ISO 9564-4:2016

Overview

ISO 9564-4:2016 - "Financial services - PIN management and security - Part 4: Requirements for PIN handling in eCommerce for Payment Transactions" defines minimum security requirements and practices for using cardholder Personal Identification Numbers (PINs) in eCommerce. It addresses scenarios where the cardholder, merchant and payment device are separated across an open network and specifies acceptable device types and handling methods to protect cardholder PINs used for card-based verification. This part is one element of the ISO 9564 series (see Related Standards).

Key topics and technical requirements

• Prohibition on NAD PIN entry: PINs must not be entered into a Network Access Device (NAD) such as a personal computer, mobile phone or other general-purpose device connected to an open network.
• Approved device types:
  • PED (PIN Entry Device) compliant with ISO 9564‑1 (traditional secure PIN entry devices).
  • FSPED (Functionally Secure PIN Entry Device) - a limited-function device with a contact IC reader, numeric keypad and display used exclusively with IC cards to generate a One-Time Token (OTT).
  • ICCPED (Integrated Circuit Card PIN Entry Device) - self-powered IC cards with integrated keypad/display that generate an OTT after PIN entry.
• One-Time Token (OTT) model: The IC card generates a cryptographic value after PIN entry; the OTT (possibly formatted by the FSPED) is entered or transferred into the NAD and sent to the issuer for verification.
• FSPED technical controls (selected requirements from the standard):
  • Tamper-resistant physical design - modifications require physical penetration and are likely visible to the user.
  • Device must not disclose PIN values (no visual/auditory leaks).
  • Single unit containing reader, processor, keypad, display and memory.
  • Immediate erasure of PIN from device memory after submission to the IC card.
  • Cryptographically authenticated software updates applied in sequence.
  • No forwarding of externally originated PIN verification commands.
  • FSPED does not contribute cryptographically to the OTT (may only encipher PIN to the IC card).
• Cardholder guidance: Issuers should instruct cardholders not to use FSPEDs from untrusted sources, to remove the card after use, and to stop using devices that appear tampered or damaged.

Practical applications - who uses this standard

ISO 9564-4 is used by:

• Card issuers and their agents implementing PIN-based eCommerce verification.
• Payment scheme operators, acquirers and PSPs designing secure online payment flows that involve cardholder PIN verification.
• Device manufacturers and integrators developing FSPEDs, ICCPEDs or PEDs for eCommerce OTT generation.
• Security architects and compliance teams who must ensure PIN handling in eCommerce meets minimum international requirements.

Use cases include secure remote PIN verification for card‑originated eCommerce transactions where the PIN cannot be entered into insecure NADs and an OTT-based workflow is required.

Related standards

• ISO 9564‑1 - Basic principles and requirements for PINs in card-based systems (PED requirements).
• ISO 9564‑2 - Approved algorithms for PIN encipherment.
• ISO/IEC 7816 - Integrated circuit cards standards (referenced for ICC definitions).

Keywords: ISO 9564-4, PIN handling in eCommerce, FSPED, ICCPED, OTT, PIN security, cardholder PIN, NAD, eCommerce payments.