IT lexicon › Security › Offline PIN

Offline PIN

Security På svenska → Updated: 2026-10-31

PIN verification in which the card's chip decides whether the code is right, without asking the bank.

The terminal hands the entered PIN to the chip with a VERIFY command, and the chip compares it with its own copy. In the older plaintext variant the PIN crosses the contacts between terminal and card in the clear. In the enciphered variant it is first encrypted under an RSA public key supplied by the card, so a tampered terminal sniffing the line gets nothing useful. The issuer learns the outcome after the fact, from fields carried in the authorisation.

The method exists because terminals were not always online, and it remains common across Europe. The US largely skipped it, going from magstripe to chip-and-signature. The alternative, online PIN, encrypts the code into a PIN block that the issuer checks. Offline PIN is cheaper but moves the trust to the chip and the terminal, which is exactly where the attacks have landed.

← Back to the lexicon