simulator returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK Network simulator checks: The following data must be observed on the 0100 or 0200 message: - DE 22 subfield 1 = 91 (POS entry mode: contactless Mag stripe) - OK/NOK - DE 61 subfield 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value as shown below: - Track 1: B5413330056003529^CUST IMP MC 352/^14122059900909900000099909909969929990400 OK/NOK/Not Applicable - Track 2: 5413330056003529D14122059999999469960 (both D and = are acceptable separators) OK/NOK/ Not Applicable PayPass M-TIP Test Case User Guide 09 April 2013 219

Test Scenarios for M-TIP Subset 6 ID 352 Test 02 Scenario 01 To ensure the PayPass terminal correctly manages the Issuer response 51 (Insufficient funds/over credit limit). [TC613] Terminal supports PayPass Master. Service Code: '205' (international, chip, PIN required). Please use the following test card: M-TIP Subset 6 ID 352 (or MCC 352) v1.0 or v1.1. Amount must be equal to 000000000200 or 000000020000. If needed select the Master PayPass product. If needed, PIN value is 7584. At the end of this test, provide information displayed on the transaction receipt or on the LCD/LED display. The network simulator returns the response 51 (Insufficient funds/over credit limit). - The terminal declines the online transaction - OK/NOK Network simulator checks: - response is 51 (insufficient funds) - OK/NOK PayPass terminals should prompt for a contact transaction when a PayPass transaction is declined by the card, terminal, or issuer, or if it fails to complete for any other reason other than a communication error. [PPReq2011] page 4-15 220 PayPass M-TIP Test Case User Guide 09 April 2013

Test Scenarios for M-TIP Subset 6 ID 353 Test 01 Scenario 01 To ensure the PayPass terminal correctly manages PayPass values in the existing authorization fields. Case of PayPass Mag Stripe. [TC050-1] To ensure that the terminal correctly completes the PayPass Mag Stripe transaction whatever the Service Code value encoded in the card. Case of 502. [TC611-3] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Track1 and Track2 having minimum discretionary data length. [TC601-3 and 4] To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-4] To ensure the PayPass terminal correctly behaves when the cardholder name is not fully populated in the Track 1. [TC616] Terminal supports PayPass Master. Service Code: '502' (domestic, MagStripe-only, goods & services only). Track1 and Track2 have minimum discretionary data length. The holder Name value returned in the Track1 data object is " /". The Third Party Data item bytes 5 and 6 indicate a device type 'tag'. Please use the following test card: M-TIP Subset 6 ID 353 (or MCC 353) v1.2. Enter amount below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is '6614'. At the end of this test, provide information displayed on the transaction receipt or on the LCD/LED display. The network simulator returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "ID353 v1 2" or "MCC353 v1 2" - OK/NOK Network simulator checks: The following data must be observed on the 0100 or 0200 message: - DE 22 subfield 1 = 91 (POS entry mode: contactless Mag stripe) - OK/NOK - DE 48 SE 23 value is '04' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK /Not required - DE 61 subfield 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value as shown below: - Track 1: B5413330056003537^ /^2512502980 OK/NOK/Not Applicable - Track 2: 5413330056003537D2512502050 (both D and = are acceptable separators) OK/NOK/ Not Applicable *: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 SE 23), if present on the card or non-card form factor. PayPass M-TIP Test Case User Guide 09 April 2013 221

Test Scenarios for M-TIP Subset 6 ID 355 Test 01 Scenario 01 To ensure the PayPass terminal correctly manages PayPass values in the existing authorization fields. Case of PayPass Mag Stripe. [TC050-1] To ensure that the terminal correctly completes the PayPass Mag Stripe transaction whatever the Service Code value encoded in the card. Case of 817. [TC611-4] To ensure the PayPass terminal correctly behaves when it receives uncommon data value or length from the card. Case of Track1 and Track2 having maximum length. [TC601-1 and 2] Terminal supports PayPass Master. Service Code: '817' (unknown). Please use the following test card: M-TIP Subset 6 ID 355 (or MCC 355) v1.0 or v1.1. Enter amount below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 7815. At the end of this test, provide information displayed on the transaction receipt or on the LCD/LED display. The network simulator returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK Network simulator checks: The following data must be observed on the 0100 or 0200 message: - DE 22 subfield 1 = 91 (POS entry mode: contactless Mag stripe) - OK/NOK - DE 61 subfield 11 = 3 (card data terminal input capability: contactless M/Chip) - OK/NOK - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value as shown below: - Track 1: B5413330056003552^CUST IMP MC 355/^14128179099969999999999999999959927899990 OK/NOK/Not Applicable - Track 2: 5413330056003552D14128179999099999900 (both D and = are acceptable separators) OK/NOK/ Not Applicable 222 PayPass M-TIP Test Case User Guide 09 April 2013

