Paypr.work Content Resources

PIN Authentication, What is PIN Entry Bypass

Continuing on the topic of PIN authentication there is another area worth diving into that fundamentally adds vulnerabilities to the card ecosystem… namely a process called PIN entry bypass, whereby the requirement to enter the PIN during a card-present transaction is skipped.

PINs are a critical layer of authentication in F2F transactions in the same way that 3DS is in e-commerce transactions. It may therefore seem odd or even counterintuitive that there are instances where this safeguard can be circumvented!

Essentially, in order for a terminal to prompt for a PIN when a customer uses an EMV card (chip and pin card), both the terminal and the card must be configured to allow the PIN entry. There are different scenarios why a POS terminal may not prompt for a PIN entry:

◾The terminal is not set up with the functionality
◾The card used does not support chip and PIN
◾The terminal supports the PIN entry bypass option

The guidelines around this PIN bypass process are defined in the EMV specifications. When a customer bypasses the PIN, it triggers a transaction indicator informing the issuer. This process, of course, bears some important considerations around liability and fraud exposure for the parties involved.

Whilst the EMV migration is a global mandate, a PIN entry bypass has historically been implemented in markets 𝐨𝐧𝐥𝐲 on a temporary basis (e.g. during a migration transition). In the US, however, where I first encountered this, it’s not uncommon to see a PIN bypass option on POS terminals. Card swiping and signature-based verification are also more widely used there compared to other markets.

#DidYouKnow

Card issuers adopt different approaches to PIN bypass, e.g.:

◾Issuers may provide a grace period at the cardholder level, during which transactions can proceed without the PIN entry. After this period, the PIN will be required, or the transaction will be declined.

◾Some issuers use a risk-scoring model that evaluates factors such as the transaction location, Merchant Category Code (MCC), card type, and more to decide whether to allow PIN bypass.

◾While this process supports merchant routing choices, it comes with potential downsides such as issuer declines, lost sales, and increased exposure to fraud.

👉🏽#Paymentexperts, any perspectives to add on #PINbypass ?


𝑾𝒐𝒏𝒅𝒆𝒓 𝒘𝒉𝒐 𝒘𝒆 𝒂𝒓𝒆?

𝘞𝘦 𝘢𝘳𝘦 𝘢 𝘵𝘦𝘢𝘮 𝘰𝘧 𝘗𝘢𝘺𝘮𝘦𝘯𝘵𝘴 𝘚𝘵𝘳𝘢𝘵𝘦𝘨𝘪𝘴𝘵𝘴 𝘣𝘭𝘦𝘯𝘥𝘪𝘯𝘨 𝘰𝘶𝘳 𝘪𝘯𝘥𝘶𝘴𝘵𝘳𝘺 𝘦𝘹𝘱𝘦𝘳𝘵𝘪𝘴𝘦 𝘸𝘪𝘵𝘩 𝘢 𝘤𝘳𝘦𝘢𝘵𝘪𝘷𝘦 𝘢𝘱𝘱𝘳𝘰𝘢𝘤𝘩 𝘵𝘰 𝘢𝘴𝘴𝘪𝘴𝘵 𝘰𝘶𝘳 𝘤𝘭𝘪𝘦𝘯𝘵𝘴 𝘵𝘩𝘳𝘰𝘶𝘨𝘩 𝘊𝘰𝘯𝘴𝘶𝘭𝘵𝘪𝘯𝘨, 𝘚𝘵𝘳𝘢𝘵𝘦𝘨𝘺, 𝘙𝘦𝘴𝘦𝘢𝘳𝘤𝘩 𝘢𝘯𝘥 𝘛𝘩𝘰𝘶𝘨𝘩𝘵 𝘓𝘦𝘢𝘥𝘦𝘳𝘴𝘩𝘪𝘱 𝘱𝘳𝘰𝘫𝘦𝘤𝘵𝘴.

𝑳𝒐𝒐𝒌𝒊𝒏𝒈 𝒇𝒐𝒓 𝒑𝒂𝒚𝒎𝒆𝒏𝒕 𝒍𝒆𝒂𝒓𝒏𝒊𝒏𝒈 𝒓𝒆𝒔𝒐𝒖𝒓𝒄𝒆?

◼️ Sign up to our unique Payment Assets Library here: https://lnkd.in/dVXjGkzB

◼️Follow Paypr.work [ˈpeɪpəwəːk] for more hashtag#paymentinfographics‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍
hashtag#paymentinsights

Share the Post:

You may also be interested in these related topics...

Featured
Report
Premium

Cross-Border Payments: New Report

Article
Featured

Selected Regional Card Networks

Article
Featured
Premium

How Many Payment Methods Are They Really Out there?

Unlock Premium Payment Resources

Subscribe For Full Access

Paypr.work blends payment knowledge and custom research into a simplified yet insightful narration. Our narratives feature visually engaging designs that break down both fundamental and complex payment jargons into bite-sized, repetitive micro-concepts to promote better comprehension and retention.

Sign up for a Paypr.work Premium Membership to exclusively access all of our payment resources, including our full articles, industry insights, ecosystem maps, reports, videos, and our unique library of bespoke infographics.

Don’t miss out— sign up to learn payments in a captivating way!

In Their Own Words... 😉

Paypr work subscription Disclaimer

Your Paypr.work subscription gets you full access to all Paypr.work content in 1 place including: our weekly new payments articles, our infographic blog, exclusive discounts on all the services that Paypr.work has to offer and the opportunity to collaborate on free infographic to promote your knowledge/value proposition and more. The content is for personal use and cannot be copied, reproduced, redistributed, altered, modified, shared publicly or with third-party nor can derivatives of the work be created. The user may share content that is available through the free blog access subject to crediting Paypr.work with the attributions.