The migration to EMV chip cards represented one of the most significant security upgrades in the U.S. payments industry, but it also introduced confusion about how cardholder authentication should work. While many consumers associated EMV technology with chip-and-PIN, the reality was more nuanced. Different markets adopted different authentication methods based on their payment infrastructure, fraud landscape, and transaction processing capabilities.
Visa’s guidance clarifying that the United States did not require offline PIN authentication helped distinguish between EMV security standards and specific cardholder verification methods. Because U.S. payment networks rely heavily on real-time authorization, online PIN and other authentication methods could provide the necessary security without the additional complexity and cost of supporting offline PIN.
Since Visa first announced its support for a U.S. migration to EMV cards, plenty of questions have cropped up. One of the most persistent is the question of the PIN number and especially the status of the off-line PIN that’s used in so many other countries. Last week, Visa released a clarifying set of guidelines that say the United States does not need such off-line PIN capability (link below). The distinction between offline and online PIN is an important one as the offline card requires significant added cost given the cryptographic capabilities the process requires. For the U.S. market, that cost is very hard to justify as the need for it is very very low, applicable only to travelers visiting other countries and in very specific situations.
The difference between an online and off-line PIN is that an online PIN is not stored on the card. Once the cardholder enters the PIN at the point of sale terminal, the PIN is encrypted by the PIN pad and sent online to the host for validation, similar to how PIN debit transactions are authorized today.
In an off-line PIN situation, the PIN is stored securely on the chip card and during a transaction, when the cardholder enters the PIN, the POS terminal sends the PIN to the chip card for verification. The cardholder verification therefore takes place within the chip card.
“One thing that’s clear from the questions is that there’s a lot of confusion around the myth that EMV means chip-and-PIN. It doesn’t in many countries, including the U.S.,” Ericksen wrote in an online entry about the recommendations. “That’s because, in the U.S., we can rely on online processing where transactions are transmitted in real-time to the issuer for approval. With that in place, there’s no need for the off-line authentication that was the genesis of chip-and-PIN.”
Understanding the distinction between online and offline PIN remains important when evaluating EMV card security. Although offline PIN plays a valuable role in certain international markets, the U.S. payments ecosystem is built around real-time transaction authorization, making online authentication a practical and cost-effective approach. The evolution of EMV has demonstrated that successful payment security depends on matching authentication methods to the needs of each market rather than applying a single global standard.
Visa’s recommendation document is here: http://usa.visa.com/download/merchants/bulletin-chip-recommended-practices.pdf
