18

Certain banks (like Capital One or NAB) offer to change a debit/credit card PIN remotely, from an app or the bank's website.

However, it seems to me that the PIN is also stored on the chip of the physical card, as it is actively checked when using Chip & PIN or certain TAN generators.

(How) does a remotely changed PIN get propagated to the physical card? The alternatives I could think of is that the PIN gets updated the next time the card is inserted into a terminal or ATM, or that the PIN is not stored on the card after all but checked online for every transaction, but both don't seem to always work or be very secure.

4
  • 3
    What makes you believe the PIN is stored on the physical card? Also what country or union are you in? – Harper - Reinstate Monica Feb 11 '20 at 18:40
  • 1
    @Harper-ReinstateMonica See the TAN generator: it's an offline (unconnected) card reader that requires you to insert your card and enter your PIN to receive a code for logging into the bank website. I wouldn't know how else this reader could verify the PIN than if it were stored on the card. – Victor Le Pochat Feb 11 '20 at 18:43
  • 2
    So when you use the TAN generator, if you enter the wrong PIN what happens? Does the card reader say "wrong PIN no code for you"? Or does it give you a legit seeming code that the bank's website subsequently refuses? In the latter case, the card has no idea if your PIN is correct, and is generating the code that would be correct if your PIN was. – Harper - Reinstate Monica Feb 11 '20 at 18:52
  • 2
    @Harper-ReinstateMonica: the former, it gives an error (and you only have three tries before the reader actually blocks the card: see for example supportcentre.natwest.com/Searchable/913229862/…). – Victor Le Pochat Feb 11 '20 at 19:01
27

The EMV standard supports two (technically three) methods of verifying a PIN. In the first method ("online"), the PIN is encrypted and sent to the bank for verification. The other method ("offline") asks the chip to verify the PIN, and only the result is transmitted to the bank. (Offline is further subdivided into "encrypted" and "plaintext", depending on how the PIN is transmitted to the chip, but the practical differences are minimal.)

In general the banks in a given country tend to be all online-PIN or offline-PIN. In the US, which it sounds like you're in, most cards are online-PIN. Thus, changing your PIN via the bank's website or app will immediately take effect, without having to update the card.

Additionally, there's a specific EMV tag that a bank can return to the terminal to pass on to the chip which can update the PIN stored in it. Not all terminals support it (the feature is called "issuer scripts"), and it doesn't work with contactless or "quickchip" transactions (because the card is no longer present when the response is received), so I don't know how common it actually is - but it does technically exist, and was presumably used at some point in time. It's probably more commonly used over the ATM network than the credit card networks.

12
  • 3
    It's probably more commonly used over the ATM network than the credit card networks yes, that's where it typically comes into play, not at actual merchant terminals. And also if you're in a branch and using the terminal at the teller line to reset your PIN. – dwizum Feb 10 '20 at 15:55
  • 2
    @dwizum Thanks for confirming that. Most of my experience has been on the credit/retail side, and I’ve been asked about whether we support it, but never had to actually implement it. – Bobson Feb 10 '20 at 16:46
  • 2
    Funny, as most of my experience is on the card issuer side, and I've often wondered if it was ever implemented at merchant terminals but had never head of a case where it was. – dwizum Feb 10 '20 at 17:18
  • 1
    "In general the banks in a given country tend to be all online-PIN or offline-PIN." -- Is that referring to the terminals/ATMs or the cards? For example, if someone from an all online-PIN changed their PIN by website then went to a country that's all offline-PIN, would they need to use their previous PIN or would the terminals/ATMs in the all offline-PIN country be able to verify the PIN online? – JoL Feb 10 '20 at 19:25
  • 2
    @Peteris funnily enough I was surprised by having to use chip+pin for a low value transaction the other day. I normally spend over the contactless limit on that card at least once a fortnight (vs 10-20 contactless in the same period) but hadn't recently, so must have triggered a need for an online transaction. This time it had probably done 30 contactless since it was last used with a PIN – Chris H Feb 11 '20 at 9:46
1

What is generally stored in the mag stripe and also from what I know in the EMV is the pin offset, not the actual pin. The pin offset is a pointer to the actual value of the pin on the banking accounting server. The offset effectively is the memory address of the person's PIN. Done that way, they can change your pin at any moment, and it has no effect on transactions and requires no change on the physical card. This offset still is sent encrypted as is the entered pin.

Note that my experience with this is related to credit unions, who generally use different core accounting systems than banks.

1
  • 1
    "What is generally stored in the mag stripe and also from what I know in the EMV is the pin offset, not the actual pin. The pin offset is a pointer to the actual value of the pin on the banking accounting server. The offset effectively is the memory address of the person's PIN." - do you have a source, reference to a standard or technical spec for this claim you're making? This is the first I've heard of it. – Dai Feb 12 '20 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.