The way reference data (ie. a PIN) is changed w/o a pinpad is by concatenating the old and the new PIN and pass this to CHANGE_REFERENCE_DATA (0x24). Here is a funny effect of this assuming a fresh card:

You enter "123456789" as the old AdminPIN and you enter for the new Admin PIN "11223344". The result is that the Admin PIN is changed to "911223344". This is because the card implicitly knows the length of the old PIN and considers the "9" to be the first digit of the new PIN.

Thus we should do a VERIFY with the old PIN right before the CHNAGE_REFERENCE_DATA.