Test Scenarios for M-TIP Subset 6 ID 356 Test 01 Scenario 01 To ensure that the terminal correctly copies the ATC in the PayPass Track 1 and/or Track 2 and pass the values to the network. [TC612] Terminal supports PayPass Master. The card ATC increments following the round-robin principle: 0001, 0002, 0003, 0001, 0002 etc You can observe the ATC value in the 'cardholder name' subfield of Track 1 data: CUST IMP MC 356/ [ATC value]. Please use the following test card: M-TIP Subset 6 ID 356 (or MCC 356) v1.0 or v1.1. Enter amount below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 1045. This transaction will be performed three times. At the end of this test, provide information displayed on the transaction receipt or on the LCD/LED display. The network simulator returns the response 00 (accepted). - The terminal approves the 3 online transactions - OK/NOK Network simulator checks: The network simulator shall receive three sets of Track 1 and/or Track 2 data, not necessarily in the order shown below. For one of the transactions, the values shall be: - Track 1: B5413330056003560^CUST IMP MC 356/ 1^141210100000170099909919769790 OK/NOK/Not Applicable - Track 2: 5413330056003560D14121010000066010 (both D and = are acceptable separators) OK/NOK/Not Applicable For one of the transactions, the values shall be: - Track 1: B5413330056003560^CUST IMP MC 356/ 2^141210100300009900276999009990 OK/NOK/Not Applicable - Track 2: 5413330056003560D14121019090298920 (both D and = are acceptable separators) OK/NOK/Not Applicable For one of the transactions, the values shall be: - Track 1: B5413330056003560^CUST IMP MC 356/ 3^141210100990399049909990599320 OK/NOK/Not Applicable - Track 2: 5413330056003560D14121010109743970 (both D and = are acceptable separators) OK/NOK/Not Applicable PayPass M-TIP Test Case User Guide 09 April 2013 223

Test Scenarios for M-TIP Subset 6 ID371A Test 01 Scenario 01 To ensure the terminal not supporting [PayPass3.0] correctly completes the Mag-Stripe transaction with a Mobile. [TC681] To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-2] Terminal supports Master PayPass and does not support [PayPass3.0] AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). The device returns the UDOL requesting the MSI tag in addition of the Unpredictable Number. Please use the following test card: M-TIP Subset 6 ID 371A (or MCC 371A) v1.0. Enter any amount below the Contactless Transaction Limit. If needed select the Master PayPass product. If needed, PIN value is 3718. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "ID371A v1 0" or "MCC371A v1 0" - OK/NOK Network simulator checks: - DE 48 SE 23 value is '01' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value: - Track 1: B5413330056003719^CUST IMP MC 371A/^2512106067750680 OK/NOK/Not Applicable - Track 2: 5413330056003719D2512106067750570 (both D and = are acceptable separators) OK/NOK/ Not Applicable *: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 SE 23), if present on the card or non-card form factor. 224 PayPass M-TIP Test Case User Guide 09 April 2013

Test Scenarios for M-TIP Subset 6 ID371A Test 02 Scenario 01 To ensure the [PayPass3.0] terminal correctly completes the Mag-Stripe transaction with a Mobile not requesting On-Device cardholder verification below the CVM Required Limit. [TC682-1] Terminal supports Master PayPass and [PayPass3.0]. The terminal is such that the CVM Required Limit is greater than zero. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). The device returns the UDOL requesting the MSI tag in addition of the Unpredictable Number. Please use the following test card: M-TIP Subset 6 ID 371A (or MCC 371A) v1.0. Enter any amount below the CVM Required Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "ID371A v1 0" or "MCC371A v1 0" - OK/NOK Network simulator checks: - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value: - Track 1: B5413330056003719^CUST IMP MC 371A/^2512106067750680 OK/NOK/Not Applicable - Track 2: 5413330056003719D2512106067750570 (both D and = are acceptable separators) OK/NOK/ Not Applicable PayPass M-TIP Test Case User Guide 09 April 2013 225

