Losing a credit card due to automatic user behavior | Hacker News Reader

Losing a credit card due to automatic user behavior

jenny.berlin

23 pointsmanume57 comments

As far as I can tell France universally uses "Flow A" (get your card back first, then your cash). When I started using ATMs, in the late 80s, I remember that "Flow A" and "Flow B" were about equally common, then in a relatively short span of time all the banks switched to A.

It surprises me, reading about it now, that it could be different in any other part of the world. That Flow A is the correct solution is not obvious, but it should be obvious to anyone who's studied human behavior and human error, which should be anyone involved in the design of ATMs. The form of "goal fixation" Jenny mentions is a very common pattern in human errors.

I just learned (thanks to James Arlen who commented directly under the blogpost), that Flow B was really useful when ATMs first showed up in the mid-80s, because people mostly made more than one transaction. They quite often made deposits and a withdrawal within one process and for each action the machine had to read the card. Therefore, it made sense that the machine kept the card till the moment when every single action was finished. But this isn’t a common pattern any longer and the flow should change in a way that makes more sense nowadays.

It surprises me that a flattened out workflow like http://i.ytimg.com/vi/luu3_y2MWGQ/maxresdefault.jpg isn't widely used. There's a very strong 'default' use of an ATM, and the conventional workflow does not optimize for it at all.

My bank switched to this layout recently, and it took me a good minute to work out what was going on, and how I should go about getting my money out. It might not have been so bad if I had just read the screen though, but I was trying to find the normal menus.

I guess a machine like an ATM has be usable by 100% of the population, including people who get easily confused by more than two options/buttons, so usability has to be sacrificed for simplicity to a certain degree.

My mother is like this. She is used to card-then-cash flow. Once she was using ATM abroad with me helping her (because it's in english). The moment card came out she turned to me with frantic face asking "where's the money?!?". She generally distrusts ATMs.

I once lost my card due to cash-then-card flow. And once left cash in card-then-cash machine. Bank did returned it though.

It's not obvious. The user might want do something else with the card even after withdrawing the money. The money are not necessarily the "goal". This is coming from someone living in a country where flow A is the most common.

This incident happened to my grandfather in France 30 years ago (mid 80s), at an ATM using "Flow B". A few months later the ATM was changed to use "Flow A" instead and I have never used a single ATM using "Flow B" since I have been in age of using a credit card myself.

I'm really puzzled that someone is still designing "Flow B" type ATMs these days (unless its a 80s model that they bought at a yard sale...).

The Netherlands uses flow A everywhere as far as I can tell, while Belgium seems to use a mix of both.

Bank of America switched years ago to "Insert card, remove card, enter PIN, take money, take receipt." Capturing invalid cards, while often done with early ATMs, turns out not to be all that useful as a fraud prevention measure. It's not required by the current PCI standard for ATMs.[1]

There's also an attack on ATMs called the "Lebanese Loop"[2] which requires that the ATM try to retain a card. So there's a security problem with retaining cards.

[1] https://www.pcisecuritystandards.org/pdfs/PCI_ATM_Security_G... [2] https://en.wikipedia.org/wiki/Lebanese_loop

How would that work with modern chip-based cards? As far as I know, you cannot complete the payment at all if the chip is not available.

When using a Chip+PIN card in the US recently, I had to insert, remove, insert again, enter PIN, take card, take cash.

It took two of us two ATMs and about 15mins to figure it out ;)

Mostly off topic, but I can't seem to find the answer online:

Does anyone happen to know what the difference is between 6 contact and 8 contact chips? I have an older travel card that has 6 pads, and a recently issued card that has 8 contact pads. Are they inter-operable? I've only used the chip and sign twice so far, both with the newer card.

Perhaps Lebanese loop could be used in relay attacks?

"Insert card, remove card, ..." makes even more sense than returning the card right before the money!

Only if using the magnetic stripe. If the transaction is authorised using the smartcard chip on the card, the PIN is (AFAIK) used to unlock the authorisation on the chip and thus needs to be entered while the card is in the machine.

The author is mistaken about people always waiting for their money from an ATM. I've seen people take their card and leave the machine before the money comes out. I'm pretty sure I've done it myself at least once, when I was thinking about something else.

