Dumps with PIN: What They Are and How They Work

Dumps with PIN are stolen debit card magnetic stripe data combined with the cardholder's PIN. Thieves use cloned cards at ATMs to withdraw cash directly from victims' accounts, which makes these records more valuable than dumps alone[1]. In the Target breach, dumps sold for $20 to over $100 per card[1]. Criminals typically capture this data through skimming devices on ATMs or payment terminals, with PINs recorded separately via cameras or overlay pads[2].

What Are Dumps with PIN?

Dumps are data stolen from the magnetic stripe on the backs of credit and debit cards[1]. This stripe contains information encoded in Track 1 and Track 2 formats, including the cardholder's name, card number, expiration date, and service code. Armed with this information, thieves can effectively clone the cards and use them in shops that still accept magnetic stripe transactions[1].

Dumps with PIN refer specifically to stolen debit card magnetic stripe data combined with the cardholder's PIN[1]. This combination transforms the value and capability of stolen card data. While dumps without PINs can only be used at point-of-sale terminals in shops, dumps with PIN access allow criminals to use cloned cards at ATMs to pull cash directly out of the victim's bank account[1]. The PIN component removes the need for a signature or other verification method, enabling immediate cash withdrawal.

Why Dumps with PIN Are More Valuable

Underground card shops sell stolen credit and debit cards, with these marketplaces earning reputations for selling quality dumps[1]. Dumps with PIN access command higher prices because they offer direct access to cash, which is harder to trace than purchases made with cloned cards in shops. In the Target breach, more than a million cards were compromised and sold in underground markets, with dumps selling for anywhere from $20 to more than $100 per card[1]. Debit card dumps with PINs typically sold at the higher end of this range.

The distinction matters for fraud risk: credit card dumps require the criminal to purchase goods and convert them to cash, adding steps and exposure. Debit card dumps with PINs allow immediate ATM withdrawal, which is why they remain sought after in carding marketplaces despite the shift toward EMV chip cards in many regions. The magnetic stripe remains vulnerable because fallback transactions still occur when chip readers fail or are unavailable.

How Criminals Obtain PINs for Card Dumps

Skimming is the most common method used to steal credit card information, where criminals place an illegal card reader on a real ATM or card reader to save customer credit card information[2]. These devices sit on top of or inside legitimate card slots, reading the magnetic stripe data as the victim inserts their card for a normal transaction. The skimmer captures Track 1 and Track 2 data, which contains the card number, expiration date, cardholder name, and service code needed to clone the card.

ATM skimmers collect card data known as dumps in fraud circles, which can include both magnetic strip data and PIN information captured from PIN pads[3]. However, the magnetic stripe reader and the PIN capture mechanism operate as separate components. The stripe data flows through the skimmer when the card is inserted, but the PIN must be captured through a different method because it is entered after the card is read.

Separate PIN Capture Methods

Criminals use two primary techniques to record PINs alongside magnetic stripe data:

• Hidden cameras: Small cameras positioned to view the PIN pad, often concealed in brochure holders, false panels above the keypad, or modified card slot surrounds
• Overlay devices: Thin false keypads placed directly over the legitimate PIN pad, recording each keystroke before passing it through to the real terminal[3]

The overlay method proves more reliable than cameras because it captures the exact keypad input regardless of viewing angle or the victim's hand position. A camera may miss digits if the cardholder shields the keypad with their hand, but an overlay records every press. Both methods require the criminal to retrieve the device later to collect the stored data, unless the skimmer transmits data wirelessly.

Why the PIN Requires Separate Capture

The magnetic stripe itself does not store the PIN. Track 1 and Track 2 data contain account information and card metadata, but PIN verification occurs through encrypted communication between the terminal and the card issuer[5]. This separation means that even if a criminal captures the magnetic stripe data, they cannot extract the PIN from that data alone. The PIN must be observed or intercepted during the transaction when the cardholder enters it.

This limitation explains why dumps with PIN command higher prices in underground card shops: obtaining both pieces of information requires more sophisticated equipment and greater risk of detection during device installation and retrieval.

Why Dumps with PIN Are More Valuable

Dumps with PIN access allow thieves to withdraw cash directly from ATMs by cloning debit cards, making them substantially more valuable than dumps without PIN information[1]. When criminals possess only magnetic stripe data, they can clone cards and use them in shops, but each transaction requires a point-of-sale terminal and leaves a merchant record[1]. With PIN access, the cloned debit card functions at any ATM, enabling immediate cash withdrawal from the victim's bank account[1].

Cash withdrawal offers three advantages over shop purchases: the money is immediately liquid, the transaction leaves no merchant trail linking specific goods to the criminal, and ATMs operate around the clock without human oversight. A criminal using a dump without PIN must purchase goods, then convert those goods to cash through resale—adding time, risk, and complexity. A dump with PIN eliminates these steps entirely.

Underground Market Pricing

In the Target breach, more than a million cards were compromised and sold in underground markets, with dumps selling for anywhere from £15 to over £75 per card[1]. Debit card dumps with PINs consistently commanded prices at the higher end of this range. The price differential reflects the direct cash access: a dump without PIN might sell for £15–£30, whilst the same card with PIN access could reach £50–£100 depending on the account balance and card issuer.

