When communicating with an EMV chip card, the card may reply to a command with error code SW1 SW2 = ’69 85′. In this post, we’ll analyze why this error code may be returned in response to the VERIFY command.

The VERIFY command “initiates in the ICC the comparison of the Transaction PIN Data sent in the data field of the command with the reference PIN data associated with the application”, as defined in EMV 4.3 book 3, section ‘6.5.12 VERIFY Command-Response APDUs‘. Status word ‘6985’ is defined as “Command not allowed” (“conditions of use not satisfied”), in EMV 4.3 book 3, section ‘6.3.5 Coding of the Status Bytes. This error code may be returned in several situations, here are a few common ones :

1. Several calls to VERIFY during the transaction
On the first call to VERIFY, card will reply with ‘9000’ if successful. On the following ones, even with a valid PIN, card may reply with ‘6985’ to prevent brute force attacks.

2. The VERIFY command sequence of execution is invalid
From section “10.5 Cardholder Verification” :
“[The VERIFY command] may be performed any time after Read Application Data and before completion of the terminal action analysis.”

So, you’ll get a ‘6985’ response if ever you try to verify a PIN just after sending the SELECT command, for example. Below is a typical VERIFY command sequence of execution :

1. SELECT FILE
2. GET PROCESSING OPTIONS
3. READ RECORD (as many times as required)
4. GET DATA
5. VERIFY
6. GENERATE APPLICATION CRYPTOGRAM

3. The card doesn’t support offline PIN verification

Obviously, if your card doesn’t support offline PIN verification, the VERIFY command will fail. To determine if an EMV card supports offline PIN verification :

1. Check the Application Interchange Profile field (AIP, tag 82) returned in response to the GET PROCESSING OPTIONS command. Byte 1, Bit 5 should be set to 1 if cardholder verification is supported, as explained in section ‘10.5 Cardholder Verification’. Example of an AIP value : 1C 00
2. In Cardholder Verification Method (CVM) List (tag 8E), ensure you have a valid CVM rule with byte 1, bit 1 = 1 (meaning “Plaintext PIN verification performed by ICC”, annex ‘C3 Cardholder Verification Rule Format’). The CVM list starts with 2 amount fields of 4 bytes each, and then a variable number of 2 bytes CVM rules. Example of a CVM list whose last rule forces offline pin : 00 00 00 00 00 00 00 00 02 01 01 00.

If you know some other common cases in which VERIFY may return error code ‘6985’, thanks to let me know in the comments !