PIN Transaction Security (PTS) is the process of verifying that card data and PIN information are used for a payment transaction.
In other words, we can say that PTS is a set of modular evaluation requirements managed by the PCI Security Standards Council for PIN-accepting terminals.
PIN Transaction Security (PTS) devices are used to capture card data and verify authorization to use the card for a transaction when a card-based transaction is performed in a store.
Devices used for transactions must hold the necessary approvals in compliance with the PCI PTS standard.
What does PCI PTS evaluate?
The PCI PTS evaluation covers various security requirements for PIN entry devices:
- The device's resistance to being physically opened or tampered with
- Encryption of the PIN within the device, so that it is never exposed in clear form
- Secure storage of the encryption keys within the device
- Protection of the device's software against unauthorized changes
Certificate validity period
PCI PTS approvals are valid for a specific period. Device models whose approval period has expired cannot be newly deployed to the field. Devices already deployed in the field are also expected to be replaced with newer ones within a certain period. For this reason, banks take into account how long a model's PCI PTS approval remains valid when selecting a POS device.
List of approved devices
The PCI Security Standards Council publishes the list of approved devices on its website. Banks and merchants can check whether the device they intend to use appears on this list.
Difference from PCI DSS
PCI DSS regulates the security of the systems of organizations that process card data. PCI PTS, on the other hand, regulates the security of the devices through which card data and the PIN are captured. Both standards form different parts of the overall security of card payments.