Test Scenarios for M-TIP Subset 6 ID371A Test 03 Scenario 01 To ensure the terminal correctly completes the Mag-Stripe transaction with a Mobile requesting On-Device cardholder verification. [TC683-1] To ensure the terminal correctly completes the Mag-Stripe transaction with a Mobile indicating 'PIN verification successful'. [TC684-1] Terminal supports Master PayPass and [PayPass3.0]. The terminal is such that the CVM Required Limit is lower than the Contactless Transaction Limit (On-device CVM). The terminal is such that the Kernel indicates 'On-Device holder Verification supported'. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). - A first transaction is performed where the card requests On-Device cardholder verification: Please use the following test card: M-TIP Subset 6 ID 371A (or MCC 371A) v1.0. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit (On-device CVM). If needed select the Master PayPass product. - A second transaction is performed where the card indicates that the Mobile PIN was successfully verified: Please use the following test card: M-TIP Subset 6 ID 371B (or MCC 371B) v1.0. If needed, the transaction amount must be the same as in the previous transaction. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). Visual checks first transaction: - The terminal displays "Please see phone" (or equivalent) - OK/NOK log checks first transaction: - Application Label indicates "ID371A v1 0" or "MCC371A v1 0" - OK/NOK Visual checks second transaction: - The terminal approves the online transaction - OK/NOK log checks second transaction: - Application Label indicates "ID371B v1 0" or "MCC371B v1 0" - OK/NOK Network simulator checks second transaction: - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value: - Track 1: B5413330056003719^CUST IMP MC 371B/^2512106067750935 OK/NOK/Not Applicable - Track 2: 5413330056003719D2512106067750835 (both D and = are acceptable separators) OK/NOK/ Not Applicable 226 PayPass M-TIP Test Case User Guide 09 April 2013

Test Scenarios for M-TIP Subset 6 ID371A Test 04 Scenario 01 To ensure the [PayPass3.0] terminal correctly completes the Mag-Stripe transaction with a Mobile not requesting On-Device cardholder verification. [TC682-2] Terminal supports Master PayPass and [PayPass3.0]. The terminal is such that the CVM Required Limit is lower than the Contactless Transaction Limit. The terminal is such that Kernel indicates 'On-Device holder Verification NOT supported'. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). Please use the following test card: M-TIP Subset 6 ID 371A (or MCC 371A) v1.0. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "ID371A v1 0" or "MCC371A v1 0" - OK/NOK Network simulator checks: - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value: - Track 1: B5413330056003719^CUST IMP MC 371A/^2512106067750680 OK/NOK/Not Applicable - Track 2: 5413330056003719D2512106067750570 (both D and = are acceptable separators) OK/NOK/ Not Applicable PayPass M-TIP Test Case User Guide 09 April 2013 227

Test Scenarios for M-TIP Subset 6 ID371B Test 01 Scenario 01 To ensure the terminal correctly completes the Mag-Stripe transaction with a Mobile indicating 'PIN verification successful'. [TC684-1] Terminal supports Master PayPass and [PayPass3.0]. The terminal is such that the CVM Required Limit is lower than the Contactless Transaction Limit. The terminal is such that Kernel indicates 'On-Device holder Verification NOT supported'. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). Please use the following test card: M-TIP Subset 6 ID 371B (or MCC 371B) v1.0. Enter any amount above the CVM Required Limit and below the Contactless Transaction Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "ID371B v1 0" or "MCC371B v1 0" - OK/NOK Network simulator checks: - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value: - Track 1: B5413330056003719^CUST IMP MC 371B/^2512106067750935 OK/NOK/Not Applicable - Track 2: 5413330056003719D2512106067750835 (both D and = are acceptable separators) OK/NOK/ Not Applicable 228 PayPass M-TIP Test Case User Guide 09 April 2013

