How does a debit/credit card reader verify the PIN so quickly?

Question

I understand that the associated PIN for a given card is not stored on the card itself in any way. So I am wondering then, when I use my cards how does it seem to be able to verify the PIN quite quickly and yet sometimes take a long time to complete the transaction. I always assumed the delay was in getting a connection with the financial servers, but the timing seems to indicate otherwise. Is the PIN verified without access to those servers?

Answer 1

In fact, in many cases, the PIN is in the card. There are a lot of possible situations, not all of them well documented, and they are subject to evolution over time.

Some cards do not have the PIN code on the card in any way; at least, that was the case for Amex cards about 15 years ago, because you could change the PIN over a phone call.

Some cards have an encrypted copy of the PIN on the magnetic stripe. This can be decrypted into some secured facilities that have a copy of the relevant decryption key; an ATM or selling point could maintain a live connection to one of these facilities, and still take some time to contact the bank that actually manages the account.

Smart cards, with a chip, know the PIN code and can verify it. That's the main point of smart cards: the chip is tamper-resistant, thus can hold secrets; these secrets can be unlocked through authentication with a PIN code; the chip will autolock itself if too many wrong PIN values are presented. When the card is a smart card, PIN verification goes as fast as the card chip can do it, normally a fraction of a second.

(A tamper-resistant smart card does not prevent the overall protocol from doing something stupid which nullifies security; e.g., see this recent article that describes an actual case of fraud due to a protocol flaw.)

Answer 2

Is the PIN verified without access to those servers?

How the PIN is verified depends quite a lot on your card and the terminal. In the following I'm going to explain how it works with Chip/EVM, as they are quite popular around the world and magstripe isn't really used anymore. (Except in places like the U.S. where, as of the first revision of this post, it is just now starting to slowly be phased out.)

The terminal requests the Cardholder Verification Method (CVM) List of the card and then compares it with it configuration. Your card for example might contain a list like this (simplified):

• Offline PIN (plaintext), move to next if unsuccessful
• Online PIN (move to next if unsuccessful)
• Paper based Signature (move to next if unsuccessful)
• No CVM required (fail if unsucessful)

The terminal then compares it with it configuration and starts with the highest priority. If the terminal for example doesn't support Offline PIN, it would go to the next verification method and verify the PIN with the bank over network.

In terms of Offline PIN (that is, without comparing it over the network), there are two major ways:

• Plaintext
• Encrypted

The encrypted verification works by using the PIN provided by the cardholder and encrypting it with the cards public key before sending it to the card, where it's decrypted and verified. The plaintext verification works by sending the PIN directly to the card.

Online PIN is always done encrypted.

So to sum it up: It depends a lot on your card and the terminals how the PIN is verified.

But of course the PIN is not the only thing that is verified when you pay by card. Depending again on the card and terminal, your purchase might need to be authorized with the bank.

Visa Electron cards for example always need an online authorization of the transaction to make sure you don't go into overdraft. So for example when you are flying in an aircraft they might not work.

But it also depends on the terminal: Depending on the country, the merchants category and the amount the terminal might not need to request an authorization for the purchase. Back in the day when you'd need to use dial-up this was quite important because it would take quite a bit to verify every $6 purchase at a grocery store. Nowadays it's not as important, but might still be used.

Both aspects, PIN verification and authorization are not connected to each other, so the time it takes for your purchase to go through can vary quite a lot.

If your card and the terminal support offline PIN and you are under the floor limit, they might not need to contact the bank at all. This can speed up the purchase quite a lot. But if you are over the floor limit, the card might not contact the bank to verify your PIN, but to authorize the transaction.

To really sum it up: It depends on your card and the terminal if the PIN is verified with the bank. It can happen quickly because of the fast internet or because the card itself verifies the PIN. But in any case the bank might be contacted to authorize the purchase (to make sure you have enough money in the account) which adds some time.