DE 52—PERSONAL IDENTIFICATION NUMBER (PIN) DATA:
This is the field where the PIN data is held. PIN verification is carried out based on this field.
What is a PIN block?
The PIN is never sent in clear in the message. First, a “PIN block” is created in a specific format together with part of the card number. This block is then encrypted with an encryption key. The F52 field contains this encrypted PIN block. The field is 8 bytes long.
How is the PIN protected throughout the message flow?
- The cardholder enters the PIN on the PIN entry device of the POS or ATM.
- The device encrypts the PIN block with the terminal PIN key (TPK).
- The acquiring bank decrypts the encrypted PIN block inside the HSM and re-encrypts it with the key shared with the issuing bank (ZPK).
- The issuing bank verifies the PIN inside its own HSM.
Throughout this process, the PIN is never in clear outside an HSM at any stage.
Relationship with F53
Information on which key and format were used to encrypt the PIN block is sent in the F53 (Security Related Control Information) field. The issuing bank needs this information to verify the PIN.
Offline PIN
For chip cards, the PIN can be verified by the card's chip in some transactions. This is called offline PIN, and in this case the F52 field does not appear in the message because the PIN is not sent to the bank.
