Pin & Pay
CARD HOLDER FAQ
The industry-wide move to replace signature cards with PIN cards will start from mid-2015. Signature will gradually be phased out as cards and terminals are upgraded. When you receive your new PIN card, you should enter a PIN when prompted, instead of signing, when making a card payment at a point of sale terminal in Malaysia. From 1 July 2017 onwards, signature will no longer be accepted when you use your card to make a domestic payment.
WHAT IS PIN?
A PIN, or Personal Identification Number, is a secret code that is either assigned to, or selected by cardholders to prove they are the rightful owner of the payment card. PINs for Malaysian cards have six digits. Your PIN must always be kept a secret and never noted down.
WHY IS PIN SAFER THAN SIGNING?
PIN usage can help protect against fraud due to lost or stolen cards, because the card and the PIN are required to make a payment. This is why you must always keep your PIN secret.
WHY DO I NEED TO RECEIVE A NEW CARD TO USE PIN?
You will be issued a new card because your current card does not support PIN for payment.
HOW DO I OBTAIN A PIN?
Your card issuer should send you a new PIN, or require you to select a new PIN, for your new PIN card. Contact your card issuer for further details.
CAN I CHANGE MY PIN?
Yes. Follow the instructions provided by your issuer. Contact your card issuer for further details.
CAN I CONTINUE USING MY SIGNATURE CARD AFTER I HAVE RECEIVED MY PIN-ENABLED CARD?
No, all card issuers in Malaysia are required by Bank Negara Malaysia to upgrade payment cards to PIN.
Your credit card issuer will send you your new PIN enabled credit card by the end of 2016. Your old signature credit card will be declined 3 months after your card issuer has sent the new PIN card.
For new PIN enabled debit cards, your card issuer will either ask you to visit your nearest branch to collect your new PIN card, or send the card to you. You must stop using your old signature debit card before the end of 2016, or it may be declined.
IS THE PIN I USE FOR MAKING PURCHASES THE SAME AS THE PIN USED AT ATMS?
Yes. Each card will have only one PIN that can be used for both cash withdrawals at ATMs and purchases at point of sale.
WHAT HAPPENS IF I ENTER THE WRONG PIN?
You will be allowed several attempts before your PIN is blocked. Limited PIN tries protects you against the possibility of a criminal using your card. If your PIN becomes blocked, contact your card issuer to receive or select a new PIN.
WHAT HAPPENS IF I FORGET MY PIN?
Before 1 July 2017, signature will still be allowed when using your new PIN card if you cannot remember your PIN while transacting at an attended terminal. The retailer can assist you to complete your transaction using signature. After 1 July 2017, you will no longer be allowed to use your card at a point of sale terminal in Malaysia if you do not know your PIN. As a security measure, you must enter your PIN at automated fuel dispensers and other unattended terminals if you are prompted for PIN, even prior to 1 July 2017. If you forget your PIN, you will not be able to use your card at these unattended terminals. If you do forget your PIN, contact your card issuer to receive or select a new PIN.
CAN I STILL USE MY PIN CARD FOR CONTACTLESS?
Yes. If your contactless card has a PIN, the terminal will prompt for PIN after your card is tapped on the contactless reader for transaction amounts above a certain limit. However, low-value contactless transactions do not require PIN or signature.
HOW DO I KEEP MY PIN SECURE?
It is very important that you keep your PIN secret so that your card is protected against lost and stolen card fraud. Ensure your PIN is not easy to guess by avoiding numbers that can be associated with you such as significant personal dates (e.g. your birthday or anniversary), telephone number, or driver’s licence number. Other measures to keep your PIN safe include:
- do not keep a written record of your PIN;
- do not allow another person to see your PIN when you enter it or it is displayed;
- do not keep your PIN in a form that can be readily identified as a PIN;
- do not disclose your PIN to any other person (including persons in apparent authority, family members or spouse);
- do not negligently or recklessly disclose your PIN;
- notify your card issuer immediately if you become aware that your PIN has become known to someone else; and
- ensure any supplementary cardholders who are able to access any of your Card Accounts by a PIN keep their PIN secure as set out above.
RETAILER FAQ
The industry-wide move to require PIN at Malaysian point of sale (POS) as a form of customer verification for Malaysian credit, debit, charge and prepaid cards will start from mid-2015 as signature cards will be replaced with PIN cards. From 1 July 2017, signature will no longer be accepted on Malaysian payment cards for domestic transactions.
DO I NEED TO CHANGE MY POS TERMINAL?
Yes. Your point of sale terminal software needs to be updated to enable prompting for PIN. This terminal software update will need to be completed before 1 January 2017.
DO I NEED TO CHANGE MY POS TERMINAL?
No. For security reasons, the customer’s PIN must never be shared with anyone, not even the employees of the card issuer.
WHAT HAPPENS IF CUSTOMERS ENTER THE WRONG PIN?
