Flexible CDCVM

Overview

This section describes the contactless proximity payment model Flexible CDCVM. Flexible CDCVM allows a transaction without end user authentication for a Low Value Transaction (LVT).

For a High Value Transaction (HVT), the payment experience is the same as CDCVM Always:

• 1-TAP experience if the end user is authenticated before the tap

• 2-TAP experience if the end user is not authenticated before the first tap

The POS determines whether a transaction is an LVT or HVT based on the transaction amount. The LVT and HVT threshold is configured in the POS and is country-specific. For an LVT, the POS does not require end user verification. NFC Payment determines whether end user authentication is required based on the following conditions:

• The digital card profile supports Flexible CDCVM

• The POS does not request CDCVM for the transaction

• The NFC Payment risk management counter limits are not exceeded

In case of Mastercard digital card profile CVM model must be Flexible CDCVM.

NFC Payment Risk Management

For security reasons, NFC Payment implements risk management based on transaction counters:

• The number of consecutive LVTs without CDCVM

• The cumulative amount of consecutive transactions without CDCVM, in the domestic currency

The issuer application can configure threshold values for these counters. If either threshold is exceeded during an LVT, NFC Payment requests CDCVM.

The transaction counters reset after a transaction with CDCVM.

The issuer application can also configure a maximum amount for a single transaction without CDCVM, in the domestic currency.

User Experience

The end user taps the POS terminal to start an LVT contactless payment. The end user is not authenticated. If NFC Payment risk management does not require authentication, the transaction is processed without CDCVM by using the default digital card.

Flexible CDCVM payment experience for an LVT.

SDK

To enable the Flexible CDCVM payment experience, configure risk management.

See the example below.

Android Java

// NFC Payment configuration: Flexible CDCVM risk management
D1PayConfigParams configParams = D1PayConfigParams.getInstance();
// Set the currency for transaction counter risk management.
configParams.setDomesticCurrencyCode(978);
// Allow only 5 consecutive LVTs without CDCVM.
configParams.setMaxConsecutivePaymentsForLVT(5);
// Set 75 EUR as the maximum cumulative amount without CDCVM.
configParams.setMaxCumulativeAmountForLVT(75);
// Set 50 EUR as the maximum amount for a single transaction without CDCVM.
configParams.setSingleTransactionAmountLimitForLVT(50);

The payment flow and SDK integration remain the same as described in CDCVM Always.