I don't see any indication on their website or marketing materials that they are accepting the PIN. I would be surprised if they did, because EMVCo have been firm in the past that a dedicated keypad is required.
I would be interested to know whether they're either capping the amount that can be charged, or are taking some of the liability themselves.
Square will also be looking to get as many people on contactless as possible, because with Apple Pay / Android Pay you can exceed the usual capped limit in the UK (I believe it's something like £30 with a regular contactless card before PIN entry is required).
They do clearly show a pin screen on their site though but it might just be the marketing dept
This is a very good question and I wonder how they've "squared" that with the credit card companies. Is it by any chance iPhone-only? Or does it actually do a card-not-present transaction?
All the normal Verifone, Ingenico etc EMV devices have built in key pads.
For the types of places this device will appeal to (small businesses where individual transactions are less that £30), contactless is taking over (in the UK at least) so this is less of a concern I think.
Contactless has already taken over. But it is still possible to spend more than £30 in a small business. What happens then?
The only security-relates info I can find, the PCI PTS certification for the Square contactless and ICC reader, mentions a USB connection to a branded base-station, and nothing much about PIN entry.
I hope they aren't trying an end-run around PCI certs?
It would be trivial for people to intercept the PIN number when it is entered on the seller's phone. That's why competitor devices (iZettle, PayPal) all have a keypad and screen on the card reader itself, it lowers the possibility of interception of the PIN number.
In fact, I am fairly sure that I read in the past that the credit card companies wouldn't allow this type of implementation.
I would certainly feel very uncomfortable entering my PIN number into someone's phone.
--
EDIT:
So, from what I can tell the design of the PIN entry keypad for EMV is governed by ISO 9564[1], which states:
I don't believe that entering a PIN into a phone based keypad is compliant with that.1: https://en.wikipedia.org/wiki/ISO_9564