Issuer PIN Security Guidelines - Visa

• The PIN selection system should be designed and operated under strictly
enforced procedures such that no individual is able to associate any control
number, PIN or authentication values with any specific account number .
• The PIN selection via the PC should not be associated with any cardholder
account data .
• The security of the PIN selection implementation is based on the premise
that no individual can associate a control number with a specific account .
• Internet PIN selection should be protected using a secure channel
established between the client application on the user’s PC and the server
according to the principles of ISO/IEC 11770 . The implementation should
take into account MITB attacks .
• Payment-system brand requirements may apply to third parties outsourced
to perform the service .
• An issuer should ensure that the association of cardholder authentication
credentials with the control number does not weaken the principle that the
control number cannot be used to determine a specific account .
• Cardholder authentication should not be performed by the internet server . It
should be performed by the back end issuer host system and only after the
control number is re-associated with the specific account .
• Cardholder authentication and generation of the reference PIN should be
done in real time during the session, with the success or failure reported
back to the cardholder .
• Web servers should be configured to disable client side caching of web
pages that display PINs and associated data during the internet session .
Cardholder PIN selection by IVR
• PIN selection by IVR should be accomplished by instructing the cardholder
to enter pre-agreed credentials: a control number, their chosen PIN and
authentication values .
• The control number and authentication values should not disclose the
account number .
• Any cryptographic key used to generate a control number should not be
used for any other purpose and should be managed in accordance with ISO
11568 .
• The control number should be generated and conveyed to the cardholder in
such a way, e .g . by using a PIN mailer, that no one other than the cardholder
can associate the control number with that cardholder without detection .
• The communication to the cardholder should also contain the control
number and instructions .
Issuer PIN Security Guidelines 2 3
Visa Public © 2010 Visa. All Rights Reserved.