At payment points such as ATMs and POS terminals, the most critical step is PIN verification, or verifying the customer through their identity information. However, since identity verification cannot be performed at ATMs, PIN verification becomes even more important.
So how is PIN verification performed?
After the customer inserts the card into the ATM, they are asked to enter the card's PIN. Once the PIN has been entered, the verification step varies depending on whether the card-issuing bank and the ATM-owning bank are the same or different.
If the card-issuing bank and the ATM-owning bank are the same, PIN verification is performed immediately. If verification succeeds, the transaction continues on the ATM.
If the card-issuing bank and the ATM-owning bank are different, the customer is allowed to navigate the menus and select the transaction they want. At the moment the transaction is to be completed, PIN verification is performed before the transaction is routed to the card-issuing bank. If verification succeeds, the transaction proceeds. Otherwise, the transaction is terminated.
Secure transport of the PIN
The PIN entered at the ATM is encrypted instantly within the device's secure PIN entry unit. This encrypted block travels to the bank with the transaction message and is decrypted and verified inside the bank's secure hardware module.
At no stage does the PIN travel across the network in plain form. If the card-issuing bank and the ATM-owning bank are different, the encrypted PIN block is passed from one bank to the other through key translation.
This architecture makes it extremely difficult for the PIN to be intercepted.
