Skip to main content
A card PIN is a numeric code that verifies the legitimacy of the person using the card as the correct cardholder. PIN + card is a strong form of authentication used in card present transactions, as it combines the following:
  • The physical card that the cardholder possesses.
  • The PIN that is unique to each card.

​
PIN Formats and Strength

A card PIN usually comprises four digits. Some PINs are considered weak because they are easy to guess, contains repetitive sequences, or includes consecutive numbers

​
How the PIN is Used

The card PIN is typically used in the following scenarios:
  • When a physical card is swiped or inserted at the terminal.
  • When it is used for withdrawing cash at the ATM.

​
PIN Validation

Based on the terminal, country, and card configurations, the PIN validation happens in either of the following ways:
  • Online: The PIN is verified by the issuer/processor in real time during the transaction — the PIN is encrypted and is sent as part of the authorisation message. The issuer/processor maintains an online PIN counter; if the maximum number of retries have reached, the PIN is locked until the PIN counter is reset.
  • Offline: The chip embedded within the physical card itself locally validates the PIN, without contacting the issuer; the validation is done against a secure PIN reference stored on the card. If the cardholder has entered the wrong PIN multiple times, the chip can lock the offline PIN usage. The counter is stored on the card and is not visible to the issuer in real time.

​
PIN Retry Limits and Reset

  • Online PIN lock: As an issuer, you can configure the maximum number of incorrect PIN entries; discuss this with your customer onboarding manager. When the maximum number of retries have reached, the PIN is locked. To reset the PIN counter, send a request to the Reset PIN Counter Endpoint.
  • Offline PIN lock Usually, a successful PIN transaction, such as an ATM transaction, can reset the PIN counter.
An online PIN counter reset cannot reset a locked offline PIN counter on the card chip.