What a PIN block is
A PIN block is a formatted, encrypted representation of a customer's PIN used in card payment processing. The customer enters a PIN into a PIN pad, and the payment system carries the PIN in this protected form so the issuer can validate it during authorization.
A PIN is the secret number the customer enters. The PIN block is the protected data format used to handle that number in the transaction. It is not the same as a cryptographic Key Block, which protects encryption keys and their usage information.
A PIN block protects a PIN in transit, but PCI DSS still forbids storing it after authorization.
How a PIN block works
When a customer enters a PIN for a debit transaction, the PIN-entry device protects the PIN in a PIN block. The issuer validates the PIN or PIN block during authorization to help confirm that the cardholder is making the transaction.
This process does not make the PIN block harmless data. PCI classifies a PIN or PIN block as sensitive authentication data. If exposed alongside other payment data, it can help an attacker obtain the PIN and account information needed to make fraudulent transactions.
What it means for your business
A PIN block is not a processing fee or a pricing tier, and it does not set your interchange or network charges. The business impact is security and compliance: PCI DSS prohibits storing sensitive authentication data after authorization, even if it is encrypted and even if the environment does not contain a primary account number.
That rule applies to your payment environment, not just to a sales screen or receipt. A system that keeps a PIN block after authorization creates exposure without helping complete the transaction. PIN-block data does not have a standard merchant-statement line item.
What you can actually change
Your main control is preventing PIN blocks from being retained after authorization. Keep PIN entry and processing within payment systems designed to protect PIN data, and verify that connected systems do not capture or store it.
- Use a secure, approved PIN-entry device for cardholder PIN entry.
- Map where PIN data travels from the PIN pad through authorization, and remove any unnecessary capture points.
- Confirm that logs, reports, and connected business systems do not retain PIN blocks after authorization.
- Keep PIN processing separate from systems that do not need to handle sensitive authentication data.
- Review data flows. Trace PIN entry through authorization and identify every system that touches the PIN block.
- Check retention settings. Verify that payment-related logs and reports do not save PIN-block data after a transaction is authorized.
- Limit system access. Restrict PIN-processing functions to the devices and systems that need them to complete a transaction.
Frequently asked questions
Is a PIN block the same as a PIN?
No. A PIN is the number a cardholder enters. A PIN block is the protected, formatted representation used to carry that PIN through payment processing so the issuer can validate it during authorization.
Can a business store a PIN block after authorization?
No. PCI DSS treats a PIN block as sensitive authentication data and prohibits storing it after authorization, even if it is encrypted or stored in an environment without a primary account number.
Does a PIN block add a fee to card processing?
A PIN block is a data-security format, not a processing fee or rate category. It does not set interchange or network charges, and it does not have a standard merchant-statement line item.