Issuer PIN Security Guidelines - Visa

More documents

Recommendations

Info

Additional PIN Management Functions Threats • Infrequently used PIN management procedures and exceptions can be exploited if the procedures and policies applied to them are unfamiliar to issuer personnel or are implemented less securely than the standard PIN management procedures . For example a lower assurance authentication mechanism may be used to identify the cardholder Special Procedures for PIN Management Compromised PIN • Where any special procedures are used to manage PINs, for example to blind or partially sighted cardholders, these procedures should be carefully vetted and rigorously applied to avoid a greater possibility of compromise . For example a P2P contact may be required . • Issuers should specify the suspicious events that indicate a PIN is suspected of compromise . • If a PIN is suspected of compromise – The compromised PIN should be deactivated as soon as possible, – The cardholder should be informed of options available to request a new PIN, – The replacement PIN should not intentionally be the same as the compromised PIN – Activation of the replacement PIN may be implicit or explicit – If the compromised PIN was a derived PIN, then at least one element used in deriving the prior PIN should be changed when the new PIN is created . – Fraudulent transactions must be reported to the networks in accordance with payment-system brand rules Forgotten PIN • If a cardholder forgets his/her PIN: – The new PIN should not be replaced within an interchange environment, – The PIN replacement should be performed through the issuer’s systems PIN UNBLOCK • Card issuers may choose to implement additional or alternative security measures before executing the PIN UNBLOCK function through an ATM, in which case the ATM display should advise cardholders to contact the card issuer . • Chip enabled ATMs should support Issuer Script Messaging and the PIN CHANGE/UNBLOCK command . • Cardholders should be provided with unambiguous guidance for the PIN UNBLOCK procedure . 4 8 Issuer PIN Security Guidelines Visa Public © 2010 Visa. All Rights Reserved.
• Cardholders should be informed at the ATM whether PIN UNBLOCK has been successfully applied . • When a PIN-blocked card has successfully completed an on-line PIN verification at an ATM, the issuer should unblock the PIN . PIN Activation • A PIN may be activated either implicitly or explicitly . If the PIN activation is explicit: – Receipt of the PIN by the cardholder should be acknowledged through signed and verified means . – Neither the PIN Receipt nor the response should contain the PIN . PIN Deactivation • The PIN should be deactivated by the issuer when one or more of the following occur: – The PIN is or is suspected to be compromised, – All accounts associated with the PIN are closed, – The issuer determines that deactivation is appropriate, • In the case of a PIN compromise, or a deactivation request by the cardholder, the cardholder should be advised of the action taken, • The issuer should take appropriate measures to ensure the deactivated PIN cannot subsequently be used with its original associated accounts . Issuer PIN Security Guidelines 4 9 Visa Public © 2010 Visa. All Rights Reserved.
Page 1:
Issuer PIN Security Guidelines Nove
Page 5 and 6: Table of Contents Using This Docume
Page 7 and 8: Using This Document Purpose This ma
Page 9 and 10: Issuer Approved PIN Entry • Offli
Page 11 and 12: General PIN Management Guidelines T
Page 13 and 14: PIN Fraud Mitigations Abbreviations
Page 15 and 16: Abbreviation Description PSTN Publi
Page 17 and 18: Term Definition Issuer Approved dev
Page 19 and 20: Term Definition POS Device Any devi
Page 21 and 22: 10 . ISO/IEC 13491: Banking—Secur
Page 23 and 24: Guidelines for Issuer Approved Devi
Page 25 and 26: Personal PIN Entry Devices Provided
Page 27 and 28: Offline PIN Generation Issuer Assig
Page 29 and 30: • The PIN selection system should
Page 31 and 32: PIN Verification Values General Gui
Page 33 and 34: • Any cryptographic algorithm use
Page 35 and 36: issuers PIN storage processes, incl
Page 37 and 38: See the PIN handling device managem
Page 39 and 40: • Transported clear text key comp
Page 41 and 42: PIN Handling Device Management Obje
Page 43 and 44: Cardholder Authentication to PIN Ma
Page 45 and 46: PIN Advice Objective Plaintext PINs
Page 47 and 48: PIN Advice by SMS • The issuer sh
Page 49 and 50: • The control number should be ge
Page 51 and 52: Call Center Use Generation of the C
Page 53: - The keyboard is controlled by sec
show all

Issuer PIN Security Guidelines - Visa

Create successful ePaper yourself

Delete template?

Save as template?