Test Scenarios for M-TIP Subset 6 ID371B Test 02 Scenario 01 To ensure the terminal correctly completes the Mag-Stripe transaction with a Mobile indicating 'PIN verification successful'. [TC684-1] Terminal supports Master PayPass and [PayPass3.0]. The terminal is such that the CVM Required Limit equals the Contactless Transaction Limit (On-device CVM). Both limits are greater than zero. AIP byte 1 bit 2 is set ("On-device cardholder verification supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). Please use the following test card: M-TIP Subset 6 ID 371B (or MCC 371B) v1.0. Enter any amount below the Contactless Transaction Limit (On-device CVM). If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "ID371B v1 0" or "MCC371B v1 0" - OK/NOK Network simulator checks: - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value: - Track 1: B5413330056003719^CUST IMP MC 371B/^2512106067750935 OK/NOK/Not Applicable - Track 2: 5413330056003719D2512106067750835 (both D and = are acceptable separators) OK/NOK/ Not Applicable PayPass M-TIP Test Case User Guide 09 April 2013 229

Test Scenarios for M-TIP Subset 6 ID372 Test 01 Scenario 01 To ensure the terminal correctly transmits the Device Type data element in the authorization message, if supported. [TC055-3] To ensure the [PayPass3.0] terminal correctly completes the Mag-Stripe transaction with a Mobile not requesting On-Device cardholder verification. [TC682-3] Terminal supports Master PayPass and [PayPass3.0]. AIP byte 1 bit 2 is NOT set ("On-device cardholder verification NOT supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). Please use the following test card: M-TIP Subset 6 ID 372 (or MCC 372) v1.0. Enter any amount below the Contactless Transaction Limit (On-device CVM). If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "ID372 v1 0" or "MCC372 v1 0" - OK/NOK Network simulator checks: - DE 48 SE 23 value is '01' (effective 19 April 2013 in US region and 18 October 2013 in Canada)* - OK/NOK/Not required - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value: - Track 1: B5413330056003727^CUST IMP MC 372/^2512101067750730 OK/NOK/Not Applicable - Track 2: 5413330056003727D2512101067750950 (both D and = are acceptable separators) OK/NOK/ Not Applicable *: U.S. region acquirers (effective 19 April 2013) and Canada acquirers (effective 18 October 2013) must transmit the device type indicator value (DE 48 SE 23), if present on the card or non-card form factor. 230 PayPass M-TIP Test Case User Guide 09 April 2013

Test Scenarios for M-TIP Subset 6 ID373 Test 01 Scenario 01 To ensure the terminal correctly completes the Mag-Stripe transaction with a Mobile requesting On-Device cardholder verification. [TC683-2] Terminal supports Master PayPass and [PayPass3.0]. The terminal is such that the CVM Required Limit is greater than zero. AIP byte 1 bit 2 is NOT set ("On-device cardholder verification NOT supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). Please use the following test card: M-TIP Subset 6 ID 373 (or MCC 373) v1.0. Enter any amount below the CVM Required Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal displays "Please see phone" (or equivalent) - OK/NOK log checks: - Application Label indicates "ID373 v1 0" or "MCC373 v1 0" - OK/NOK ID373 Test 02 Scenario 01 To ensure the terminal correctly completes the Mag-Stripe transaction with a Mobile requesting On-Device cardholder verification. [TC683-3] Terminal supports Master PayPass and [PayPass3.0]. The terminal is such that the CVM Required Limit is zero. AIP byte 1 bit 2 is NOT set ("On-device cardholder verification NOT supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). Please use the following test card: M-TIP Subset 6 ID 373 (or MCC 373) v1.0. Enter any amount below the Contactless Transaction Limit (On-device CVM). If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal displays "Please see phone" (or equivalent) - OK/NOK log checks: - Application Label indicates "ID373 v1 0" or "MCC373 v1 0" - OK/NOK PayPass M-TIP Test Case User Guide 09 April 2013 231

