PT-2021-05: Lack of Amount/CVMResults fields checking for Public Transport Schemes

Mobile wallets allow to charge one amount within the Public Transport Scheme' cryptogram and charge a different amount using any payment terminal in the end. This is due to EMV standards and is a requirement for modern payments when the price shown on the terminal is different from the actual...

PT-2021-07: GPay payments above NoCVM limits, CryptoATC out of order

EMV standards which are used as a predecessor of mobile wallets, do not put some mandatory fields as a cryptogram input. These fields are crucial for risk management steps, and their tampering can bypass payment restrictions. During the transaction authorisation, MDES does not decline payments wi...