Issuer PIN Security Guidelines - Visa

• The control number should be generated and conveyed to the cardholder
in such a way, e .g . by using a PIN mailer, so that no one other than the
cardholder can associate the control number with that cardholder without
detection .
• The control number should be communicated to the cardholder in such a
way that no one other than the cardholder can have access to it without
detection . The system should have no way of associating a control number
or the authentication values with a specific cardholder’s name, telephone
number, address or account number .
• The PIN advice function should exchange only strings of numbers, (a control
number and authentication values) with the issuer PIN notification system .
• The PIN notification system should re-associate the control number with a
specific account number, validate the cardholder (or the transaction if there
is no mechanism for pre-registration of the cardholder as in an anonymous
gift card) using the authentication values and retrieve the cardholder PIN for
that account number .
• The control number/PIN/authentication values string should not be logged
and should be deleted immediately after use .
• The PIN advice system should be designed and operated under strictly
enforced procedures such that no individual is able to associate any control
number, PIN or authentication values with any specific account number .
• The PIN delivery to the PC should not be associated with any cardholder
account data .
• Cardholder PIN advice may be treated as equivalent to card activation .
• Internet PIN advice should be protected using a secure channel established
between the client application on the user’s PC and the server according to
the principles of ISO/IEC 11770 . In addition the implementation should take
into account MITB and other malware attacks .
• Payment-system brand requirements may apply to third parties outsourced
to perform the service .
• An issuer should ensure that the association of cardholder authentication
credentials with the control number does not weaken the principle that the
control number cannot be used to determine a specific account .
• Cardholder authentication should not be performed by the internet server . It
should be performed by the back end issuer host system and only after the
control number is re-associated with the specific account .
• Web servers should be configured to disable client side caching of web
pages that display PIN and associated data during the internet session .
Issuer PIN Security Guidelines 4 3
Visa Public © 2010 Visa. All Rights Reserved.