PIN bypass is activated by pressing OK or Enter, depending on the terminal, instead of typing the PIN. Assist customers to use PIN bypass but only if they have forgotten their PIN. PIN bypass is not supported for contactless transactions. To bypass PIN if customers forget their PIN, perform a new transaction by inserting the card.
After 1 July 2017, PIN bypass will no longer be allowed for Malaysian cards and they will be automatically declined if PIN is prompted but not entered.
WHAT IF CUSTOMERS HAVE NOT RECEIVED NEW CARDS WITH PIN.
Before 1 July 2017, a terminal that has been upgraded for PIN will continue to accept signature cards and will not prompt for PIN but the customer’s signature will still need to be verified. After 1 July 2017, signature-only cards will no longer be permitted to be used in Malaysia.
WHAT HAPPENS IF OVERSEAS CUSTOMERS DO NOT HAVE PIN CARDS?
Signature will still be a valid form of authorization for many visitors from overseas.
DO ALL TRANSACTIONS AT MY POS TERMINAL NEED PIN?
No, not all transactions at point of sale will need PIN:
- Low-value contactless transactions for amounts below a certain limit do not require PIN.
- International transactions (with cards issued by banks outside Malaysia) may be approved with signature and not require a PIN.
CAN CUSTOMERS STILL USE THE CONTACTLESS OPTION?
Yes. If the contactless card has a PIN, the terminal will prompt for PIN after the card is tapped on the contactless reader for transaction amounts above a certain limit. However, low-value contactless transactions do not require PIN or signature.
HOW WILL I KNOW WHEN PIN IS REQUIRED?
All you need to do is follow the prompts on the terminal. The payment terminal that is reading the card will determine if a PIN is required and if so, it will prompt for a PIN.
WHAT IF CUSTOMERS ARE NOT PROMPTED TO ENTER A PIN?
They will be asked to sign to authorise their transaction. Note that low-value contactless transactions for amounts below a certain limit will not require a PIN or a signature.
IF I RUN A CAFé, BAR OR RESTAURANT BUSINESS, WHAT DOES THIS MEAN FOR ME?
PIN transactions require customers to complete their payment where the terminal is physically located. For convenience, you may want to upgrade from a fixed-line terminal to a portable terminal.
WILL PIN BE USED TO MAKE CARD TRANSACTIONS THROUGH THE INTERNET OR OVER THE TELEPHONE?
No. The PIN that customers use at point of sale terminals or ATMs must never be entered into the Internet or provided over the telephone.
HOW CAN CUSTOMERS ADD A TIP/GRATUITY IN A RESTAURANT?
Most terminals at restaurants should display the amount that customers are paying and ask if they wish to add a tip/gratuity, before prompting for PIN. Customers should simply follow the display prompts.
CURRENT PROCESS FOR CARD PAYMENT AT F&B OUTLETS STILL FAVOURS SIGNATURE VERIFICATION:
- Payment card is inserted in the terminal
- Terminal prompts for PIN
- Operator presses OK to bypass PIN, without first allowing the customer to enter PIN
- Customer must sign the transaction receipt
F&B merchants need to take action to enforce PIN…F&B merchants need to take action to enforce PIN…
if the terminal prompts for pin, the payment card requires pin to verify the cardholder
ask the customer to go to the counter, or bring the terminal to the table, to enter their pin
if the customer does not know their pin, advise the customer to contact their bank to get a pin
REASONS FOR DISCOURAGING PIN BYPASS
- PIN protects against fraudulent use of a lost card or stolen card
- Malaysian banks will decline transactions with signature from 1 July 2017
Allow customers to enter PIN now, to facilitate PIN use and minimise disruptions on 1 July. Request for wireless portable terminals from your acquirer, for pay-at- table operations. Without wireless you must ask the customer to go to the terminal to enter their PIN
CURRENT PROCESS FOR CARD PRE-AUTHORISATION AT HOTELS DOES NOT ENCOURAGE USE OF PIN:
- Payment card is inserted in the terminal
- Terminal prompts for PIN
- Operator presses OK to bypass PIN, without first allowing the guest to enter their PIN
- Signature on the pre-authorisation receipt may or may not be requested, keeping to established practices
Hotels need to take action to enforce PIN…
if the terminal prompts for pin, the payment card requires pin to verify the cardholder
ask the guest: "please enter your pin"
if the customer does not know their pin, advise the guest to contact their bank to get a pin
HOTELS MUST UPDATE PROCEDURES FOR PRE-AUTHORISATION AT CHECK-IN
- PIN protects against fraudulent use of a lost card or stolen card for all payment card transactions, including PRE-AUTHORISATION
- The entry of a PIN for pre-authorisation when a customer checks-in does not change the purpose of a pre-authorisation, and there is no change to the check-out process
- Malaysian banks will decline transactions without PIN from 1 July 2017
Allow guests to enter PIN now, to facilitate PIN use and minimise disruptions on 1 July