Beru Learning

Hardware security keys protect financial accounts against remote phishing attacks, but touching an unconfigured key satisfies only User Presence (UP). Setting up FIDO2 PIN protection for banking enables User Verification (UV), so a lost or stolen key cannot be used to access your accounts.

Without a PIN, anyone who finds your security key could plug it into a computer, click sign-in on an active session, press the sensor, and log into your accounts.

User Presence vs. User Verification

The WebAuthn and CTAP2 standards differentiate between simple physical contact and verified user access:

User Presence (UP): The key confirms that an entity touched its capacitive sensor. This stops remote bots from authenticating in the background, but it does not identify who touched the device.
User Verification (UV): The key checks user identity before providing a cryptographic signature. This is done through an on-chip fingerprint reader or a local hardware PIN.
On-device processing: The FIDO2 PIN stays inside the key's secure microcontroller. It is never sent over the USB connection or across the network to your financial institution.

Configuring a FIDO2 Hardware PIN

You can set up your security key PIN using operating system tools or key management software from the manufacturer.

Method 1: Using Windows Native Settings

Plug your FIDO2 security key into a USB port.
Open Windows Settings and go to Accounts > Sign-in options > Security Key.
Click Manage and touch the key when prompted.
Under Security Key PIN, select Add (or Change).
Enter a PIN. For financial security, use a passphrase of at least eight alphanumeric characters instead of a basic 4-digit code.

Method 2: Using Manufacturer Management Tools

Open the official management tool for your hardware key (such as YubiKey Manager).
Select the Applications > FIDO2 section.
Click Set PIN.
Enter and confirm your new hardware PIN.
Check that the interface shows the PIN is active on the device.

Understanding Lockout Thresholds and Account Recovery

FIDO2 firmware limits guessing attempts to stop brute-force attacks. Keep these hardware restrictions in mind:

Eight-attempt lockout: Most certified FIDO2 keys lock permanently after eight consecutive wrong PIN attempts.
Power cycle counters: After three incorrect entries, you must unplug and reinsert the key between tries, which slows down automated attempts.
Hardware reset consequences: If you forget your PIN and exhaust all attempts, you must reset the key. A factory reset wipes all resident credentials and private keys, removing your access to enrolled accounts.
Always maintain a backup key: When securing accounts, set up two identical hardware keys at the same time. Store the backup key in a secure offsite location with its PIN documented safely.

FAQ

Is a FIDO2 PIN the same as my computer login password?

No. Your FIDO2 PIN is stored only inside the hardware key and is used solely to authorize cryptographic signatures on that device.

Will my bank require the PIN on every single login?

That depends on your bank's configuration. Sites that set UserVerification = required will always prompt for your PIN before accepting the security key tap.

Can an attacker extract the PIN by physically disassembling the key?

Certified keys use secure elements designed to erase cryptographic data if physical tampering, voltage manipulation, or decapping is detected.

Key Takeaways

Standard hardware key taps confirm physical contact, not the identity of the person touching the key.
Setting a FIDO2 PIN provides two-factor verification: physical possession of the key plus a secret code.
PIN verification happens entirely inside the security key and is never transmitted over the internet.
Exceeding eight wrong PIN attempts permanently locks the key, requiring a full factory reset.
Always configure a secondary backup key with its own PIN to prevent account lockouts if a key is lost.

Configuring FIDO2 PIN Protections on Banking Hardware Keys