Underground card shops earn reputations specifically for selling quality dumps with PIN access because of the ATM cash withdrawal capability[1]. Marketplaces track seller reliability through feedback systems, and vendors who consistently provide working PINs alongside valid magnetic stripe data build higher-value reputations. Buyers in these forums pay premium prices for dumps with verified PIN access, understanding that the investment returns immediate cash rather than requiring additional fraud steps.

The liability shift to EMV chip cards in many regions has not eliminated the value of magnetic stripe dumps with PIN. ATMs in some countries still accept magnetic stripe fallback transactions, and criminals target machines in areas where chip adoption remains incomplete. As long as magnetic stripe readers remain active, dumps with PIN retain their cash withdrawal capability and corresponding black market value.

EMV Chip Cards and PIN Verification Methods

EMV chip cards support two distinct PIN verification methods: offline PIN, where the PIN is validated by the chip card itself against internal storage, and online PIN, where the PIN is encrypted and sent to the issuer for verification[4]. Both methods serve the same purpose—confirming the cardholder's identity—but they operate through fundamentally different validation paths. Understanding this distinction matters because it determines where and how stolen PIN data can be exploited.

During an online PIN transaction, the PIN is entered into the terminal, then encrypted and sent to the issuer for PIN verification[5]. The terminal encrypts the PIN immediately after entry, and authorisation messages passed between the POS terminal and the issuer's host must carry PIN data in a securely encrypted form[5]. The issuer's system decrypts the PIN and verifies it against the account record before approving or declining the transaction. This method requires an active network connection between the terminal and the issuer.

An offline PIN transaction is validated between the terminal and chip card or mobile device with no issuer validation[5]. The terminal sends the encrypted PIN to the card's chip, which decrypts it and checks the value against the PIN stored internally during card personalisation. No data travels to the issuer during this verification. Offline PIN transactions occur commonly at merchants operating in areas with connectivity limitations, such as metro stations, aeroplanes, and intraregional buses[6].

PIN Storage and Configuration Requirements

Both online and offline PINs on a physical card must always have the same value, even though they are validated through different mechanisms[6]. A cardholder cannot set different PINs for online and offline transactions. The card stores a single PIN value, and the validation method—online or offline—depends on the terminal capabilities and the card's configuration profile set by the issuer[6].

A physical EMV card can have either online or offline PIN validation preference, and the preference is determined by the card configuration profile set by the issuer[6]. This preference guides the terminal's choice when both methods are available. However, issuers must enable the online PIN capability within their EMV chip cards, and POS device hardware and configuration must be online PIN-enabled for online PIN transactions to work[5]. If either the card or the terminal lacks online PIN support, the transaction falls back to offline PIN or an alternative verification method.

For offline payments, the terminal can only check against the offline PIN stored on the chip because there is no internet connection available in such cases[6]. This limitation means that even if the card supports online PIN, the terminal must use offline PIN when network connectivity is absent. Criminals exploiting stolen card data cannot bypass these technical requirements: a cloned magnetic stripe card cannot perform EMV chip PIN verification because the chip itself contains the cryptographic keys and PIN storage that magnetic stripe data lacks.

Online PIN is always enciphered (encrypted), whilst offline PIN can be enciphered or plaintext, according to payment processing documentation[4]. Plaintext offline PIN, though less common in modern implementations, transmits the PIN to the card without encryption, relying on the chip's physical security to protect the stored PIN value. Encrypted offline PIN adds a layer of protection during transmission between the terminal and the card, but both methods validate the PIN locally on the chip rather than querying the issuer.

How Offline PIN Verification Works on EMV Cards

In an offline PIN EMV transaction, the terminal generates a random number, pads the message containing the PIN and the card's nonce, encrypts it with the card's RSA public key, and the card decrypts it and checks that the nonce matches before verifying the PIN against internal storage[7]. This cryptographic process ensures that even if an attacker intercepts the transmission between terminal and card, they cannot extract the plaintext PIN or replay the encrypted message in a different transaction.

The nonce—a number used once—prevents replay attacks. Each transaction generates a fresh random number, so an encrypted PIN block from one transaction cannot be reused. The terminal pads the message to meet RSA encryption block size requirements, typically combining the PIN, the card's nonce, and additional data into a fixed-length structure. The card's public key encrypts this padded message, and only the card's private key, stored securely within the chip, can decrypt it. After decryption, the card verifies that the nonce matches the one it provided, confirming the message is fresh and intended for this specific transaction. Only then does the card compare the decrypted PIN against the value stored internally during personalisation.

When Offline PIN Is Used

For offline payments, the terminal can only check against the offline PIN stored on the chip because there is no internet connection available in such cases, which is common at merchants operating in areas with connectivity limitations such as metro stations, aeroplanes, and intraregional buses[6]. These environments cannot support online PIN verification because the terminal lacks real-time communication with the issuer's authorisation system. The card configuration profile set by the issuer determines whether online or offline PIN is preferred[6], but connectivity constraints override this preference when no network is available.

