What does successful PIN use prove?¶

Successful PIN use proves that the payment system accepted the correct personal identification number for the card or account.

Avoid this assumption: This proves the named cardholder made the payment.

The PIN may have been known by a family member, employee, associate or offender. It may have been disclosed, observed, recorded or stored with the card.

A chip-and-PIN record can therefore establish that the genuine card and correct PIN were used, but not automatically who used them.

The context matters. CCTV, merchant location, card possession, device evidence and the timing of reported loss or compromise may help identify the user.

Repeated failed PIN attempts followed by success may also be relevant.

Ask the issuer for the PIN verification result, terminal details, transaction reference, timestamp, card status and any prior failed attempts.

Preserve merchant CCTV and receipts where available.

Do not assume that a correct PIN rules out theft or misuse. A stolen card can be used successfully if the PIN is known.

Equally, do not assume that the cardholder must have shared the PIN merely because another person used it. The method of compromise may be unclear.

When reporting, use precise wording. Say that the system recorded successful PIN verification, not that the cardholder entered the PIN.

The same caution applies to ATM withdrawals and other PIN-protected activity.

If attribution remains uncertain, keep the conclusion at the level of card and authentication method.

Operational takeaway¶

Treat successful PIN verification as evidence that the correct PIN was entered, and use CCTV, possession and contextual evidence to establish who entered it.