Cardholder verification method (CVM)
The step in a card payment meant to prove the person holding the card also owns it: PIN, signature, the phone's biometrics, or nothing at all.
In EMV the chip carries a CVM list in priority order, and the terminal walks it until it finds a method both sides support. Offline PIN is checked by the chip itself. Online PIN is encrypted into a PIN block and sent to the issuer. Signature means a tired cashier comparing two squiggles, and Visa and Mastercard stopped requiring it in North America in 2018. "No CVM" covers small contactless purchases, and CDCVM means the phone has already checked its owner by fingerprint or face.
The negotiation is also an attack surface. In 2010 Steven Murdoch's group at Cambridge showed that a man in the middle could convince the terminal the PIN had been accepted while the card believed the purchase would be signed for. Any PIN worked, and the receipt cheerfully claimed "PIN verified".