To add to the other two answers, the data on the magnetic stripe is stored using IEC_7813 encoding. According to Wikipedia the Discretionary Data may include the PIN. It normally does not.
My recollection of the way it used to work was roughly as follows, which both has a degree of security and permits off-line PIN changes.
- The bank stores in respect of each card the 'Bank PIN', which is the initial card PIN as sent to the user.
- The PIN on the magnetic stripe is set to 0000 (or a known random number)
- When a PIN is entered into an ATM, the entered PIN and the PIN on the magnetic stripe are added together, and the answer taken modulo 10,000, and the result transmitted to the bank, and compared with the 'Bank PIN'
- When you change the PIN on the card, all that happens is stored offset changes.
I believe the code on the magnetic stripe may be called the PVV (or 'PIN offset'). See e.g. here and here for an older reference, from the second of which (end of section 3.1):
Finally, to permit the cardholders to change their PINs, an offset is added which is stored in the mainframe database along with the account number. When an ATM verifies an entered PIN, it simply subtracts the offset from the card before checking the value against the decimalised result of the encryption.
See here (see note below) for a modern reference:
PINCP: PIN Control Parameters (PINPARM). 6 digits:
If FC = 01 the two first digits represent the algorithm used to calculate PIN, where 00-09 mean private algorithm, 10-19 mean DEA and values 20 to 99 are reserved for future use by ISO/TC 68. Next 4 digits are PIN offset, a complementary value of PIN so customers can change their PIN, or PVV.
If FC = 02 the first digit represents the algorithm used to calculate PIN, where 0 means private algorithm, 1 means DEA and values 2 to 9 are reserved for future use by ISO/TC 68. The second digit represents a key for the algorithm. Next 4 digits are PIN offset, a complementary value of PIN so customers can change their PIN, or PVV.
If this field is not used a FS will be in place.
(the above was done from memory, then searched with Google, and only then did I realise the article actually appears to be the same as the one you referenced).