How a PIN is checked
A PIN is verified in one of two ways. With online PIN, the terminal encrypts the entry into a PIN block, a block of data that encapsulates the PIN, and sends it with the authorisation request for the issuer to check. With offline PIN, the chip on the card compares the entry itself and tells the terminal the result.
Either way the merchant never learns the PIN. On a chip card the PIN took the place of the cardholder's signature.
The security standards around a PIN
PCI SSC's PIN Security Standard sets requirements for the secure management, processing and transmission of PIN data at ATMs and at attended and unattended point-of-sale terminals. ISO 9564-1 gives the basic principles for managing PINs through their creation, issuance, usage and deactivation.
Under PCI DSS, PINs and PIN blocks are sensitive authentication data, which may not be stored after authorisation even if encrypted. Entry of a PIN on a phone's own screen is covered by a separate standard, PCI MPoC.
Who handles PINs in a card product
The issuer sets the PIN or lets the cardholder choose one, delivers it, often by showing it in the app after authentication, and verifies it inside hardware security modules. An acquirer's terminals capture it. A card that has no PIN cannot be used where one is demanded, cash machines included.
PIN, card security code or device check?
- Card security code
- Printed on the card and typed into online checkouts. The code shows possession of the card's details, where a PIN is a secret the cardholder keeps.
- Consumer device verification
- A fingerprint, face or passcode check on the cardholder's own phone or watch, which the Visa Core Rules recognise as a method of verifying a cardholder (CDCVM).
- App passcode
- Unlocks a banking or wallet app and is checked by that app or its server. A card PIN is checked by the issuer or by the card's chip.
Where a PIN shows up in a platform
Modules that do the work
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
- PCI SSC, Glossary: PIN, PIN Block, Sensitive Authentication Data
- PCI SSC, PCI Security Standards: PIN Security
- ISO 9564-1:2017, Financial services, PIN management and security, Part 1 (ISO)
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026: glossary, PIN and CDCVM (Visa)
General information, not legal advice: what applies to you depends on your services and your market.