If your offset is recorded on your card, then all someone has to do is know how to generate your natural PIN from your account number and how the PINs are compared. Thus it seems like it could be said that your PIN is encrypted on the card: if you know the decryption scheme, all the information necessary to obtain a card’s PIN is on the card. If that’s the case, the production of natural PINs and the comparison technique need to be kept closely guarded secrets, or at least the seed for their algorithms.
Here’s something you’re not considering, but one of the many reasons why this (or something like it) isn’t possible.
I many cases around the world, banks have only just begun - and in some cases not yet begun but shortly will - modernising systems from the 70’s, 80’s and in some cases even earlier.
Most of these banks still operate batch systems, and not real time.
Banks (believe it or not) actually want to give you nifty stuff like this (and say, real time banking from various platforms.) But many/most are held back by organically grown systems. Over the years bits and pieces have been added on, programmed in, sporadically replaced. When Fortan and Cobol are still running your core systems, and you rely on overnight batching instead of real time running, the then stuff you ask for becomes impossible to achieve.
Some of this was going to be/started to be in progress prior to the GFC. Some banks (US/European ones in particular) will be delayed in starting even now.
I have a little insider knowledge on this and beyond security concerns, which are real and have been pointed out, the main reason so much of this stuff you can dream up can’t be implemented is that the banking systems in the majority of the world are too anitquated to handle it. They are solid systems, don’t get me wrong, but they are old and they hold back innovation.
But for all the skepticism, banks know that most people have an account. The only want to get more people is to take them from competitors. The way you take them from competitors is to have more stuff people want. They need to moderise to do this.
I would say this is the main reason what you ask for hasn’t been implemented.
Not for me. I don’t want anybody to have my fingerprints, iris scan or DNA in its computer files.
The PGKs are extremely well-guarded. You think we’re anal about server root passwords? Those are practically public knowledge compared to the PIN systems.
You misunderstand. The minor issue is not the bank having your scans, the minor issue is the lack of lighting.