In the US, the PIN-pad has no way to validate the PIN by itself. The PIN-pad is a separate, black-box peripheral of the POS terminal. The POS commands it to re

In the US, the PIN-pad has no way to validate the PIN by itself. The PIN-pad is a separate, black-box peripheral of the POS terminal. The POS commands it to read a PIN, and, when the customer finishes entering the PIN, the PIN-pad replies to the POS with a 16-byte (IIRC) encrypted block. The clear-text PIN never leaves the PIN-pad. The POS includes the encrypted PIN-block along with the mag stripe data and other info (such as the merchant account and the amount to charge) in its charge request uploaded to the payment processor. The payment processor then decrypts the PIN as part of the process of deciding whether to approve or decline the transaction. >Is there a real flow online one can read? Google for "PIN-pad protocol" or "DUKPT" (the encryption scheme commonly used).