Personal Identification Number (PIN)
PCIComplianceHubLast updated
A secret numeric code the cardholder enters at a PIN entry device to prove they are entitled to use the card, most often at a point-of-sale terminal or cash machine. PCI DSS classes the PIN, and the PIN block that carries it, as Sensitive Authentication Data: neither may be stored once the authorisation process is complete.
Applies to. The PIN is in scope for any entity that accepts PIN-based card-present transactions or processes them downstream: merchants with PIN entry devices, and the acquirers and processors behind them. 3.3.1.3 forbids storing the PIN or the PIN block after authorisation, and the assessor checks data sources to confirm it. Beyond the entry device the PIN should travel only as an encrypted PIN block, so a clear PIN found anywhere in a merchant's systems is a serious finding.
Example. A supermarket chain records keypad input on its self-checkout lanes for a usability study. The capture includes the digits customers type at the PIN prompt. That is stored PIN data whatever the study's purpose, and it puts the chain in breach of 3.3.1.3 until the recordings are destroyed and the capture is switched off for the payment step.
Limits. A card PIN is not a login PIN. A numeric code used to sign in to a system is an authentication factor under Requirement 8, with different rules on length, change and protection. The card PIN is also not the card verification code: the code is printed on or encoded in the card, the PIN is known only to the cardholder. And 3.3.1.3 is about retention after authorisation; the PIN must still pass through the terminal and the network to be checked, and that transit is protected by PIN encryption controls outside the scope of 3.3.1.3.
In PCI DSS v4.0.1. 3.3.1.3