Society of Payment Security Professionals - Payment Security Blog

Online PIN Debit; Great Idea or Not so Great Idea?

I (Chris) want to thank Susan Kohl for sending this over.  Digital Transactions has published several articles on new technology that will allow PIN Debit for eCommerce sites.  Read the article here.

In short, the new technology will present a buyer with a floating ‘PIN Pad’ on the screen. Users can then enter their PIN which will then allow the merchant to immediately debit the user’s account for payment. While the technology appears very compelling from a convenience perspective I have to admit that it also gives me pause.  In my mind, there are a number of potential issues with this technology.  I am sure (or at least hoping) the companies, banks and card brands are working through these issues but they merit discussion here anyhow.

From a security perspective, I am challenged by the technology.  My first thought is key stroke logging and malicious software.  Now I know people will likely say that this is possible with traditional eCommerce transactions.  This is accurate.  In this scenario, however, PIN data is being transmitted.  As discussed in a previous entry, there may not be a limit to the liability associated with compromise of PIN data.  See PIN or PEN in an earlier article.  It brings another question to light, as well.

If the transaction is a ‘card not present’ transaction then where is the PIN Verification Value / PIN Offset stored?  In a traditional PIN Debit transaction it is resident on the magnetic stripe of the card.  This has several benefits one of which is that it prevents a data thief from obtaining a PIN and only the primary account number and being able to conduct PIN based transactions.  If the card is not required to be presented, it appears that this would allow fraudsters to obtain the PAN or other card data and the PIN and conduct transactions.

The technology is being touted as a benefit to issuers and merchants but interestingly nothing has been mentioned about a benefit to cardholders with the exception of saying there is ‘demand’ for PIN based transactions and it will be ‘convenient’.   If someone obtains my own PIN and can empty my bank account immediately, I would probably say that is ‘less convenient’ for me.  Considering I may not have the same liability protection as afforded signature based transactions, then again this would prove problematic.

It is inevitable that PIN based debit transactions arrive online at some point.  I think it is another example of the US’s pursuit of convenience over security.  While the rest of the World moves toward Chip and PIN and E2E encryption, we are moving toward RFID and PIN Debit for online transactions.