How can I tell a wrong PIN from a PIN block bug?

By how many cards it affects. A genuinely mistyped PIN fails for one cardholder while everything else on the terminal works. A format, PAN or key fault fails for every card identically — and that pattern is the signal to stop asking cardholders to re-enter and start decoding a block against a PIN and PAN you know.

Which PAN digits go into a format 0 PIN block?

The rightmost twelve digits of the PAN, excluding the check digit. For a sixteen-digit PAN that is digits 4 through 15 counting from the left. Including the check digit, or taking the leftmost twelve, is a common error — and it produces a well-formed block that decrypts to the wrong PIN, which the issuer reports as 55 rather than as a format error.

ISO 8583 response code: 55

The PIN entered does not match the one on file for the account. In practice, at least as often a PIN block or key problem on the acquiring side as a genuinely mistyped PIN.

Incorrect PINAction required

Someone has to do something before this can succeed.

What it means

The PIN is never sent in the clear: it is encrypted into a PIN block, keyed with a working key shared between terminal, acquirer and issuer, and carried in field 52. A 55 means the issuer decrypted it and the digits did not match. But that decryption depends on the block format, on the PAN digits used to build it, and on the key being right — so a formatting or key fault produces exactly the same code as a cardholder typing the wrong number.

Common causes

The cardholder genuinely entered the wrong PIN.
The PIN block was built in a different ISO 9564 format from the one the issuer expects — format 0 XORs the PIN field with the PAN, format 1 does not use the PAN at all, and the results are entirely different blocks.
The wrong twelve PAN digits used in the XOR for a format 0 block. The rule is the rightmost twelve digits excluding the check digit; using the leftmost, or including the check digit, produces a valid-looking block that decrypts to the wrong PIN.
A key mismatch, or a translation error where the PIN block was re-enciphered between zones with the wrong key.

How to fix it

Rule out the cardholder first — if one card fails and others succeed on the same terminal, it is probably the PIN.
If many cards fail, it is not the PIN. Decode a PIN block against a known PIN and PAN and confirm the format and the PAN digits used are the ones your issuer specifies.
Check the key check value of the working key at both ends. A KCV mismatch is definitive and takes seconds to compare.
Confirm which ISO 9564 format your issuer expects. Format 0 and format 3 differ only in their fill, and a block built as one and interpreted as the other decrypts to nonsense.

Tools that help

Frequently asked questions

How can I tell a wrong PIN from a PIN block bug?: By how many cards it affects. A genuinely mistyped PIN fails for one cardholder while everything else on the terminal works. A format, PAN or key fault fails for every card identically — and that pattern is the signal to stop asking cardholders to re-enter and start decoding a block against a PIN and PAN you know.
Which PAN digits go into a format 0 PIN block?: The rightmost twelve digits of the PAN, excluding the check digit. For a sixteen-digit PAN that is digits 4 through 15 counting from the left. Including the check digit, or taking the leftmost twelve, is a common error — and it produces a well-formed block that decrypts to the wrong PIN, which the issuer reports as 55 rather than as a format error.