Summary: New PIN Terms and Conditions Activation Agreement and Challenge Question and Response Process To Be Implemented on December 26, 2004

Publication Date: December 16, 2004

Author: General Manager, FSA Application, School Eligibility and Delivery Services

Summary: New PIN Terms and Conditions Activation Agreement and Challenge Question and Response Process To Be Implemented on December 26, 2004

Posted on 12-16-2004

We would like to alert you to two significant changes to the PIN (Personal Identification Number) process that we are implementing on December 26, 2004. As you are aware, the PIN is an important tool for many of our online products. The PIN gives users the ability to sign documents electronically and to access personal data online. The enhancements described in this message are important measures designed to provide a secure environment for all PIN users.

The changes include the implementation of a PIN Terms and Conditions Activation Agreement and a Challenge Question and Response. These security enhancements affect all PIN users, including students, parents, and financial aid administrators (FAAs). Current holders of a PIN, as well as those who apply for a PIN on or after December 26, 2004, are affected by these changes.

PIN Terms and Conditions Activation Agreement

The PIN Terms and Conditions Activation Agreement explains to PIN users and applicants the importance of keeping the PIN in a safe place and not sharing the PIN with anyone (including third party servicers). PIN users and PIN applicants are required to agree with the terms and conditions before they can continue using their PIN or submit their PIN application.

Challenge Question and Response

To further increase the security of the PIN, current PIN users and new PIN applicants are required to select and answer a challenge question. This is a common security measure for Web sites that allow access to personal data. PIN users and applicants may choose from a selection of nine predefined questions. An example of a challenge question is "What is the name of your elementary school?"

Once users have provided their challenge question and response, they may be required to use their challenge question response in the following instances:

• To retrieve a PIN through an e-mail notification;
• To re-establish the PIN because the user unsuccessfully attempted to authenticate the PIN within 3 consecutive tries when logging in to a secure Web site or when signing a document electronically. This means that after providing the correct identifiers-Social Security Number (SSN), Last Name, and Date of Birth (DOB)- the user failed to provide the correct PIN in three consecutive attempts;
• To update an e-mail or mailing address on the PIN Web site without using a PIN; or
• To re-establish a PIN that has been disabled. Some reasons why a PIN may be disabled include not being used for 30 months or because the user intentionally disabled the PIN using the "Disable My PIN" function on the PIN Web site.

Under most circumstances, a PIN that has been disabled may be re-established by going to the PIN Web site, selecting "Re-Establish My PIN" from the home page and providing the correct challenge question response. However, there are situations in which a PIN will be permanently deactivated. These include situations in which users are found on the Death Master File (they are listed as deceased by the Social Security Administration) and when users cannot correctly answer the challenge question within three tries, after first failing to authenticate the PIN. These individuals will have to reapply for a PIN.

Effect on Current PIN Users

Current PIN users must agree to the PIN Terms and Conditions Activation Agreement and select and answer a challenge question before they will be able to use their PINs on or after December 26, 2004. Users will have two options for "activating" their PINs.

1. On or after December 26, 2004, current PIN users can go to the PIN Web site at www.pin.ed.gov and select "Activate My PIN" from the home page. After selecting this option, users will be required to agree with the PIN terms and conditions and select and answer a challenge question.

2. Users who do not go to the PIN Web site to activate their PIN will be prompted to activate it before they can continue using a secure Web site. For example, when students using FAFSA on the Web enter their SSN, Last Name, DOB and PIN, they will receive a "PIN Not Activated" page. There will be a link on this page to the PIN site where they will be required to agree with the PIN Terms and Conditions Activation Agreement and select and answer a challenge question. Once users have completed these two tasks, their identifiers will be authenticated, their PIN will be activated, and they will be able to continue doing business on the site.

Effect on New PIN Users

New users who apply for a PIN through the PIN Web site will be prompted to indicate their agreement with the terms and conditions and provide their challenge question and response before they submit their PIN application. As an additional security measure, if these new users retrieve their PIN through e-mail, they will be required to answer their challenge question before their PIN will be displayed.

Students whose PINs are automatically generated and sent due to a successful Social Security Administration Match on their processed FAFSA application, and FAAs whose PINs are generated as part of their enrollment in FAA Access to CPS Online, are required to activate their PIN in the same manner as current users (see "Effect on Current PIN Users" section above). In these cases, if the PIN for new users is e-mailed, users must indicate their agreement to the terms and conditions and provide their challenge question and response before they can view their PIN.

Explanation for Your Students

We heard from many of you attending our recent Electronic Access Conferences that you would like FSA to provide a brief explanation of these changes for you to post on your school's Web site for students to see. You may use the following text for this purpose:

"To enhance the security of your U.S. Department of Education PIN and your personal information on the Web, there are two significant changes to the PIN process that you should be aware of.

If you already have a PIN, the first time you attempt to use it on or after December 26, 2004, you will be prompted to agree to a PIN Terms and Conditions Activation Agreement, which asks you not to share your PIN with anyone and to keep it in a safe place, and to select and answer a challenge question. Only you will know the answer to your challenge question, and it may be used to validate your identity in the future.

If you apply for a PIN on or after December 26, 2004, you will be required to agree to the terms and conditions and provide a challenge question and response before your PIN will be issued.

These changes have been made to ensure the security of the PIN process and to remind you of the importance of safeguarding your PIN. Your PIN serves as your electronic signature and provides access to your personal records, and it is critical that it remain as secure as possible."

Renewal E-mail Notifications

To give advance notice to students of this new process, we have added information to the e-mails we send to applicants who are eligible to participate in the renewal application process. These notifications, which remind students they can use their PIN to complete their Renewal FAFSA online, now explain that as a new security measure they will first be prompted to agree to terms and conditions of PIN usage and select and answer a challenge question.

In addition to the enhancements described in this message, we are also making other enhancements to the PIN Web site and processes. All of the enhancements will be described in the 2005-2006 Student Web Application Products Process Guide, which will be posted in December to the U.S. Department of Education's Information for Financial Aid Professionals (IFAP) Web site, located at ifap.ed.gov, and ED's Federal Student Aid Download (FSADownload) Web site, located at fsadownload.ed.gov.

If you have any questions regarding this message or the PIN Web site in general, please contact the Federal Student Aid Information Center for assistance by calling 800/4-FED-AID (800/433-3243).