A system comprising: one or more computer programs implemented as one or more modules of computer program instructions encoded on a non-transitory computer storage medium for execution by, or to control the operation of, a mobile device to: display a user interface for personal identification number entry, receive input on the user interface representing a PIN, encrypt the PIN using a public cryptographic key stored on the mobile device, wherein the public cryptographic key is an asymmetric key that corresponds to a private cryptographic key stored at a card reader, and transmit the encrypted PIN to the card reader; and the card reader configured to: receive the encrypted PIN from the mobile device, decrypt the encrypted PIN using the private cryptographic key stored on the card reader, perform a comparison using the decrypted PIN, encrypt a response to the mobile device using the private cryptographic key stored on the card reader, the response being an acknowledgement that the card reader has verified a PIN match, and transmit the encrypted response to the mobile device; and the one or more computer programs further for execution by, or to control the operation of, the mobile device to: receive the encrypted response from the card reader. one or more computer programs implemented as one or more modules of computer program instructions encoded on a non-transitory computer storage medium for execution by, or to control the operation of, a mobile device to: display a user interface for personal identification number entry, receive input on the user interface representing a PIN, encrypt the PIN using a public cryptographic key stored on the mobile device, wherein the public cryptographic key is an asymmetric key that corresponds to a private cryptographic key stored at a card reader, and transmit the encrypted PIN to the card reader; and display a user interface for personal identification number entry, receive input on the user interface representing a PIN, encrypt the PIN using a public cryptographic key stored on the mobile device, wherein the public cryptographic key is an asymmetric key that corresponds to a private cryptographic key stored at a card reader, and transmit the encrypted PIN to the card reader; and the card reader configured to: receive the encrypted PIN from the mobile device, decrypt the encrypted PIN using the private cryptographic key stored on the card reader, perform a comparison using the decrypted PIN, encrypt a response to the mobile device using the private cryptographic key stored on the card reader, the response being an acknowledgement that the card reader has verified a PIN match, and transmit the encrypted response to the mobile device; and receive the encrypted PIN from the mobile device, decrypt the encrypted PIN using the private cryptographic key stored on the card reader, perform a comparison using the decrypted PIN, encrypt a response to the mobile device using the private cryptographic key stored on the card reader, the response being an acknowledgement that the card reader has verified a PIN match, and transmit the encrypted response to the mobile device; and the one or more computer programs further for execution by, or to control the operation of, the mobile device to: receive the encrypted response from the card reader.