Offline data authentication (ODA)
How an EMV terminal checks that a chip card is genuine without asking the bank, in three generations: SDA, DDA and CDA.
The first, SDA (Static Data Authentication), is an issuer RSA signature over the card's fixed data. The terminal walks the chain from the card network's root key through the issuer certificate and concludes that the data hasn't been tampered with. What it can't conclude is that the card is real, since the same signed data copies happily onto another chip. Such clones, usually programmed to accept any PIN, became known as yes-cards.
DDA (Dynamic Data Authentication) gives the card its own key pair to sign the terminal's random number, so a copy without the private key gives itself away. CDA also binds that signature to the application cryptogram, closing the gap for a man in the middle who swaps the response afterwards. New SDA cards were phased out during the 2010s. None of this matters unless the terminal approves offline, as at transit gates or on aircraft.