[SOLVED] Does host should increase ATC (Application Transaction Counter) (EMV tag 9F36) after unsuccessful transaction?

Does host should increase ATC (Application Transaction Counter) (EMV tag 9F36) after unsuccessful transaction?

The host update the ATC after success transaction and the counter on the ICC and in the host DB is the same in this moment.

But, does host should increase/update the ATC in the own DataBase after not success transaction (for example after transaction with not correct PIN) because the counter on ICC is increased? Or host shouldn't change the ATC after it.

I didn't find answer into any EMV book.

Solution

One of the big objectives of emv transaction is to stop replay transactions. The authenticity of a transaction is verified using Authorization Request Cryptogram and ATC is a component of its generation and obviously in its validation.

Now, chip increments the ATC every time you issue a Get Processing Options. So when you receive a transaction online, it is expected that the ATC for the transaction is always higher than the last ATC you have at issuer. If it is same or lower than what stored at issuer for the card, the transaction is probably a replay.