Skip to content

Credit Card

What should be considered when setting a card PIN?

· Payment systems expert and technology executive~1 min read
Hand entering a PIN code on a card payment terminal

A credit card is one of the most important payment tools in our lives. For this reason, keeping our credit cards secure is extremely important.

So how do we secure our credit card?

The most important security measure used for credit card security is the card PIN. In particular, with Chip&PIN technology, card copying and fraudulent transactions carried out by stealing other information have been significantly reduced.

What should be considered when setting a card PIN?

  • For the security of the card PIN, it should generally consist of 4 digits and must never contain consecutive numbers (such as 1,2,3,4). According to research, the most insecure PINs are those containing consecutive digits like 1234.
  • Due to security rules adopted by some banks, card PINs cannot start with the digit zero (0).
  • A birth date should not be set as the card PIN.
  • The card PIN should be memorable, but not easily guessed by others.
  • The card PIN should be changed periodically and should differ from previously used PINs.

In short, since the limit defined on a credit card is essentially our cash, the utmost care should be taken with card PIN security, which is the most important factor in protecting that limit.

Translated from the Turkish original. Read the original in Turkish.

Comments (3)

Readers commented on the Turkish original, so the comments below are in Turkish.

  1. umut

    Kredi kartı şifresini 0 ile başlatmayan bankalara örnek İş bankası. Ancak bu bankadan kullandığım kartımın şifresini örneğin Vakıfbank ATM’sinden 0 ile başlayacak şekilde değiştirebiliyorum. Kart şifresinin kontrolü kartı çıkaran bankada değil mi? Yada İş bankası ATM’sinde işlem yaparken İş bankası durumu farkedip düzelttiremiyor mu?

    1. Arif Ünal

      Normal şartlar altında kart şifre belirleme kontrollerinin tek bir noktadan yönetilmesi beklenir.
      Sizin belirttiğiniz durumun iki açıklaması olabilir.
      1.İş bankası ATMsinden yapılan şifre değiştirme işleminde şifre doğrulaması banka sistemine gitmeden ATM üzerinden yapılması.
      2. Onus (bankanın kendi kartı ile kendi ATMsinden işlem yapması) ve Not Onus (bankanın kendi kartı ile başka banka ATMsinden işlem yapması) şifre belirleme akışlarının farklı kodlanması.
      İş bankasına bildirmek faydalı olacaktır:)

  2. umut

    Valla bence bildirmeyin İş Bankasına, maaş kartım Vakıfbanktan, Amex Kartım garanti, en sık kullandığım enpara kartım var, birde işbankası kartı. Hepsinin şifresini aynı yapmam gerekiyor. İş bankası ATM’sinden 0’la başlayan şifre yapamadığım için gelen kredi ve banka kartlarının şifrelerini hep Vakifbank ATM’sinden değiştiriyorum 😀 Başka banka ATM’lerinden denemedim aklıma gelmişken bir bakayım bir ara.

Leave a comment on the original article (the form is in Turkish; comments in English are welcome).

Illustration of customer-based contactless card limit management

Payment Systems

Can a Card's Contactless Limit Be Managed on a Per-Customer Basis?

Contactless payment has greatly improved the user experience, yet its fixed transaction limit is a common complaint. Can this limit be managed dynamically per customer? This post covers the current situation, technical and regulatory requirements and the outlook.

Contactless card payment at an overseas POS terminal that prompts for a PIN after a limit is exceeded

Payment Systems

Visa Overseas Contactless Transactions – After Code 70 (Part 2)

After switching to response code 70 for contactless limit-exceeded cases, we found that some overseas POS devices and acquirers did not handle it as expected. This post covers why the problem lies in the ecosystem and how to address it.

Contactless card payment on a POS terminal abroad

Credit Card

On the Issue with Visa Contactless Transactions Abroad...

From the outside, Visa contactless looks simple, but once the limit is exceeded and PIN comes into play it gets deeper. Why do response codes 65 and 70 behave so differently on POS devices in different countries, such as the Netherlands and Saudi Arabia?