Short answer: The first thing the app asks you to do with a new card is set a PIN. You choose it yourself. On every self-enrolled card the PIN protects enrolment and re-enrolment. On cards with FIDO it must also be in place before the card can be registered with a service, and it is the fallback when the fingerprint cannot be verified – during registration as well as when signing in. The app states which applies when you set it.
What your PIN is for
You cannot tell by looking at the card whether it has FIDO. When you set the PIN, the app tells you what it is for: on a card with FIDO, it covers both fingerprint enrolment and digital sign-in; on a card without FIDO, it protects fingerprint enrolment.
Choosing a PIN
- 4–12 digits – it is strongly recommended to use more than four
- Do not reuse a PIN you use elsewhere, and do not write it on or with the card
- Choose it with care: it cannot be recovered, and when the allowed wrong attempts are used up the card is permanently blocked See: Forgotten PIN or too many wrong attempts.
What the PIN is used for
- In the app: enrolling, re-enrolling and deleting fingerprints – on every self-enrolled card
- On cards with FIDO: registering the card with a service – you verify with your fingerprint, and the PIN is the fallback. Some platforms ask for the PIN during registration regardless. See: What FIDO2 sign-in with the card gives you.
- On cards with FIDO: signing in when the fingerprint cannot be verified – if fingerprint verification fails and the allowed attempts are used up, the service may ask for your PIN instead. Entering it completes the sign-in and re-enables fingerprint verification.
- Not for doors – the card’s PIN is never used at a door. If a door requires a PIN as well as the card, that PIN is configured in your access control system, not on the card
Changing the PIN
The PIN cannot be changed on its own. To set a new one, reset the card in the app: the card returns to its initial state, the enrolled fingerprints and any passkeys are removed. You then set a new PIN, enrol again and register the card with your services again. See: Re-enrol or delete a fingerprint.
At an enrolment station, the FIDO PIN on a card with FIDO can be changed directly, without resetting the card. Fingerprints and registered passkeys are not affected.
Cards issued at an enrolment station
A card issued at an enrolment station has a PIN only if it has FIDO. It is set when the card is issued, and is used for registering with services and as the sign-in fallback. Fingerprints on these cards are managed at the station, not with the PIN. See: Security management for mobile enrolment.