How long for new pin?

InsideInsurance

agrinnall wrote: »

I'm not sure that it is a matter of semantics, but I can absolutely confirm that the banks I have worked for in the UK and New Zealand have no method for either a customer or a member of staff to see a PIN on screen, and I am personally surprised to hear that any financial institution would be able and willing to do so.

Its semantics on if they are storing the actual number or the system has the ability to recreate it.

If a customer or CSA has the ability to display it on screen is independent as to if/ how its stored/ regenerated. The difference of stored -v- regenerated only potentially changes who in IT would be able to get the pin from either just a DBA to a DBA + the spec for the algorithm

I'm not surprised now because Amex had already been mentioned. But even though access to view the PIN is secure, if somebody other than the cardholder has obtained their login credentials then they have instant access to the PIN and can start using it straight away With the banks that I have experience of (and I have in fact worked for Amex too, but in a different capacity) that person would need to order a replacement PIN mailer, wait for it to arrive, and be in a position to intercept it.

Well, they'd need access to the card and the online banking.

In practice with some banks if you have access to their online banking you really have much higher and quicker ability to commit fraud and get away with it than with a card and pin. If you're talking of something more than the opportunistic fraudster then the pin is fairly unnecessary anyway

agrinnall

InsideInsurance wrote: »

In practice with some banks if you have access to their online banking you really have much higher and quicker ability to commit fraud and get away with it than with a card and pin. If you're talking of something more than the opportunistic fraudster then the pin is fairly unnecessary anyway

Agreed, and of course there are other ways of getting hold of PINs fraudulently. But there are a lot of rules around PIN security and my experience is that banks take the line that if nobody other than the cardholder gets to see the PIN then that significantly reduces the opportunity of a security breach.