Is it secure to ask a user to enter their debit card pin to perform certain actions on their mobile banking app? (payment, view card number, etc.)
The pin will be transmitted over HTTPS, which is compliant with PCI requirements for online pin processing. But HTTPs can be hacked - so sending the PIN so often doesn't seem wise (and may not be PCI compliant, or follow industry best practices )
I think PCI Pin Security (v2) Requirement 1 is the most relevant to your question:
"All cardholder-entered PINs must be processed in equipment that conforms to the requirements for secure cryptographic devices (SCDs). PINs must never appear in the clear outside of an SCD.
A secure cryptographic device (SCD) must meet the requirements of a “Physically Secure Device” as defined in ISO 9564. For POI PIN-acceptance devices this is evidenced by their being validated and PCI approved"
So, unless the device meets the requirements of an SCD (I don't know of any devices resembling home computers or consumer mobiles meeting those requirements) it can't be done. The details of encrypting and transporting the data are secondary to this (which, IMO, cant be overcome).
What I have understand, this requirement is waived (compensating control: Compromise is limited to a single cardholder) for cardholder-owned equipment, as the risk for compromise is reduced to one single instance of a card. Eg, if the mobile banking app is compromised, you would get the PIN code for one single customer. Not a lot of customers like if a ATM/POS PIN entry device was compromised.
When it also comes to transit, I believe the bank has taken measures to prevent the PIN from being visible even if the HTTPS was decrypted/removed/compromised, by using app-specific encryption that is using the PIN-code to generate a ZKP.
The reason a ATM/POS pinpad must for example be a SCD, is to prevent someone from installing a invisible skimmer under the keypad which "snoops" the PIN code. Now the skimmer must resort to detectable methods like cameras or PINpad overlays, as the PIN is encrypted in the tamper-resistant PIN pad.
Also another thing issuers do:
Think all those "OTP cardreaders" where you insert your card, enter your cardholder PIN, and then a OTP code is shown on screen that can be used to login to internet banking. These does not meet the requirements for SCD either, as they don't have any tamper resistance. But tamper resistance would also be impossible to implement on a "OTP cardreader", as then the cardreader would then need to be personalized to the customer instead of being "generic".
Same with Samsung Pay, Android Pay, and Apple Pay. Cardholder Authentication is here done on a "insecure" device, but the device is still owned by the cardholder, which makes it a lot more secure, as tampering with the device would get you ONE cardholder details, not many, and also, tampering with it would require getting physical hands on it, which is a lot harder than skimming a ATM or similiar.
The payment card industry has already approved Samsung Pay, Android Pay, and Apple Pay, even if their support for PIN authentication is done on a device which is not SCD compliant. (Fingerprint is normally used, but PIN can be used if finger is dirty etc.)
