I have never heard of credit card PINs being required for online purchases. Why is this? Wouldn't it drastically reduce online fraud? Physically stolen credit cards couldn't be used in online transactions either if a PIN was required.

  • With respect to EMV chip cards, the PIN is used in conjunction with the chip itself, which is not utilized in a CNP (card not present) transaction (such as an online purchase). Mar 12, 2017 at 4:33
  • Websites get hacked all the time and when they do, this would just be giving up another piece of valuable information. Which can be used to cash out at the ATM assuming the attacker also has the track data. Something interesting I found out is some credit card companies allow you to setup a password for online purchases.
    – nd510
    Mar 12, 2017 at 6:32
  • 1
    credit cards don't have PINs, so that might be explain some of it...
    – dandavis
    Mar 12, 2017 at 7:51
  • In my country, I've to enter PIN for shopping and for online purchases I enter PIN+OTP.
    – defalt
    Mar 12, 2017 at 7:55
  • @dandavis, in Canada all credit cards have had pins for 5 years now. I think they are less common in the US.
    – Elias
    Mar 13, 2017 at 1:50

1 Answer 1


Consider the threat model -- today, a rogue website (or one taken over by an attacker) can siphon off your credit card number and make fraudulent purchases.

Ok, so we implement a PIN, required for online purchases.

The same rogue website just asks you for your PIN too, and then uses those to make fraudulent purchases.

The method they use in Europe (IIRC) uses the PIN in conjunction with a chip on the card, which prevents the website from being able to give up that authorization to an attacker. I'm not sure of the actual method, but I'd imagine the PIN unlocks a certificate on the chip, and the certificate is used to sign the transaction.

  • 1
    That's not the only way cards get stolen, though; there are also the more pedestrian physical attacks like card skimmers at gas stations. Mar 12, 2017 at 15:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .