The security element PIN: who chooses it, where it is entered, what happens after wrong attempts and how to get a new element

When the security element arrives, the first question is "so where is the PIN". The second, usually a few months later, is "what now that it is locked". The third, after a year or two, is "how is it renewed". This article answers all three, and it starts from the fact that many taxpayers have no PIN at all, because their form of the element does not use one.

Two forms of the element, two different codes

Under article 7 of the Law on Fiscalization a taxpayer must use the security element to sign fiscal receipts. Under the rulebook on the conditions and procedure for issuing and using the security element (article 2), the element is issued by the Tax Administration and personalised for the taxpayer and for a specific business premises. In practice it comes in two forms, and the code you need depends on the form:

So if you chose a V-PFR, you are looking for a PAC, not a PIN. Which processor is which and how to choose is in L-PFR or V-PFR; what the element itself is and how it is obtained is in The security element: what it is and how to get one.

Who chooses the PIN and where to find it

According to the Tax Administration's eFiscalization help, the smart card PIN is "always a four digit code, which taxpayers choose when they request each individual smart card". So the PIN does not arrive from the Tax Administration or from the register vendor: you choose it yourself, in the card request, and you should write it down and keep it apart from the card. The L-PFR maker and the register vendor do not know it unless you tell them.

Where the PIN is entered, and where it is not

The PIN is entered into the L-PFR, the device or program that holds the card in the reader. When the L-PFR is a program on a computer on the premises, the PIN is typed in its window when the card is inserted; according to the Tax Administration's help, once the correct PIN is entered it does not have to be entered again until the card is removed from the reader. Under the technical guide the L-PFR keeps the PIN only in working memory, so after a restart the operator has to enter it again. The PIN is also used when signing in to the Electronic Fiscalization Services.

The register (ESIR) sends the receipt to the L-PFR, which signs it with the card. The Tax Administration notes that the PIN is sometimes asked for when a receipt is issued, depending on how the ESIR is set up; if your ESIR asks for it, that can be a legitimate setting, so check your ESIR's manual.

A wrong PIN and a locked card

A smart card counts consecutive wrong entries and locks after a limited number of them. In the Tax Administration's test environment, on the cards we worked with, that number was five. A blocked card no longer signs, which means the L-PFR refuses receipts and, until you have a new element, that card issues no fiscal receipts.

What to do then:

1. Stop trying. Every further wrong entry only confirms the lock.
2. Through the Electronic Fiscalization Services (reached from the ePorezi portal) request revocation of the certificate on that card, then a new security element. The Tax Administration explicitly lists a forgotten PIN and a certificate blocked by too many wrong entries among the reasons for revocation. The procedure and its duration are theirs; we do not quote them, because we cannot guarantee them.
3. If sales must not stop, a V-PFR with a file for the same premises can help you keep issuing receipts while you wait, if your ESIR supports it and you already have a file for those premises. Bear in mind that under article 6 paragraph 4 of the Law, as we understand it, an L-PFR must run in business premises, so request the new card at once. Check this in advance, not on the day the card is blocked.

The best protection is boring: one person knows the PIN, it is typed carefully, and cashiers do not guess.

Expiry and renewal of the element

The certificate in the element has a validity period written into the certificate itself: under the rulebook (article 7) at least one year and at most four. Check whether your L-PFR or ESIR shows that date in its status. The application for a new element for the same premises can be filed within 30 days before expiry of the current one, through the Electronic Fiscalization Services on the ePorezi portal. An expired element can no longer be used, so in its consequences expiry is the same as a blocked card.

Before you remove the old card for good, check that the L-PFR has delivered all audit packages to the Tax Administration, over the internet or on a USB stick. Those packages are the proof of the receipts issued, and the technical guide requires them to be kept until the Tax Administration confirms receipt. The same applies when changing the L-PFR and when moving to another computer.

What a V-PFR user needs to know instead

• There is no PIN and no card locking.
• The certificate file is your element: keep it like a password, with a backup somewhere other than the register itself.
• You choose the PAC yourself when requesting the file. The test environment PAC and file do not work in production, and the other way round. If you forget the PAC, the Tax Administration's answer is revocation of the certificate and a new element.
• The file has an expiry date too, and a new element is requested the same way, within 30 days before expiry.

Short version

• The PIN goes with the card (L-PFR); a V-PFR has a PAC and a file.
• You choose the PIN yourself when requesting the card; the register vendor does not know it and should not ask.
• It is entered into the L-PFR, when signing in to the Tax Administration's services and sometimes into the ESIR. Too many wrong entries block the certificate; you then request revocation and a new element.
• The application for a new element is filed within 30 days before expiry, through ePorezi; before removing the old card, check the audit.