Skip to main content
This capability enables your cardholders to specify a card PIN of their choice through the issuer-provided mobile or web applications. It also reduces the significant cost incurred in delivering PIN through mail or courier services. This also optimises the user experience as cardholders are empowered to choose a PIN of their preference.
The Set PIN function prohibits any exposure of sensitive data to the backend processes and is compliant with the latest security requirements. For more information, see PCI and Security Compliance.

​
Setting PIN | Supported Workflows

This section explains how PIN setting works during new card creation, reissue, and replacement.

​
New Card Creation

When you are creating a new card via the Create Card Endpoint, you can perform any of the following:
  • pinStatus parameter set to GENERATED: This is the default value and it creates a random PIN for the new card.
  • pinStatus parameter set to WAITING: If you specify this value, you can set the PIN later. Once you set the PIN, the PIN status is changed to SET.
The card cannot be included in the embossing file when the pinStatus is WAITIING; it is sent to the manufacturer for printing the plastic card only when the status is changed to SET.

​
Card Reissue

When a card is reissued, by default, the PIN remains the same in the new version. However, You can modify this behaviour via the Reissue Card Endpoint > pinStatus parameter:
  • Specify GENERATED to set a random PIN.
  • Specify WAITING to manually set the PIN later.

​
Card Replacement

When a card is replaced, by default, a random PIN is generated. You can modify this behaviour via the Replace Card Endpoint — to set the PIN later, specify WAITING for the pinStatus parameter.

​
Set PIN | Workflow

You can set PIN for the latest card version with an encrypted PIN block in ISO format 1. The PIN block is encrypted using a pre-shared double-length 3DES key. If the ZPK index is not specified, the first key is used, by default.
In a multi-application card, the multiple card applications included in the main application inherits the same PIN.

​
Prerequisite

When you are creating a new card, via the Create Card Endpoint, you can perform any of the following:
  • pinStatus parameter set to GENERATED: This is the default value and it creates a random PIN for the new card.
  • pinStatus parameter set to WAITING: If you specify this value, you can set the PIN later. Once you set the PIN, the PIN status is changed to SET.
  • Unless the PIN is set, the card cannot be included in the embossing file for manufacturing the plastic card.
  • After the pinStatus is set to WAITING, if the cardholder wants to generate a random PIN: send a request via the Partially Update Card Endpoint and set the pinStatus parameter to GENERATED.

​
Step-by-Step Guidance

If the pinStatus was set to WAITING, the PIN can be set in the following process:
To check whether a card PIN has been manually set by the Set PIN workflow or a random PIN is generated, send a request to the Get Card Endpoint:
  • If the PIN is manually set, the pinStatus parameter specifies SET.
  • If the PIN is randomly generated, the pinStatus parameter specifies GENERATED.

​
PCI Compliance

The Set PIN feature is designed in such a manner that it does not expose any sensitive, PCI-categorised data to the backend processes; this is compliant with the PCI DSS regulations and the following list highlights a few pointers of compliance:
  • The PIN data is encrypted during transmission.
  • The software is code reviewed and quality checks are ensured.
  • The Set PIN Endpoint is protected by a web application firewall.

​
Enfuce Recommendations | Guidelines for Issuers

  • Ensure that the cardholder accessing either the mobile/web application must be authenticated via the Strong Customer Authentication (SCA) process, before setting the PIN of their choice.
  • Your application must not save the PIN that the cardholder enters.
  • Ensure that other third-party applications interfacing with your application does not interfere in the set PIN workflow. Also, confirm that the interactions between your application frontend and the backend is done in an authenticated and encrypted session.