What Is a PIN? Personal Identification Numbers in Banking

Search Fintrev

Search our guides, reviews and glossary.

A personal identification number (PIN) is a short secret code, usually four to six digits, that proves you are the authorized user of a card, account or device. In banking, it is the code you enter at an ATM or a store terminal to approve a debit card transaction. The phrase “PIN number” is redundant, since the N already means number, but it means the same thing.

What Is a PIN?

A PIN is any numeric code used to confirm a person’s identity before a system grants access. The idea dates to the cash machines of the mid-1960s, when Scottish engineer James Goodfellow patented a system pairing a machine-readable card with a personal number. The card is something you have, the PIN is something you know, and requiring both means a stolen card alone should not be enough to drain an account.

PINs are either assigned by the bank or chosen by the account holder. An assigned PIN is often mailed separately from the card, so intercepting one envelope does not give a thief both pieces. Customers may choose their own at a branch, at an ATM, by phone or in the bank’s app.

The same mechanism unlocks smartphones, SIM cards, alarm keypads and voicemail. Some banks also issue a telephone banking PIN so callers can verify themselves by phone. It may differ from the card PIN.

How a PIN Works

When you enter a PIN at an ATM or payment terminal, the PIN pad encrypts it immediately. The encrypted value is then checked inside secure hardware at the bank or card network against the value on record. Banks do not store PINs in plain text, so an employee cannot look up your PIN. A forgotten PIN is reset, not retrieved.

With chip cards, verification can happen in one of two places:

• Online PIN verification: the encrypted PIN is sent to the card issuer, which confirms it as part of authorizing the transaction. ATM withdrawals work this way.
• Offline PIN verification: the chip on the card checks the PIN itself, and the terminal receives a yes or no result. This is common in parts of the world where chip-and-PIN cards are standard.

Interpreting a PIN

The digits of a PIN carry no information about you or your account. A card number identifies the issuer and account and is checked with the Luhn checksum to catch typos. A PIN has no internal structure to validate: it is only a match or a mismatch.

What gives a PIN its strength is the combination of the number of possible codes and the number of attempts allowed. Issuers lock or block a card after a set number of incorrect entries, so an attacker cannot simply try every combination at a terminal. On a phone, repeated failures may trigger delays or, depending on settings, erase the device.

Why Is a PIN Important?

A PIN makes card fraud harder in the situations where the physical card is present. Someone who finds or steals a debit card can see the card number, expiration date and security code printed on it, but not the PIN. Without it, they cannot withdraw cash from an ATM, and they are blocked from purchases that require PIN entry.

In the United States, debit purchases can run as PIN debit, authorized with the PIN over debit networks, or as signature debit, which runs over the card brand’s network without a PIN. Signature debit is often labeled “credit” at the terminal, even though money still leaves your checking account. Contactless taps below a limit set by the issuer, network or country may also go through without a PIN. So not every debit transaction requires one.

PINs also extend beyond cards. The IRS offers a six-digit Identity Protection PIN (IP PIN) that taxpayers can obtain through the IRS website; once you have one, it is used when filing your federal tax return to confirm the return is genuinely yours. Phones protected by a PIN also guard the banking and payment apps installed on them, including the cards stored in a digital wallet.

Example of a PIN

As a hypothetical example, take a card with a four-digit PIN, chosen truly at random, that is blocked after three wrong entries. A thief guessing blindly has three chances out of 10,000 possible codes:

• 3 ÷ 10,000 = 0.0003, or a 0.03% chance of getting in before the card locks.

With a six-digit random PIN and the same three-attempt limit:

• 3 ÷ 1,000,000 = 0.000003, or a 0.0003% chance.

Now suppose the cardholder chose a PIN based on a birth year, and the thief has the wallet with a driver’s license inside. The realistic candidates shrink from 10,000 to a handful, and three attempts may be enough. The math holds only when the PIN is genuinely unpredictable.

PIN vs. Password, Passcode and CVV

These terms are often used interchangeably, but they verify different things.

PIN vs. password. A PIN is short and usually digits only. A password can be longer and mix letters, numbers and symbols, giving far more combinations. Online accounts need that because they can be attacked remotely at scale. A PIN is built for quick keypad entry and compensates by being tied to a specific card or device and by locking after a few failures.

PIN vs. passcode. “Passcode” is a broader term. On phones, a passcode can be a numeric PIN or an alphanumeric code. Some systems allow PINs with letters, but standard bank card PINs are numeric.

PIN vs. CVV. The card verification value (CVV or CVC) is the three- or four-digit code printed on the card. It shows that the payer has the card details and is used mainly for online and phone purchases. The PIN is never printed on the card. It shows that the person holding the card is the authorized user, so it is used mostly at ATMs and in person.

PIN vs. card number. The 15- or 16-digit card number identifies the account and the issuer. It is shared with every merchant you pay. Your PIN should be shared with no one.

How to Choose a Strong PIN

• Avoid the obvious. Codes such as 0000, 1111, 1234 and 1212 are among the first an attacker would try. Some systems also reject repeated digits, simple sequences or a code you have used before.
• Skip personal data. Birthdays, anniversaries, phone numbers, house numbers and parts of a Social Security number can be found in documents or online.
• Use more digits when offered. If your bank or device allows a PIN longer than four digits, a longer code multiplies the number of combinations.
• Use different PINs for different things. A phone unlock code that matches your debit card PIN means anyone who watches you unlock your phone has your card PIN too.
• Never write it on or near the card. A note in the wallet defeats the point of separating the card from the code.
• Shield the keypad. Cover your hand when entering a PIN at an ATM or checkout, since cameras and onlookers can capture entries.
• Change it if you suspect exposure. If you think someone saw your PIN, or a card was used without your permission, change it promptly and contact your bank.

A legitimate bank has no reason to ask for your full PIN by email, text message or an unsolicited phone call. A request like that is a strong sign of a scam.

Limitations of a PIN

A PIN protects card-present transactions but does little for card-not-present fraud. Online purchases usually rely on the card number, expiration date and CVV, so a thief who copies those details can shop online without ever knowing the PIN.

PINs can also be captured. Skimming devices fitted over ATM card slots, combined with hidden cameras or fake keypads, can record both the card data and the PIN. Shoulder surfing achieves the same thing with no equipment at all.

Important: In the United States, the Electronic Fund Transfer Act and Regulation E limit your liability for unauthorized debit card transactions, but the limit depends on how quickly you report the problem. If you notify your bank within two business days of learning that your card or PIN was lost or stolen, your liability is capped at $50. After that, it can rise to $500, and transfers that you fail to report within 60 days after your statement is sent can leave you without protection for later losses. Reporting fast matters more than with most credit card fraud.

The Bottom Line

A PIN is a short numeric secret that ties a card, account or device to its owner. It is one layer of protection, not a complete safeguard. For payments that do not use a PIN at all, such as PayPal or other app-based transfers, account passwords and multi-factor authentication take over that role.

FAQs