Issuer PIN Security Guidelines - Visa

More documents

Recommendations

Info

Abbreviation Description DTMF Dual tone multi frequency EMV the jointly agreed specifications for ICC-terminal operation FIPS Federal Information Processing Standards GSM Global System for Mobile HSM Hardware Security Module IC Card / ICC Integrated Circuit Card (same as smart card) ISO International Standards Organization IFD Interface Device IVR Interactive Voice Response IMSI International Mobile Subscriber identity LAN Local Area Network MAC Message Authentication Code MCC Merchant Category Code . MITB Man In The Browser MITM Man In The Middle MO/TO Mail order Telephone order MSP Member Service Provider MSISDN Mobile Subscriber Integrated Services Digital Network Number NFC Near Field Communication NIST National Institute of Standards and Technology PAN Primary Account Number PC Personal Computer PCI Payment Card Industry PED PIN Entry Device PIN Personal Identification Number POI Point of Interaction POS Point-of-Sale PSD Physically Secure Device 8 Issuer PIN Security Guidelines Visa Public © 2010 Visa. All Rights Reserved.
Abbreviation Description PSTN Public Switched Telephone Network P2P Person to Person PVV PIN Verification Value RF Radio Frequency RSA Rivest, Shamir and Adleman (an asymmetric encryption algorithm, named after its inventors) SCD Secure Cryptographic Device (as defined in ISO 13491-1) SIM Subscriber Identification Module SMS Short Message Service SSL/TLS Secure Socket Layer/ Transport Layer Security TDES Triple DES TPP Third Party Provider UTC Coordinated Universal Time WAN Wide Area Network Terminology The following table provides definitions of the key terms used in this manual . Term Definition Account Data (PCI definition) At a minimum, account data contains the full PAN and (if present) any elements of sensitive authentication data . The following are also considered to be account data if sent in conjunction with the PAN: cardholder name, expiration date or service code . Account holder See cardholder . Account issuer The entity with which the cardholder has an account used to make payments . For single application cards, this is the same as the card issuer . Associated data All data associated with a PIN, including cardholder data . (See Cardholder Data) Authenticity The property of data or an entity that identifies origin . Best practice Security techniques that reduce risk at a practical cost . Call center A facility for managing telephone requests . Issuer PIN Security Guidelines 9 Visa Public © 2010 Visa. All Rights Reserved.
Page 1: Issuer PIN Security Guidelines Nove
Page 5 and 6: Table of Contents Using This Docume
Page 7 and 8: Using This Document Purpose This ma
Page 9 and 10: Issuer Approved PIN Entry • Offli
Page 11 and 12: General PIN Management Guidelines T
Page 13: PIN Fraud Mitigations Abbreviations
Page 17 and 18: Term Definition Issuer Approved dev
Page 19 and 20: Term Definition POS Device Any devi
Page 21 and 22: 10 . ISO/IEC 13491: Banking—Secur
Page 23 and 24: Guidelines for Issuer Approved Devi
Page 25 and 26: Personal PIN Entry Devices Provided
Page 27 and 28: Offline PIN Generation Issuer Assig
Page 29 and 30: • The PIN selection system should
Page 31 and 32: PIN Verification Values General Gui
Page 33 and 34: • Any cryptographic algorithm use
Page 35 and 36: issuers PIN storage processes, incl
Page 37 and 38: See the PIN handling device managem
Page 39 and 40: • Transported clear text key comp
Page 41 and 42: PIN Handling Device Management Obje
Page 43 and 44: Cardholder Authentication to PIN Ma
Page 45 and 46: PIN Advice Objective Plaintext PINs
Page 47 and 48: PIN Advice by SMS • The issuer sh
Page 49 and 50: • The control number should be ge
Page 51 and 52: Call Center Use Generation of the C
Page 53 and 54: - The keyboard is controlled by sec
Page 55 and 56: • Cardholders should be informed

Issuer PIN Security Guidelines - Visa

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?