PCI PIN Security

PCI PIN Security is the payment card industry standard that sets out how personal identification numbers, or PINs, must be protected during card transactions, and how the cryptographic keys used to protect them must be managed. It is published by the PCI Security Standards Council as the PCI PIN Security Requirements and applies to organisations that accept, transmit or process PINs, including acquirers, processors, ATM operators, network switches and facilities that load keys into payment terminals. The aim is to ensure that a cardholder's PIN is never exposed in clear text outside secure devices.

PCI PIN Security sits alongside the better-known Payment Card Industry Data Security Standard (PCI DSS), which protects card data more generally, and the PIN Transaction Security device standards, which govern the design of PIN entry devices and hardware security modules. The PCI Council maintains the standard, but enforcement and validation requirements are set by the individual card networks, which decide which organisations must be assessed and how often.

The standard covers the whole life of a PIN in an online transaction: from the moment the cardholder enters it on a terminal or ATM, through encryption and transmission across acquirer and network systems, to translation and verification at the issuer or its processor. Typical organisations in scope include:

• Acquirers and processors that receive encrypted PIN blocks from terminals and pass them on.
• ATM operators and networks that handle cash withdrawals and balance enquiries.
• Key injection facilities that load cryptographic keys into terminals before they are deployed.
• Third-party service providers that operate HSMs or key management services on behalf of others.

Merchants that use approved terminals and do not manage PIN keys themselves are generally not assessed directly, although they rely on their providers' compliance.

The requirements are organised around a set of control objectives that, in summary, require organisations to:

• Process PINs only in secure, approved devices, so that the PIN is never visible in clear text outside a secure cryptographic device.
• Use approved methods to encrypt PINs, forming PIN blocks according to ISO 9564 formats and protecting them with strong algorithms such as Triple DES or AES.
• Generate, transport, load and store keys securely, using dual control and split knowledge so that no single person can learn a full key.
• Use keys only for their intended purpose and protect them from substitution or misuse, increasingly by packaging them in key blocks such as the TR-31 format.
• Manage the full key lifecycle, including replacement, destruction and handling of suspected compromise.
• Control and track devices, including terminals and HSMs, from manufacture to decommissioning.
• Maintain documented procedures, logs and audit trails for all of the above.

These controls are closely tied to wider key management practices and to payment data encryption more broadly.

When a cardholder enters a PIN on a payment terminal, the device combines it with other data, typically part of the card number, to form a PIN block, then encrypts it immediately under a working key. Many terminals use per-transaction keys derived from a base key, so that each PIN is protected by a different key. At the acquirer, an HSM decrypts the PIN block and re-encrypts it under a key shared with the next party, a process called PIN translation, without the PIN ever appearing outside the HSM. The issuer's HSM finally verifies the PIN against its records.

Keys are arranged in a hierarchy of key-encrypting keys and working keys, each with a defined purpose. The standard requires this hierarchy to be documented and protected, because the compromise of a high-level key could expose every PIN beneath it.

Organisations in scope are assessed by qualified PIN assessors, who review documentation, inspect facilities, interview staff and test controls. Assessment frequency and reporting are set by the card networks, which may impose fines or restrict participation for non-compliance. The standard has introduced phased deadlines for stronger practices, such as the adoption of key blocks and the move away from older encryption methods, giving the industry time to replace equipment.

PINs are a primary cardholder verification method for debit cards and ATM withdrawals, and in many markets for credit cards too, where they work alongside the EMV chip. A compromised PIN, combined with copied card data from card skimming, allows criminals to withdraw cash directly, so PINs are a high-value target. PIN data is classed as sensitive authentication data, and failures in PIN handling can lead to large losses and loss of trust. The combination of secure devices, strong key management and regular assessment under PCI PIN Security is the industry's main defence against such attacks.

• PCI Security Standards Council