Personal Identification Number
What is a personal identification number?
Personal identification number (PIN) is a numeric code that authenticates the during card payments and ATM withdrawals. It's most commonly required for debit card transactions, both at ATMs and at .
A PIN is a knowledge factor (something only the cardholder should know), so it confirms identity beyond simply holding the physical card. Even if a card is lost or stolen, it can't be used at a PIN-protected terminal without the correct code. The issuing bank assigns a PIN when the card is created, and the cardholder can reset it through an ATM or the bank.
PIN checks happen in one of two ways. An offline PIN is verified locally by the card's chip, while an online PIN is encrypted and sent to the issuer for verification during authorization.
Key facts
- Also known as: PIN, PIN code
- Format: numeric only, typically 4–6 digits
- Used for: debit card payments at and ATM withdrawals
- Entered at: chip-and-PIN terminals, ATMs, and unattended kiosks such as fuel pumps and ticket machines
- Verifies: that the person presenting the card is the legitimate cardholder
- Security factor: a knowledge factor, usually paired with the physical card (a possession factor) to form two-factor authentication
How PIN verification works
- Entry: The cardholder enters the PIN on a terminal or ATM keypad. It's combined with the card data into an encrypted PIN block at the keypad, so the clear code never reaches the merchant or the network.
- Routing to the acquirer: The terminal sends the encrypted transaction to the merchant's , which forwards it into the card network.
- Issuer verification: The network passes the payment details to the , which validates the PIN and runs its own fraud and funds checks.
- Authorization response: The issuer approves or declines, then returns the result back through the to the acquirer.
- Completion: The acquirer notifies the merchant, and an approved transaction moves into settlement.
Why it matters
A verified PIN shifts liability for fraud. When a transaction is authenticated with a PIN, the issuer generally treats it as cardholder-present, which makes it harder to dispute as unauthorized and reduces the merchant's exposure to certain . PINs also satisfy the knowledge element of , the European requirement that two independent factors confirm the payer.
Common issues
- Guessable codes: Birthdates, repeated digits (1111), and sequential patterns (1234) are the first values an attacker tries, so they offer little real protection.
- Lockouts: Most issuers block the card after a few consecutive incorrect attempts, which protects the account but can strand a legitimate cardholder mid-purchase.
- PIN vs signature: Debit transactions usually require a PIN, while many credit and contactless payments rely on a signature or no cardholder verification at all. Credit card PINs are common in Europe and add the same knowledge check to credit transactions.
- PIN vs card security code: A PIN authenticates in-person payments, whereas the verifies card-not-present online purchases. The two aren't interchangeable.
