When is a PIN requested during payment?

[Tomcat]

I noticed that people often talk about the reasons for not requesting a PIN code, or, on the contrary, they are surprised why it was suddenly required. Trying to explain in what situations a PIN code is needed, I got confused and decided to collect data and write an article.

Theory​

Let's look at the cards first​

Non-chip magnetic cards are rare, but are still used. The bank was responsible for the lost funds, but the EMV standard (an international standard for transactions with bank cards with a chip) appeared, which allowed banks to transfer responsibility for the lost funds to trading organizations that do not support EMV, otherwise to the cardholder (unless he can prove that has nothing to do with the operation). Equipment that does not support EMV is abandoned due to the fact that purchasing equipment that supports the new standard is not profitable for organizations. It turns out that if the store has old equipment, they will be able to service it with any card, but if the client has a chip card that supports the EMV standard, the store is responsible; if the store is against it, he will have to buy new equipment.

As a result, we get two types of cards: those that support EMV and those that do not. There are other payment cards, but they are used by banks locally and are not of interest to us.

Next, let's look at the PIN code.​

The terminal will request a PIN code or signature by referring to the CVM sheet of the chip card and relying on its mode. How many people - so many opinions, some for signing, some against. In reality, all banks are different. Some banks include a signature priority in the card, others a PIN code, and still others allow you to reconfigure the card through an ATM at the client’s request.

Now about commercial equipment​

I did not find specific information on how terminals in stores are configured, but I realized that they also contain certain settings that, for example, allow you to require a signature instead of a PIN code, even if the card has PIN code priority, but only if the amount does not exceed a certain limit. This mode is necessary in stores where there are many customers in line with small amounts. This mode, if I'm not mistaken, is called Offline, transfers responsibility to the store, even if EMV equipment is used.

Result​

Based on what was written above, I compiled a table to calculate in which case a PIN code will be requested:

The safest operations are marked in green, the most dangerous in red. In the column responsible (for lost funds) in some cells two/three parties were indicated, I think who exactly depends on the specific tariff plan. (correct me if I'm wrong). Safe operations are marked in blue, provided that the magnetic tape was not read.

Safety​

Data can be compromised on any card if the magnetic tape is read and the PIN code is entered. With a compromised card, an attacker will only be able to make purchases at retail outlets with equipment that does not support EMV. A card that supports EMV cannot be used at ATMs (there is a note on the tape that the card has a chip). And with a card without EMV, in addition to purchases, an attacker will be able to make transactions at an ATM, for example, withdraw money.

Pay attention to this fairly common situation: the operator swipes the magnetic tape, “slows down”, noticing that the card has a chip (or “slows down a lot”, seeing a message on the display about the chip), then inserts the card as expected and asks to enter a PIN -code. In this case, you will also compromise your card data, because perhaps the operator did this on purpose.

In any case, we can always refuse to enter the PIN so as not to compromise it. To do this, after requesting a PIN code, you must press the red key on the terminal, after which the cashier will see on the screen “The client refused to enter the PIN code” and he will have the choice to accept the signature (click “continue”) instead of the PIN code or refuse the operation ( click “cancel”). I don’t know about you, but personally I didn’t know about this function and thought that the red button was for completely canceling the operation. Of course, the operator may be indignant, but there is a simple answer to this: “I don’t remember the PIN code” or “I don’t know it” (there are credit cards that do not issue an envelope with a PIN code).

I hope this information was useful to you.