Test Scenarios for M-TIP Subset 6 ID374 Test 01 Scenario 01 To ensure the terminal correctly completes the Mag-Stripe transaction with a Mobile indicating 'PIN verification successful'. [TC684-2] Terminal supports Master PayPass and [PayPass3.0]. The terminal is such that the CVM Required Limit is greater than zero. AIP byte 1 bit 2 is NOT set ("On-device cardholder verification NOT supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). Please use the following test card: M-TIP Subset 6 ID 374 (or MCC 374) v1.0. Enter any amount below the CVM Required Limit. If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "ID374 v1 0" or "MCC374 v1 0" - OK/NOK Network simulator checks: - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value: - Track 1: B5413330056003743^CUST IMP MC 374/^2512101067750475 OK/NOK/Not Applicable - Track 2: 5413330056003743D2512101067750215 (both D and = are acceptable separators) OK/NOK/ Not Applicable 232 PayPass M-TIP Test Case User Guide 09 April 2013

Test Scenarios for M-TIP Subset 6 ID374 Test 02 Scenario 01 To ensure the terminal correctly completes the Mag-Stripe transaction with a Mobile indicating 'PIN verification successful'. [TC684-3] Terminal supports Master PayPass and [PayPass3.0]. The terminal is such that the CVM Required Limit is zero. AIP byte 1 bit 2 is NOT set ("On-device cardholder verification NOT supported"). AIP byte 2 bit 8 is not set ("EMV NOT supported"). Please use the following test card: M-TIP Subset 6 ID 374 (or MCC 374) v1.0. Enter any amount below the Contactless Transaction Limit (On-device CVM). If needed select the Master PayPass product. The network simulator validates the authorization message and returns the response 00 (accepted). - The terminal approves the online transaction - OK/NOK log checks: - Application Label indicates "ID374 v1 0" or "MCC374 v1 0" - OK/NOK Network simulator checks: - DE 35 (Track2) or DE 45 (Track1) must be present and have the expected value: - Track 1: B5413330056003743^CUST IMP MC 374/^2512101067750475 OK/NOK/Not Applicable - Track 2: 5413330056003743D2512101067750215 (both D and = are acceptable separators) OK/NOK/ Not Applicable PayPass M-TIP Test Case User Guide 09 April 2013 233

Annexes 6 Annexes 6.1 RSA Keys used The Public Keys and modulus to be loaded into the terminal for offline CAM Verification are given hereafter. The hash value is calculated on the concatenation of all parts using SHA-1. RID A0 00 00 00 04 Certification Authority Public Key Index FA CA Public Key Modulus (1152 bits / 144 bytes) A9 0F CD 55 AA 2D 5D 99 63 E3 5E D0 F4 40 17 76 99 83 2F 49 C6 BA B1 5C DA E5 79 4B E9 3F 93 4D 44 62 D5 D1 27 62 E4 8C 38 BA 83 D8 44 5D EA A7 41 95 A3 01 A1 02 B2 F1 14 EA DA 0D 18 0E E5 E7 A5 C7 3E 0C 4E 11 F6 7A 43 DD AB 5D 55 68 3B 14 74 CC 06 27 F4 4B 8D 30 88 A4 92 FF AA DA D4 F4 24 22 D0 E7 01 35 36 C3 C4 9A D3 D0 FA E9 64 59 B0 F6 B1 B6 05 65 38 A3 D6 D4 46 40 F9 44 67 B1 08 86 7D EC 40 FA AE CD 74 0C 00 E2 B7 A8 85 2D Public Key Exponent 03 Hash (20 bytes using SHA-1) 5B ED 40 68 D9 6E A1 6D 2D 77 E0 3D 60 36 FC 7A 16 0E A9 9C RID A0 00 00 00 04 Certification Authority Public Key Index F1 CA Public Key Modulus (1408 bits / 176 bytes) A0 DC F4 BD E1 9C 35 46 B4 B6 F0 41 4D 17 4D DE 29 4A AB BB 82 8C 5A 83 4D 73 AA E2 7C 99 B0 B0 53 A9 02 78 00 72 39 B6 45 9F F0 BB CD 7B 4B 9C 6C 50 AC 02 CE 91 36 8D A1 BD 21 AA EA DB C6 53 47 33 7D 89 B6 8F 5C 99 A0 9D 05 BE 02 DD 1F 8C 5B A2 0E 2F 13 FB 2A 27 C4 1D 3F 85 CA D5 CF 66 68 E7 58 51 EC 66 ED BF 98 85 1F D4 E4 2C 44 C1 D5 9F 59 84 70 3B 27 D5 B9 F2 1B 8F A0 D9 32 79 FB BF 69 E0 90 64 29 09 C9 EA 27 F8 98 95 95 41 AA 67 57 F5 F6 24 10 4F 6E 1D 3A 95 32 F2 A6 E5 15 15 AE AD 1B 43 B3 D7 83 50 88 A2 FA FA 7B E7 Public Key Exponent 03 Hash (20 bytes using SHA-1) D8 E6 8D A1 67 AB 5A 85 D8 C3 D5 5E CB 9B 05 17 A1 A5 B4 BB 234 PayPass M-TIP Test Case User Guide 09 April 2013

