How Does a Personal Identification Number Work?

The cardholder enters the PIN on a terminal or ATM keypad, and it is checked in one of two ways. With offline PIN, the chip on the card compares the entered PIN with the one stored on the chip. With online PIN, the terminal encrypts the PIN into a PIN block and sends it to the card issuer, which verifies it in a hardware security module. A PIN sent to the issuer leaves the terminal only in encrypted form, and issuers do not keep PINs in readable form. After a set number of wrong attempts — often three — the PIN is blocked.

A card PIN is not used for online card payments. Online, the cardholder is verified with other methods: the CVV code printed on the card and, especially in the UK and Europe, 3-D Secure. With 3-D Secure, the issuer either approves the payment based on risk data or asks the cardholder to confirm it in a banking app, with a one-time code or biometrics.

Personal Identification Number in the UK Context

In the UK, Chip and PIN arrived in 2004 and became mandatory on 14 February 2006. Today most in-person card payments are contactless and need no PIN. For years the contactless limit was £100 per payment. Since 19 March 2026, the Financial Conduct Authority lets banks and payment providers set their own limits. The PIN still comes back as a periodic check. Under the previous rules, it was requested after £300 of cumulative contactless spend or five contactless payments in a row; firms can now adjust this approach too. Phone and watch wallets work differently: they verify the cardholder with the device's own biometrics or passcode instead of a card PIN.

PIN Number vs. PIN — What’s the Difference?

Saying “PIN number” is redundant since PIN stands for Personal Identification Number. It is common in everyday speech, but in technical and banking writing, "PIN" is enough.