Issuer PIN Security Guidelines - Visa

• The PIN distribution system should have a fail-safe feature that limits the
number of attempts made to obtain a PIN . This system feature should alert
the service provider whenever this parameter is exceeded .
• When the PIN is to be sent to the cardholder, it may be decrypted and a
string of numbers passed to the distribution mechanism or channel (e .g . the
PSTN operator or email system) .
• The PIN distribution system should not contain any other cardholder data
(e .g . PAN, cardholder name) .
• The association of the PIN to a specific account should not be possible with
the authorised information available in the distribution system .
• The PIN distribution system should not link to any other system where
associated cardholder data could be accessed .
• The identification value, PIN and authentication value should not be logged
and should be deleted immediately after successful delivery is confirmed .
• If the PIN is not delivered to the cardholder then it should be deleted from
the system after the period required by issuer policy .
• It should not be possible to identify the type of cardholder payment device
or the account from the SMS message containing the PIN .
PIN Advice by Internet
PIN advice by internet requires the cardholder to communicate credentials in
exchange for the PIN to the issuer’s PIN notification system via an intermediate
internet based PIN advice function .
• The issuer should provide the cardholder with security guidance for the
management of PCs used for PIN management . This should include advice
about the risks of malware and of storing account data on the PC .
• PIN advice by internet should protect the PIN using commensurate
cryptographic protection as when PINs are transmitted during transaction
processing, until it arrives at the cardholder’s computer .
• PIN advice by internet should be accomplished by instructing the cardholder
to enter pre-established credentials: for example a control number, a chosen
PIN and authentication values .
• The security of the PIN advice implementation is based on the premise that
no individual can associate the control number with a specific account .
• The control number and authentication values should not disclose the
account number .
• The control number and authentication values should be communicated to
the cardholder using a different mechanism
• Any cryptographic key used to generate a control number should not be
used for any other purpose and should be managed in accordance with ISO
11568 .
4 2 Issuer PIN Security Guidelines
Visa Public © 2010 Visa. All Rights Reserved.