Issuer PIN Security Guidelines - Visa

More documents

Recommendations

Info

PIN Advice by IVR PIN advice by IVR requires the cardholder to communicate credentials in exchange for the PIN to the issuer’s PIN notification system via an intermediate IVR PIN advice function . • PIN Advice by IVR should be accomplished by instructing the cardholder to enter pre-agreed credentials: a control number and authentication values . • The control number and authentication values should be communicated to the cardholder using a different mechanism . • The control number and authentication values should not disclose the account number . • Any cryptographic key used to generate a control number should not be used for any other purpose and should be managed in accordance with ISO 11568 . • The control number should be generated and conveyed to the cardholder in such a way, e .g . by using a PIN mailer, that no one other than the cardholder can associate the control number with that cardholder without detection . • The communication to the cardholder should contain the control number and instructions . • The cardholder should be instructed to dial the issuer’s IVR PIN advice function and follow the prompts to enter their control number and one or more authentication values . • The IVR PIN advice function should perform no other function than PIN advice within a single session . • The call should be terminated after the PIN advice has been performed . • The IVR system should have no way of associating a control number or the authentication values with a specific cardholder’s name, telephone number, address or account number . • The IVR PIN advice function should exchange only strings of numbers, (a control number and authentication values) with the issuer PIN advice system . • The PIN notification system should re-associate the control number with a specific account number, validate the cardholder (or the transaction if there is no mechanism for pre-registration of the cardholder as in an anonymous gift card) using the authentication values and retrieve the cardholder PIN for that account number . • The control number/PIN/authentication values string should not be logged and should be deleted immediately after use . • The PIN advice system should be designed and operated under strictly enforced procedures such that no individual is able to associate any control number, PIN or authentication values with any specific account number . 4 4 Issuer PIN Security Guidelines Visa Public © 2010 Visa. All Rights Reserved.
Call Center Use Generation of the Control/ Reference Number Linked to the PAN • Any involvement of a Customer Service Representative (CSR) should respect the principles of PIN advice by IVR and should not request the cardholder’s name or account number . • The IVR system taking part in the PIN advice call should have no way of associating a PIN advice call to the calling telephone number . • Cardholder PIN advice may be treated as equivalent to card activation . • The security of PIN advice by IVR is based on the premise that no individual can associate a control number with a specific account . • Payment-system brand requirements may apply to third parties outsourced to perform the service . • An issuer should ensure that the association of cardholder authentication credential with the control number does not weaken the principle that the control number cannot be used to determine a specific account . • Cardholder authentication should not be performed by the IVR system . It should be performed by a separate back end issuer host system and only after the control number is re-associated with the specific account . • Issuers should ensure that call-center services are unable to divert PIN or sensitive cardholder information to an unauthorized destination for later retrieval . • Where possible, call center personnel activity should be analyzed against compromised cardholder accounts processed by the personnel . • Call center personnel should not request a cardholder to divulge their PIN in an oral or written manner . • Any cryptographic key used to generate the control number should not be used for any other purpose . • Any cryptographic keys to generate the control number should be managed in accordance with the PIN related Key management section . Issuer PIN Security Guidelines 4 5 Visa Public © 2010 Visa. All Rights Reserved.
Page 1: Issuer PIN Security Guidelines Nove
Page 5 and 6: Table of Contents Using This Docume
Page 7 and 8: Using This Document Purpose This ma
Page 9 and 10: Issuer Approved PIN Entry • Offli
Page 11 and 12: General PIN Management Guidelines T
Page 13 and 14: PIN Fraud Mitigations Abbreviations
Page 15 and 16: Abbreviation Description PSTN Publi
Page 17 and 18: Term Definition Issuer Approved dev
Page 19 and 20: Term Definition POS Device Any devi
Page 21 and 22: 10 . ISO/IEC 13491: Banking—Secur
Page 23 and 24: Guidelines for Issuer Approved Devi
Page 25 and 26: Personal PIN Entry Devices Provided
Page 27 and 28: Offline PIN Generation Issuer Assig
Page 29 and 30: • The PIN selection system should
Page 31 and 32: PIN Verification Values General Gui
Page 33 and 34: • Any cryptographic algorithm use
Page 35 and 36: issuers PIN storage processes, incl
Page 37 and 38: See the PIN handling device managem
Page 39 and 40: • Transported clear text key comp
Page 41 and 42: PIN Handling Device Management Obje
Page 43 and 44: Cardholder Authentication to PIN Ma
Page 45 and 46: PIN Advice Objective Plaintext PINs
Page 47 and 48: PIN Advice by SMS • The issuer sh
Page 49: • The control number should be ge
Page 53 and 54: - The keyboard is controlled by sec
Page 55 and 56: • Cardholders should be informed

Issuer PIN Security Guidelines - Visa

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?