Annexes RID A0 00 00 00 04 Certification Authority Public Key Index CA Public Key Modulus (1984 bits / 248 bytes) Public Key Exponent 03 EF A1 91 CB 87 47 3F 29 34 9B 5D 60 A8 8B 3E AE E0 97 3A A6 F1 A0 82 F3 58 D8 49 FD DF F9 C0 91 F8 99 ED A9 79 2C AF 09 EF 28 F5 D2 24 04 B8 8A 22 93 EE BB C1 94 9C 43 BE A4 D6 0C FD 87 9A 15 39 54 4E 09 E0 F0 9F 60 F0 65 B2 BF 2A 13 EC C7 05 F3 D4 68 B9 D3 3A E7 7A D9 D3 F1 9C A4 0F 23 DC F5 EB 7C 04 DC 8F 69 EB A5 65 B1 EB CB 46 86 CD 27 47 85 53 0F F6 F6 E9 EE 43 AA 43 FD B0 2C E0 0D AE C1 5C 7B 8F D6 A9 B3 94 BA BA 41 9D 3F 6D C8 5E 16 56 9B E8 E7 69 89 68 8E FE A2 DF 22 FF 7D 35 C0 43 33 8D EA A9 82 A0 2B 86 6D E5 32 85 19 EB BC D6 F0 3C DD 68 66 73 84 7F 84 DB 65 1A B8 6C 28 CF 14 62 56 2C 57 7B 85 35 64 A2 90 C8 55 6D 81 85 31 26 8D 25 CC 98 A4 CC 6A 0B DF FF DA 2D CC A3 A9 4C 99 85 59 E3 07 FD DF 91 50 06 D9 A9 87 B0 7D DA EB 3B Hash (20 bytes using SHA-1) 21 76 6E BB 0E E1 22 AF B6 5D 78 45 B7 3D B4 6B AB 65 42 7A PayPass M-TIP Test Case User Guide 09 April 2013 235

Annexes 6.2 DES Keys used The Issuer Master Key (IMK) to be programmed in the Network for Online Cryptograms (ARQC) verification is: IMK ARQC (IMK for ARQC) 9E 15 20 43 13 F7 31 8A CB 79 B9 0B D9 86 AD 29 The other keys (IMK for TC, AAC, Secure Messaging for Confidentiality and/or Integrity) are the following. IMK TC (IMK for TC, same as IMK ARQC ) 9E 15 20 43 13 F7 31 8A CB 79 B9 0B D9 86 AD 29 IMK AAC (IMK for AAC, same as IMK ARQC ) 9E 15 20 43 13 F7 31 8A CB 79 B9 0B D9 86 AD 29 IMK SMI (IMK for Secure Messaging for Integrity) 46 64 94 2F E6 15 FB 02 E5 D5 7F 29 2A A2 B3 B6 IMK SMC (IMK for Secure Messaging for Confidentiality) CE 29 3B 8C C1 2A 97 73 79 EF 25 6D 76 10 94 92 : The above DES test keys is already put within your simulator 236 PayPass M-TIP Test Case User Guide 09 April 2013

Annexes 6.3 DES Key Used for PVV and CVC Introduction The PVV calculation uses the Master algorithm. Below shows how to program the DES key for PVV verification. Issuer PVK Issuer PVK: D1 0C 52 A4 D9 38 13 CF 3F F6 2E 21 C2 27 FF 58 Issuer PVKI: 1 Below shows how to program the DES key for CVC verification is: Issuer CVK: D1 0C 52 A4 D9 38 13 CF 3F F6 2E 21 C2 27 FF 58 : The above DES test keys are already put within your MCI simulator. *** END OF DOCUMENT *** PayPass M-TIP Test Case User Guide 09 April 2013 237