Short answer: When users enrol on their own phones, the security of the enrolment (and card protection) is provided by the PIN. It controls who may re-enrol a fingerprint or manage credentials, so it matters that users choose a good one, keep it to themselves, and know that they can change it.
What the PIN protects
The PIN does not open doors. On every self-enrolled card it protects enrolment and re-enrolment. Cards issued at the enrolment station do not have a PIN and can only be managed there, not in the self-enrolment app.
On cards with FIDO the PIN must be in place before the card can be registered with a service. It is the fallback for both registration and signing in: if fingerprint verification fails or the allowed fingerprint attempts are used up, the service will ask for the PIN instead. Entering it completes the sign-in and re-enables fingerprint verification.
For self-enrolment, cards must have their door credentials encoded before they are handed out. Biometric registration of a door application is only possible before the fingerprint is enrolled. See: How do I register an application to use biometrics?.
A card that has not had its PIN set should be considered open: anyone in possession of it can set a PIN and enrol their fingerprints. Treat cards carefully before first setup, like bank cards before activation – keep them controlled, and have users set them up promptly on receipt.
Choosing a PIN
- The apps accept a PIN of 4–12 digits
- Try not to reuse a PIN that has been used elsewhere
- Do not write it on or with the card
Changing the PIN
The PIN cannot be changed on its own. Setting a new one means resetting the card, which removes enrolled fingerprints and any passkeys – the user enrols and registers again afterwards. At an enrolment station, the FIDO PIN can be changed directly, without a reset. Choose the PIN with care at setup. See: Set your PIN.
If the PIN is forgotten
It cannot be recovered or reset, and too many wrong attempts locks the card permanently. That is deliberate: a recovery mechanism would also be available to anyone else holding the card. A locked card can only be replaced. See: Forgotten PIN or too many wrong attempts.
What the organisation still controls
Self-enrolment moves the enrolment step to the user, not the trust decision. The card grants no access until its credential is registered in your access system and identity provider, and both stay under your control – as does revocation if a card goes missing. See: Lost or stolen card: revoke and replace.