Do PINs added to chip-and-sign cards work at chip-and-PIN terminals?

There are two types of PIN verification for chip cards: offline and online.
In offline verification, the pin or a cryptographic hash of it is stored in the microchip of the card. When you type your pin, the terminal sends the pin (possibly after encryption/hashing) to the card and the card replies back with a yes or no. The card’s microchip is programmed to lock itself after a few incorrect attempts.

In online verification, the terminal sends the pin (after encryption) to the bank’s servers for verification.

Changing the PIN is easy for cards that only support the online verification method. In theory, you should be able to just log into the bank’s website and change the pin. Changing the pin is tricky for cards that support offline verification because the pin is stored in the card too. EVM supports a mechanism called “Issuer scripts”, which are programs that your bank (issuer) can automatically remotely run to change the parameters (including pin) of the card, whenever you use the card at a chip terminal.

At the time of writing this, Bank of America cards only support online pin verification. However, some automated kiosks in Europe only support offline PIN verification. My Bank of America cards did not work in those kiosks.

This website lets you find out cards that support various verification mechanisms such as online pin, offline pin, signature…
I just got the Jetblue card from Barclays, which seems to support offline pin verification according to the above website. Barclay’s customer support confirmed to me that this card supports offline pin verification. Indeed, their website asks cardholders to use their card at a chip terminal to “activate” any change in PIN, presumably using issuer scripts.

In Europe and most of the rest of the world, due to rampant skimming fraud – magstripe-only access is restricted to the point of being non-existent.

All cards (debit or credit) are CHIP+PIN. The signature does not matter (just like in the US).

A PIN is required for all Point-Of-Sale and ATM transactions (not just withdrawing cash). This means that for all practical purposes – you need a PIN.

However, banking is a complex network of many different providers and players, so there are certain exceptions to these rules:

1. Online transactions do not require a PIN; they may require what is called either 3D Secure by MasterCard or VerifiedByVisa (by Visa) – there are similar programs by American Express and other networks. This is a secondary security control that you can enroll your card into through the bank. The process involves selecting a unique passphrase for your card. If the online merchant’s acquiring bank is so enabled you will be redirected to a special page where you will have to enter this pass phrase in order to approve the transaction. However, most merchants are still not “3D Secure enabled” (for example, Amazon doesn’t have this requirement) so transactions go through as normal.

2. If the Point of Sale terminal at a merchant does not have a chip reader, then the merchant will swipe your card; now the merchant’s acquiring bank has to allow this type of transaction and your bank has to allow these transactions before the transaction will go through. To prevent fraud, most banks that have CHIP+PIN do not allow magstrip transactions especially if they are from a foreign country – it helps to inform your bank that you will be traveling so they don’t flag transactions as fraud and then block your card. Some banks go as far as to even block all transaction types from certain countries; again in the name of fraud prevention.

In your case, I can recommend two options:

1. The safest option is to get a separate card for your international travels. Your bank may offer one with special rates or low fees for international transactions. On this card make sure that CHIP+PIN is enabled.

2. You can enable the PIN on your card. It will still work as normal on ATMs in the US, and your online purchases will not be affected; the only difference is that you will have to enter a PIN at the Point-of-Sale terminals.

3. Always inform your bank if you are traveling and will be accessing your account or using your cards. They will make sure they enable enhanced monitoring and further, will not block your card which can cause a great inconvenience if you are in an emergency situation.

In the Netherlands earlier this month, I only had one restaurant where my USA chip card worked as a chip card. However, both that card, which also has a mag strip, and an unchipped card, worked as swipe cards, including at Amsterdam and Rotterdam train stations. It did not work in the metro stations, except for one tram stop in Amsterdam with a machine. (Most tram stops have no ticket machine, card or otherwise.)