There are 3 types of PIN strategy in HCE:
No PIN: Entering a PIN is not required for the application to work. The application must be open on the phone or, if it is not open, it must be selected as the default payment method. Since the mobile device is not passive like a credit card, some checks other than the PIN can be performed.
- Device is active: the device is not in sleep mode
- Device is active and the screen lock has been entered: the mobile wallet can be used if the device is not in sleep mode and the screen is unlocked.
Currently, usage around the world generally works on a No PIN basis.
Card PIN: This is the case where the card PIN is requested during the transaction as an extra security verification.
The card PIN may be requested in 3 situations:
- During registration
- During token download
- At the time of the transaction
Wallet PIN/Customer Biometric Data:
To make an HCE transaction, the mobile application must be activated and, if a password or similar has been set for the application, it must be entered.
Balancing the strategy choice
There is a balance between user experience and security. With the method where no PIN is requested, payment is fast, but the risk increases if the device is stolen. That is why other controls (screen lock, biometric verification, transaction limits) come into play.
Banks can apply an amount-based strategy: no PIN for small amounts, additional verification for large amounts. The choice is made according to the bank's risk appetite and scheme rules.
