Published by the PCI SSC, PCI Software-based PIN Entry on COTS (SPoC) is a standard that provides a software-based approach for protecting PIN entry on various commercial off-the-shelf devices on the market (such as smartphones and tablets).
Are SPoC and PIN on Glass the same thing?
No. The SPoC Standard covers a software-based approach for accepting the PIN as a cardholder verification method on a device running the merchant's commercial off-the-shelf solution.
PIN on Glass refers to PIN entry on the touchscreen of a PCI-approved payment device. Since the device has no physical keypad for PIN entry, this differs from PIN entry on that type of terminal.
What components make up a SPoC solution?
A SPoC Solution consists of an SCRP (Secure Card Reader - PIN), a PIN CVM application, the merchant's COTS device, and back-end monitoring and attestation systems. All of these elements work together to ensure that the PIN accepted by a software application on the COTS device is isolated from other sensitive data (card number, CVV, expiration date, etc.) on the COTS device. The back-end monitoring and attestation systems continuously monitor the entire solution for abnormal conditions and check for tampering or physical attacks. In other words, in a SPoC Solution, the merchant-facing COTS device is only one element of the entire solution.
Does SPoC support contactless transactions?
Are EMV-based contactless transactions permitted under Software-based PIN Entry in the COTS (SPoC) Standard?
The COTS standard was developed for chip-based transactions that support dynamic transaction data. Because it has static transaction data, transactions made by reading a contact magnetic stripe are excluded. Contactless magnetic-stripe reading capabilities within SCRPs, and the acceptance or processing of contact magnetic-stripe transactions by SPoC solutions, are not permitted.
Are magnetic-stripe transactions within the scope of SPoC?
Are transactions made by reading a magnetic stripe permitted under Software-based PIN Entry in the COTS Standard?
No. Contact magnetic-stripe readers (MSR) are not permitted in a SPoC Solution. As part of a Solution, only a Secure Card Reader - PIN, or SCRP, may be used together with a PIN CVM application. The SCRP is a new Secure Card Reader (SCR) approval class within the PTS POI Standard that does not permit any contact MSR features. The SPoC Standard permits only EMV contact and contactless transactions.
What makes up a SPoC Solution? Does the SPoC standard cover separate components, or is it a single solution?
A SPoC Solution consists of a PCI-approved SCRP(s), a PIN CVM Application, a merchant COTS device, and back-end monitoring and attestation systems. Only the Secure Card Reader - PIN (SCRP) needs to be evaluated as part of the PTS POI Standard. However, all SCRPs associated with a SPoC Solution must be included as part of a SPoC Solution evaluation and must be assessed as part of that SPoC Solution's approval.