What is a chip-and-PIN payment?¶

A chip-and-PIN payment is a card-present transaction where the card’s chip is read and the correct PIN is entered at the terminal.

Avoid this assumption: Successful PIN entry proves the cardholder made the payment.

The transaction record may show that the chip was used, the PIN check succeeded and the issuer authorised the payment.

That is stronger than a record showing only card details were entered, but it still does not identify the person who entered the PIN.

The PIN may have been known by a family member, associate or offender. The cardholder may also have disclosed it or kept it with the card.

Relevant evidence may include terminal ID, merchant location, timestamp, authorisation code, card verification result, PIN outcome and transaction reference.

Merchant CCTV and receipt records may help identify who was present.

The card issuer may also hold information about card status, previous failed PIN attempts, reported loss, replacement and related transactions.

Do not assume that chip use rules out compromise. A genuine card can be stolen and used with a known PIN.

Likewise, do not assume that a transaction is legitimate merely because the chip and PIN were accepted.

Preserve the full transaction record and identify whether any fallback or unusual terminal process occurred.

Ask the issuer what the verification fields mean and whether the transaction followed normal chip-and-PIN processing.

Compare the payment with card possession, user location, CCTV, communications and other account activity.

When reporting, state that the payment was completed using the chip and a correct PIN unless the wider evidence identifies the user.

Operational takeaway¶

Treat successful chip-and-PIN use as proof that the card and correct PIN were used, not automatic proof of who used them.