This question asked about how having a PIN is safer than signing the receipt when doing a credit card transaction (personally the question makes no sense to me as it's just a scientific fact that a PIN is harder to forge than a signature). It got me thinking...

My question is, when is a PIN required? When giving credit card information over the phone the transaction can be completed (regardless of amount) and they don't require a PIN. Obviously they don't require a signature neither.

  • 1
    Phone (and mail and Internet) transactions can't use PIN as explained in the answers, but do use other antifraud methods, mostly CVV2 but also address (AVS) and 3DSecure, which are not used for card-present. – dave_thompson_085 Jun 15 '16 at 17:51

This is a surprisingly complex question, and the answer is buried under a confusing layer of protocols, laws, and profits. It's no surprise that most people don't understand how it works.

PIN entry is required when the issuing bank has configured the card to request it, AND the terminal is capable of accepting a PIN, AND and the chip on the card decides it wants a PIN.

When a bank issues a card, they decide whether they want the cardholder to enter a PIN, or sign for the transaction, or neither. Each bank ultimately makes the decision for themselves, but most issuing banks follow the recommendation of the card brands. An example of a merchant that isn't following that recommendation is a US retailer who was famously breached in 2013. Following the breach they installed chip reading terminals in their stores, and they instructed their issuing bank to issue Chip-and-PIN MasterCards to their customers, instead of the default chip-and-signature cards.

As a result of the acquiring bank's decision, the issuing bank stores a code in the chip on the card indicating if PIN or signature is required (this code is called the Cardholder Verification Method, or CVM). When a chip card is inserted into a terminal for payment, the terminal sends the chip its own code indicating "I have a PIN pad/I don't have a PIN pad" and "I can take a signature/I can't take a signature." The terminal also sends the amount of the transaction to the chip. The chip examines the data, then figures out if it should prompt for PIN or not, and then it tells the terminal whether to "prompt for PIN" or "prompt for signature".

Obviously, not all terminals have PIN pads. Some, such as those commonly seen on vending machines, have neither a PIN pad nor a paper receipt to sign. But vending machines can enforce a low limit as to the amount of the transaction, which limits the vending machine's liability. Since they can't comply with the desire of the card to enter the PIN or sign a slip, they are breaking the rules and the merchant who operates the vending machine is liable for any unpaid transactions. If the merchant decides to risk accepting credit to sell $3.00 bottles of soda without a PIN or signature, they're doing so because they're not afraid of the amount at risk.

A PIN only protects a card from unauthorized usage by a thief. It does not make any of the other aspects of using a credit card more or less secure.

In Europe, banks have decided that requiring PIN is in their best interests at fighting fraud, so virtually all credit cards require PIN. In the US, the situation is more complex.

  • US Federal law protects credit card holders from unauthorized use, so your bank can't hold you liable if a thief steals your credit card and maxes out your account. This gives cardholders less incentive to worry about security. (The law limits customer liability to $50 max, but most US issuers cover the full amount so their customers pay nothing.)
  • The US card brands have figured out that signature transactions are more convenient for customers than PIN transactions.
  • The US card brands make far more money on the increased volume of convenient transactions than they lose on the increase in fraudulent signature transactions because they don't require PIN.

So in the US, since the law requires them to reimburse customers for theft anyway, and they make more money by encouraging more transactions, they have figured out that signature is far more profitable than PIN, and that average customers don't mind the reduced security. Thus, the US banks have chosen to issue chip-and-signature cards.

Regarding your question about phone or web authorizations, this is called Card Not Present (CNP) authorization. The card cannot physically be read by the device, and obviously there is no secure device available to enter the PIN or to collect signature data, so these are the weakest link of all. Even with the entry of the CVV2 code from the back of the card, CNP transactions are considered the highest level of risk for fraud. All the liability for disputed or fraudulent CNP charges is placed on the merchant or system who accepts the transactions. This must be factored into the business model of the web retailers as another hidden cost of doing business.

Note that if any party doesn't comply with the protocol, the party with the weakest security in the protocol is responsible for the entire cost of any losses if there's a problem. It doesn't matter if the customer doesn't pay the bill, or if the card was skimmed at a gas pump and this is a fraudulent charge. This is called the liability. So if a bank only issues mag stripe cards, but the merchant has chip card readers, the bank is liable for that transaction because they didn't issue secure chips. If a bank issues a chip card, but the merchant's terminal can't read the chip, the merchant is liable. If the merchant's terminal doesn't have a PIN pad, the merchant is liable for the transactions if the card requires a PIN, but not if the card doesn't. If the card calls for a signature, but the merchant can't collect a signature, the merchant is liable. (These rules went into effect in the US in October of 2015, and were called the "liability shift". They were intended to encourage merchants to install chip reader terminals, and to encourage banks to issue chip cards.)

  • Interesting. It was my understanding a credit card isn't actually done through the bank, despite the fact the bank often issues it and slaps it's logo on it. – Celeritas Jun 15 '16 at 19:23
  • @Celeritas, credit cards are processed on behalf of merchants by "acquiring banks" who then use "issuing banks" to issue the cards; one issuing bank may be an issuer for many different and unrelated payment cards. I have probably misused the terms "issuer" and "bank" by incorrectly interchanging them in the above text. I'll see if I can fix that. – John Deters Jun 15 '16 at 19:30
  • @Celeritas, I tried to clear it up a bit, but defining "acquiring bank" and "issuing bank" and their relationships to the merchant just makes an already complex description even more confusing. – John Deters Jun 15 '16 at 19:42

The PIN is requested only for cardholder-present transactions where the card is inserted into a point-of-sale terminal.

It improves security for those transactions, as it prevents someone using a stolen card in store (because they won't know the PIN).

It should never be used over the phone, or on web sites, and you should never give your PIN to anyone who asks for it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.