PCI Watch

Tracking changes across the Payment Card Industry

SB nº 163: Changes to PIN Pad requirements (Spec Change)

v1.0 Specification Bulletins
Contact

Specification Bulletin No. 163 First Edition May 2015 Changes to PIN Pad requirements This Specification Bulletin updates the PIN Pad requirements in the EMV Integrated Circuit Card Specifications.

Applicability

This Specification Bulletin applies to:  EMV Integrated Circuit Card Specifications for Payment Systems Version 4.3 Book 1 [EMV Book1]  EMV Integrated Circuit Card Specifications for Payment Systems Version 4.3 Book 2 [EMV Book2]  EMV Integrated Circuit Card Specifications for Payment Systems Version 4.3 Book 3 [EMV Book3]  EMV Integrated Circuit Card Specifications for Payment Systems Version 4.3 Book 4 [EMV Book4]

Related Documents

N/A.

Description

This bulletin describes changes to PIN Pad related parts of the EMVCo specifications to:  clarify that the terms “PIN Pad” and “PIN Entry Device” are equivalent.  increase flexibility for PIN Pad layouts.  remove a requirement for PIN Pads to be tamper evident, since PIN Pad security is addressed by individual payment systems.

Specification Changes The term “PIN Entry Device” is in common use in the industry. The EMVCo specifications currently only use the term “PIN Pad”. The changes below clarify that the terms “PIN Pad” and “PIN Entry Device” are equivalent. Please update the definition for “PIN Pad” in Section 3 of EMV Books 1, 2, 3 and 4 as below: PIN Pad Arrangement of numeric and command keys to be used for personal identification number (PIN) entry. Also known as a “PIN Entry Device” (PED). Innovative PIN entry devices are being developed, for which a traditional PIN Pad layout is not always appropriate. The changes below continue to recommend that a standard layout is used, but increase flexibility for PIN Pad design. Please update EMV Book 4 section 7.1.2 as below: If the terminal supports PIN entry, a separate keypad may be present for PIN entry or the same keypad may be used for both PIN entry and entry of other transaction related data. The PIN pad should shall comprise the numeric and 'Enter' and 'Cancel' command keys. If necessary, the command key for 'Clear' may also be present. It is recommended that the numeric layout of the PIN pad shall comply with ISO 9564 as shown in Figure 4, except for cardholder controlled terminals such as personal computers (PCs), where the keyboard may contain a numeric keypad in a different format for PIN entry. An example of the placement of the 'Cancel' and 'Enter' keys on the bottom row is shown in Figure 4. Security testing for PIN Pads is out of scope for EMVCo and addressed by individual payment systems. Please update Book 2 section 11.1 as below: A PIN pad is shall be a tamper evident device and shall support entry of a 4-12 digit PIN. Security requirements for PIN pads are addressed by individual payment systems. For general PIN management and security principles, refer to ISO 9564.