Personal identification number

The PIN originated with the introduction of the automated teller machine (ATM) in 1967, as an efficient way for banks to dispense cash to their customers. The first ATM system was that of Barclays in London, in 1967; it accepted cheques with machine-readable encoding, rather than cards, and matched the PIN to the cheque.[5][6][7] 1972, Lloyds Bank issued the first bank card to feature an information-encoding magnetic strip, using a PIN for security.[8] James Goodfellow, the inventor who patented the first personal identification number, was awarded an OBE in the 2006 Queen's Birthday Honours.[9][10]

Mohamed M. Atalla invented the first PIN-based hardware security module (HSM),[11] dubbed the "Atalla Box," a security system that encrypted PIN and ATM messages and protected offline devices with an un-guessable PIN-generating key.[12] In 1972, Atalla filed U.S. Patent 3,938,091 for his PIN verification system, which included an encoded card reader and described a system that utilized encryption techniques to assure telephone link security while entering personal ID information that was transmitted to a remote location for verification.[13]

He founded Atalla Corporation (now Utimaco Atalla) in 1972,[14] and commercially launched the "Atalla Box" in 1973.[12] The product was released as the Identikey. It was a card reader and customer identification system, providing a terminal with plastic card and PIN capabilities. The system was designed to let banks and thrift institutions switch to a plastic card environment from a passbook program. The Identikey system consisted of a card reader console, two customer PIN pads, intelligent controller and built-in electronic interface package.[15] The device consisted of two keypads, one for the customer and one for the teller. It allowed the customer to type in a secret code, which is transformed by the device, using a microprocessor, into another code for the teller.[16] During a transaction, the customer's account number was read by the card reader. This process replaced manual entry and avoided possible key stroke errors. It allowed users to replace traditional customer verification methods such as signature verification and test questions with a secure PIN system.[15] In recognition of his work on the PIN system of information security management, Atalla has been referred to as the "Father of the PIN".[17][18][19]

The success of the "Atalla Box" led to the wide adoption of PIN-based hardware security modules.[20] Its PIN verification process was similar to the later IBM 3624.[21] By 1998 an estimated 70% of all ATM transactions in the United States were routed through specialized Atalla hardware modules,[22] and by 2003 the Atalla Box secured 80% of all ATM machines in the world,[17] increasing to 85% as of 2006.[23] Atalla's HSM products protect 250 million card transactions every day as of 2013,[14] and still secure the majority of the world's ATM transactions as of 2014.[11]

Financial PINs are often four-digit numbers in the range 0000–9999, resulting in 10,000 possible combinations. Switzerland issues six-digit PINs by default.[31]

Some systems set up default PINs and most allow the customer to set up a PIN or to change the default one, and on some a change of PIN on first access is mandatory. Customers are usually advised not to set up a PIN-based on their or their spouse's birthdays, on driver license numbers, consecutive or repetitive numbers, or some other schemes. Some financial institutions do not give out or permit PINs where all digits are identical (such as 1111, 2222, ...), consecutive (1234, 2345, ...), numbers that start with one or more zeroes, or the last four digits of the cardholder's social security number or birth date.

Many PIN verification systems allow three attempts, thereby giving a card thief a putative 0.03% probability of guessing the correct PIN before the card is blocked. This holds only if all PINs are equally likely and the attacker has no further information available, which has not been the case with some of the many PIN generation and verification algorithms that financial institutions and ATM manufacturers have used in the past.[32]

Research has been done on commonly used PINs.[33] The result is that without forethought, a sizable portion of users may find their PIN vulnerable. "Armed with only four possibilities, hackers can crack 20% of all PINs. Allow them no more than fifteen numbers, and they can tap the accounts of more than a quarter of card-holders."[34]

Breakable PINs can worsen with length, to wit:

The problem with guessable PINs surprisingly worsens when customers are forced to use additional digits, moving from about a 25% probability with fifteen numbers to more than 30% (not counting 7-digits with all those phone numbers). In fact, about half of all 9-digit PINs can be reduced to two dozen possibilities, largely because more than 35% of all people use the all too tempting 123456789. As for the remaining 64%, there's a good chance they're using their Social Security Number, which makes them vulnerable. (Social Security Numbers contain their own well-known patterns.)[34]

Rumours have been in e-mail and Internet circulation claiming that in the event of entering a PIN into an ATM backwards, law enforcement will be instantly alerted as well as money being ordinarily issued as if the PIN had been entered correctly.[37] The intention of this scheme would be to protect victims of muggings; however, despite the system being proposed for use in some US states,[38][39] there are no ATMs currently in existence that employ this software.[40]

A mobile phone may be PIN protected. If enabled, the PIN (also called a passcode) for GSM mobile phones can be between four and eight digits[41] and is recorded in the SIM card. If such a PIN is entered incorrectly three times, the SIM card is blocked until a personal unblocking code (PUC or PUK), provided by the service operator, is entered. If the PUC is entered incorrectly ten times, the SIM card is permanently blocked, requiring a new SIM card from the mobile carrier service.

PINs are also commonly used in smartphones, as a form of personal authentication, so that only those who know the PIN will be able to unlock the device. After a number of failed attempts of entering the correct PIN, the user may be blocked from trying again for an allocated amount of time, all of the data stored on the device may be deleted, or the user may be asked to enter alternate information that only the owner is expected to know to authenticate. Whether any of the formerly mentioned phenomena occur after failed attempts of entering the PIN depends largely upon the device and the owner's chosen preferences in its settings.

• ATM SafetyPIN software
• Campus card
• Transaction authentication number