For most purchases in the United States, a credit card does not need a PIN. You insert or tap the card, the chip does the authentication, and the terminal approves the sale without asking for a code. The two situations where a PIN is required are ATM cash advances and certain unattended payment machines overseas.
Why U.S. Checkouts Don’t Ask for a PIN
When you use a credit card at a store, restaurant, or gas station in the U.S., the EMV chip generates a unique, one-time security code for each transaction, and the card network uses that code to confirm the card is genuine and hasn’t been cloned.1EMVCo. EMV Contact Chip That cryptographic handshake replaced the older swipe-and-sign method as the primary way to prove the card is physically present.
Visa, Mastercard, American Express, and Discover also dropped their signature requirements for most transactions starting in April 2018. A typical purchase now needs nothing more than the card and a moment of processing time.
Credit and debit cards behave differently at the register because different federal rules apply to them. The Electronic Fund Transfer Act and Regulation E cover debit transactions, ATM withdrawals, and direct deposits, but not credit card purchases.2National Credit Union Administration. Electronic Funds Transfer (EFT) and Regulation E Credit cards fall under the Truth in Lending Act and Regulation Z, which do not require a PIN at the point of sale.
When You Travel Abroad
Outside the U.S., chip-and-PIN is the standard checkout method. At a staffed register in a shop, restaurant, or hotel, a cashier can usually fall back to a signature if your U.S. card doesn’t prompt for a PIN. Unattended machines are the real problem: train-ticket kiosks, highway toll booths, parking meters, and fuel pumps have no way to accept a signature and will simply decline the card.
Ask your issuer to set up a PIN before you leave. Some countries use six-digit PINs rather than four, and travelers have reported trouble using four-digit codes at certain ATMs in parts of Asia, so it is worth confirming with your issuer whether your PIN length will work where you’re going. Mailed PINs can take a week or more, so don’t leave this to the last day.
ATM Cash Advances Always Require a PIN
Any time you use a credit card at an ATM to withdraw cash, you have to enter a PIN. The ATM will not dispense money without it, and this applies in every country. That withdrawal is treated as a cash advance, which is a different transaction from a purchase and carries its own costs:
- Upfront fee of roughly 3% to 5% of the amount withdrawn. On a $500 advance, that’s $15 to $25 before you walk away from the machine.
- A separate, higher APR. At major banks, the cash advance rate often runs around 30%, compared with roughly 22% for purchases.
- No grace period. Interest starts accruing the moment the cash is dispensed, unlike purchases where paying in full each month lets you avoid interest.3Consumer Financial Protection Bureau. What Is a Grace Period for a Credit Card
- ATM operator surcharges of about $2 to $5 on top of what your issuer charges.
Your issuer must disclose the cash advance APR and fees before you open the account and on every periodic statement.4eCFR. 12 CFR Part 226 – Truth in Lending (Regulation Z) The figures are in the pricing table that came with your cardholder agreement.
Setting Up or Changing Your PIN
Some issuers mail a PIN with the card; others make you request one. You generally have three ways to set or change it:
- Online or through the mobile app. Look under card settings or security. Some issuers activate the new PIN instantly.
- By phone. Call the number on the back of the card and follow the prompts, or ask a representative.
- At an ATM branded by your issuer, by inserting the card and following the on-screen prompts.
The exact steps vary by bank. Issuers are allowed to send PINs to existing cardholders without a specific request, provided the PIN alone won’t access credit; it has to be used with the physical card.5Consumer Financial Protection Bureau. 1026.12 Special Credit Card Provisions
What Happens If You Enter the Wrong PIN
Three consecutive wrong entries at an ATM or terminal will usually trigger a temporary lockout on the card. That’s a security measure against someone guessing the code. The lockout may lift automatically after 24 hours, or you may need to call the issuer to unblock the card; the policy depends on the bank.
If you can’t remember the PIN, stop guessing at the machine and reset it through the issuer’s app, website, or customer service line. Repeated wrong entries can also flag the account for potential fraud and lead to a longer hold.
Fraud Liability If Someone Uses Your PIN
If a thief steals your credit card and uses it, even with your PIN, federal law caps your liability at $50 once you notify the issuer.6Office of the Law Revision Counsel. 15 U.S. Code 1643 – Liability of Holder of Credit Card Most major issuers go further with zero-liability policies, so in practice you typically owe nothing for fraudulent charges. If the thief uses only your card number and expiration date, with no PIN or physical card, you have no liability at all under the statute. Report a lost or stolen card as soon as you notice it: once the issuer knows, you’re not on the hook for any charges that follow.
Debit cards work under a different rule. Under the Electronic Fund Transfer Act, your liability for unauthorized debit transactions can reach $500 or more if you don’t report the loss within two business days.2National Credit Union Administration. Electronic Funds Transfer (EFT) and Regulation E That gap is worth remembering when you decide which card to carry on a trip or use for a large transaction.