System and method for touchless pin entry

A method for touchless entry of a personal identification number (PIN) at a self-service terminal, the self-service terminal including a wireless interface for communicating wirelessly with a mobile device, comprising:

• reading a primary account number of a customer from a bank card of the customer via a card reader at the self-service terminal;
• establishing a wireless communication channel directly between the mobile device of the customer and the wireless interface included within an encrypting PIN pad module at the self-service terminal by scanning for and locating an open PIN entry application on the mobile device of the customer after reading the primary account number of the customer from the bank card of the customer at the self-service terminal;
• verifying a public key of the self-service terminal at the mobile device;
• formatting a PIN for the customer into a PIN-block that does not include a primary account number for the customer;
• encrypting only the PIN-block for the customer at the mobile device;
• transmitting the encrypted PIN-block to a host associated with the self-service terminal for signing the encrypted PIN;
• receiving the host-signed encrypted PIN-block at the mobile device;
• transmitting only the host-signed encrypted PIN-block from the mobile device to the self-service terminal;
• verifying the host signature of the host-signed encrypted PIN-block at the self-service terminal;
• decrypting the encrypted PIN-block at the self-service terminal, and
• wherein the mobile device of the customer never receives or stores the primary account number of the customer.

A system for touchless entry of a personal identification number (PIN), comprising:

• a mobile device of a customer, the mobile device including a PIN entry application, the PIN entry application never receiving or storing a primary account number of the customer;
• a self-service terminal comprising a central processing unit, a display, a card reader, a PIN entry device having an encryption processor, and a wireless interface included within an encrypting PIN pad module for communicating wirelessly with the mobile device to receive only an encrypted PIN and not a primary account number;
• wherein the PIN entry application is configured to verify a public key of the self-service terminal at the mobile device, format a PIN for the customer into a PIN-block that does not include a primary account number for the customer, encrypt only the PIN-block for the customer, and transmit only the encrypted PIN-block directly to the self-service terminal via the wireless interface on a wireless communication channel thereon established by scanning for and locating the PIN entry application on the mobile device of the customer after the primary account number of a customer is read from a bank card of the customer via a card reader at the self-service terminal;
• and
• wherein the encryption processor is configured to decrypt the encrypted PIN-block.