Online PIN is always enciphered (encrypted), whilst offline PIN can be enciphered or plaintext[4]. Enciphered offline PIN uses the RSA encryption process described above. Plaintext offline PIN transmits the PIN to the card without encryption, relying entirely on the chip's physical tamper resistance to protect the stored PIN value. Modern implementations favour enciphered offline PIN because it protects the PIN during transmission between the terminal keypad and the card, reducing the attack surface for interception.

Implications for Stolen Magnetic Stripe Data

Both online and offline PINs on a physical card must always have the same value, even though they are validated through different mechanisms[6]. This requirement means criminals cannot exploit differences between online and offline PIN values. However, magnetic stripe dumps with PIN remain valuable because many ATMs and point-of-sale terminals still accept magnetic stripe fallback transactions when chip readers fail or are unavailable. In these fallback scenarios, the terminal reads the magnetic stripe data and processes the transaction without EMV chip cryptography, allowing cloned cards with captured PINs to withdraw cash or make purchases.

The cryptographic protections of offline PIN verification apply only to EMV chip transactions. A cloned magnetic stripe card cannot perform the RSA encryption handshake because it lacks the chip hardware and private keys. Criminals using dumps with PIN target magnetic stripe readers and older ATMs that do not enforce chip-only transactions, bypassing the EMV security model entirely. This limitation explains why the industry's liability shift to EMV aimed to render magnetic stripe data less useful, though the transition remains incomplete in many regions.

Typical Mistakes and Misconceptions

Assuming a dump automatically includes the PIN

A dump is data stolen from the magnetic stripe on the back of a credit or debit card[1]. The PIN is captured separately, usually through a camera or an overlay device on the PIN pad. Conflating the two leads people to believe every stolen card record can immediately withdraw cash. That assumption is wrong: a dump without the PIN only allows card cloning for in-store transactions, not ATM withdrawals[1].

Believing EMV software can write a PIN onto a chip card

EMV chip cards support two distinct PIN verification methods: offline PIN, validated by the chip card itself against internal storage, and online PIN, encrypted and sent to the issuer for verification[4]. Both online and offline PINs on a physical card must always have the same value, even though they are validated through different mechanisms[6]. The PIN is stored during card personalisation, not written by terminal software or by any tool that reads magnetic stripe data. A cloned magnetic stripe card cannot perform EMV chip PIN verification because the chip itself contains the cryptographic keys and PIN storage that magnetic stripe data lacks.

Treating all underground prices as stable or current

In the Target breach, dumps sold for anywhere from $20 to more than $100 per card[1]. These figures describe one documented breach in 2013, not a fixed market rate. Underground card shops sell stolen credit and debit cards, with stores earning a reputation for selling quality dumps, and dumps with PIN access allow thieves to withdraw cash from ATMs[1]. The premium for PIN-equipped dumps comes from direct cash access, but quoting a single price as if it were a current benchmark misrepresents how these markets operate.

Assuming skimming captures the PIN through the same channel as the card data

Skimming is the most common method used to steal credit card information, where criminals place an illegal card reader on a real ATM or card reader to save customer credit card information[2]. ATM skimmers collect card data known as dumps in fraud circles, which can include both magnetic strip data and PIN information captured from PIN pads[3]. The card data comes from the magnetic stripe reader, whilst the PIN comes from a separate capture mechanism, typically a camera or a fake keypad overlay. Treating these as a single capture channel obscures why some skimming operations succeed in getting card data but fail to obtain the PIN.

Expecting a verification framework that relies on a single source

No single document covers both the criminal acquisition of dumps with PINs and the technical detail of EMV PIN verification. The criminal side appears in reporting on breaches and skimming devices[1][3][2]. The technical side appears in payment network documentation and academic analysis of EMV cryptography[4][5][7][6]. A practical verification approach is to separate claims about how PINs are stolen from claims about how PINs are validated, then check each against the appropriate source type.

Confusing offline PIN validation with issuer verification

An offline PIN transaction is validated between the terminal and chip card or mobile device with no issuer validation[5]. The terminal generates a random number, pads the message containing the PIN and the card's nonce, encrypts it with the card's RSA public key, and the card decrypts it and checks that the nonce matches before verifying the PIN against internal storage[7]. No data travels to the issuer during this verification. This distinction matters because a stolen PIN used in an offline transaction never reaches the issuer's systems, which changes where fraud detection can occur.

Conclusions

• A dump is magnetic stripe data stolen from a card, and the PIN is captured separately through cameras or overlay devices[1][3].
• Dumps with PIN allow cash withdrawals at ATMs, which is why they command higher underground prices than dumps alone[1].
• EMV chip cards verify PINs either offline on the chip or online through the issuer, but both stored values must match[4][6].
• Cloned magnetic stripe cards cannot perform EMV PIN verification because they lack the chip's cryptographic keys and PIN storage[7].
• Documented prices, such as $20 to over $100 per card in the Target breach, describe one 2013 event and are not stable market rates[1].

If you need to trace how stolen card data moves through criminal marketplaces, start with Stealing Credit Cards Dark Web: How Data Is Stolen and Sold.

Explore More on Card Security

Discover additional resources to enhance your understanding.