VISA Issuer PIN Security

These guidelines are intended to manage the exposure of PINs and associated data (processed during transactions within the scope of this document) that could be used to clone cardholder payment devices for use in any payment channel.

Issuers should ensure that any exposed data or credentials required for PIN management do not permit personalization of undetectable, unauthorized cardholder payment devices that can be used to make any payment with or without PIN as a CVM. Issuers should confirm that the security checks performed on transaction data by their authorization host will detect when a transaction is from an unauthorized cardholder payment device. Issuers should reduce PIN management as a target for fraudsters by maintaining separation of the PIN from associated account data used for payment transaction processing throughout the PIN management processes. Issuers should ensure that PINs are protected during processing, transmission and storage by one or more of the following: provision of physical protection; encryption of the PIN; use of separate HSMs for Issuer vs. Acquirer functionality; use of an encrypted reference or control number to indirectly link the PIN to the PAN when the two items of data must be transmitted separately; Issuers should ensure that their PIN management system prevents the PIN from being stored wherever it is received while under issuer responsibility. PIN mailers, SMS messages and emails are vulnerable and their content should be constructed to meet the PIN Generation, General Guidelines section. Issuers should conduct employee monitoring with respect to accessing cardholder data. Routine monitoring can help determine if employees are accessing cardholder records when there is no need to do so, for example accessing an unusual amount of cardholder records, or asking for cardholders’ PINs. Issuers should provide guidance on safe PIN management to cardholders when the account is first opened, and at least annually, for example: never share your PIN with anyone; select a PIN that cannot be easily guessed (i.e., do not use birth date, partial account numbers, sequential numbers like 1234, or repeated values such as 1111); memorize your PIN. Do not write it down on your card or keep it on a piece of paper in your wallet; do not use your PIN as a password for other bank and non-bank services; be aware of others nearby when entering your PIN at an ATM or point of sale; check your monthly statements for unauthorized charges. Issuers should regularly insert a PIN security reminder into cardholder statements and promote cardholder awareness of ‘phishing’ and other social engineering attacks. Issuers, member/client service providers and vendors providing any PIN management service should refer to brands for any mandates that apply to the service.

Issuers should apply risk factors to ATM withdrawal limit assignments. Establish an expanded range of higher POS spending and ATM withdrawal limit tiers in combination with an ongoing limit upgrade program that is aligned with customer risk, as well as deposit classification/value. Review requests for higher ATM withdrawal limits at an individual cardholder level. Customer demand for higher ATM withdrawal limits is relatively small and should be satisfied by permitting individually-raised ATM withdrawal limits on a case-by-case basis. Issuers should Apply cashback amounts to the ATM withdrawal limit. The cashback portion of a POS PIN transaction should always be applied toward the cardholder ATM withdrawal limit. Issuers should ensure that quasi-cash is categorized as cash and applied to the ATM withdrawal limit. The total amount of a quasi-cash transaction should also be applied to the ATM withdrawal limit.