But generally the negative effect will be lower: You'll lose your money if there are people coming after you that are dishonest enough to take the money only. Otherwise it'll get pulled back in. You'll still have your card.

I'm not sure I agree. I'd much rather lose a card than money.

I'm sure there are people who arrived at work one day and only then noticed they had forgotten to put on pants, but I guess quite a lot more forget their wallet or cell phone. ;)

Of course this is a user flow that happens as well. But I think way more often people are really focused on holding the money in their hands.

In terms of ATM struggles for foreign visitors, Brazil really holds the record. The workflow requires you to insert your card twice (at least for Banco do Brasil). It goes like this:

Insert card -> Take card (no PIN entered yet) -> Choose account & amount -> Enter PIN -> Insert card again -> Take card -> Take cash

Also, most banks in Brazil have ATMs that DON'T give cash right beside ATMs that DO give cash. The ones that don't give cash are meant for deposits, balances, payments, and transfers, but the GUI is otherwise identical, i.e., they display a cash withdrawal button even though they aren't equipped for cash! "If you then proceed with a cash withdrawal, the machine will hold onto your card for several minutes while making dispensing noises and finally return your card without giving any cash or receipt."[1]

[1] http://brazilsense.com/index.php?title=Bank_cards_and_ATMs#L...

Wow, that sounds like a complete UX disaster!!! In Germany we also have machines where you can’t get cash, but each machine usually has a sign that tells you what you can do with it and they also have different keyboards.

Unfortunately I can't provide a reference, but I distinctly remember reading that the user flow at German ATMs is specifically designed to minimize forgotten card incidents.

Interesting, if you (or someone else) has any source for this, I'd love to read it! I'd say that ALL ATMs should be designed to minimize those incidents though... :)

I actually had this exact thought. There's some good discussion on my UX StackExchange question about it: http://ux.stackexchange.com/questions/23462/why-dont-atms-gi...

Thanks for the link - there are some really interesting comments!

If you remember the reference, I would love to read it!!

Some ATMs in Canada do make you take your card first before dispensing the money if it's not your last transaction. Others display a "Remember to take your card" message. Others have a beep and flashing light near the card slot.

There really is no standard.

For what it's worth, every ATM I've ever used here (a major city in the US) has made you take the card back before continuing the transaction.

That said, they've all used a "insert card -> remove card -> enter PIN -> perform transaction" flow rather than the "insert card -> enter PIN -> remove card -> perform transaction" flow mentioned in the article.

Interesting! We've noticed the behaviour described in the article at several ATMs in Montreal. Maybe a Québécois thing?

That would make sense, as I have noticed the same thing in Québec City and was rather confused about it. For me, returning the card first makes so much sense that I wondered how people could implement this differently. A lot of people will grab the cash, their brains will subconsciously tell them "I have what I came here for" and they will leave - without their card.

I see really only one potential advantage for doing it this way: you can provide other transactions after dispensing cash. So you could get some cash and then afterwards check your balance, for example, without having to re-enter card and PIN code. With the "international model", cash withdrawals are always the last transaction in the series as the card will always be withdrawn as part of the transaction. Nevertheless, I would judge this "convenience factor" as far less important as the protection against forgotten cards.

But maybe someone here works in the Canadian banking industry and has some clues? Maybe the recording of the withdrawal transactions works differently and the ATM needs the card for a short period after the money has been dispensed? I don't know...

Yes, multiple (trans)actions in one session are a use case where it would make sense to keep the card until the end. I'd say it would still make sense to return the card before the cash and have the user insert it again - a small inconvenience for the few users that want to do multiple actions but probably a big decline in forgotten cards.

Interesting, in the Netherlands almost all ATMs work in the same way as Germany, take the card first before it gives you the money.

However the other part about paying a lot in cash seems strange to me? And a fee on card payments while cash withdrawal is free if the exact opposite of my Dutch card. Paying in shops is free, cash withdrawal within the country is also free (not sure if all banks do this), but taking cash from an ATM abroad costs a small transaction fee.

We (my girlfriend, who is the author, and I) are with the German DKB bank, which offers a free checking account, EC card and credit card. You basically have two accounts with them, one connected to the EC card and one to the credit card. The credit card can be used for free cash withdrawals worldwide and POS payments in Germany, but if you use it to pay outside Germany, they charge a 1.75% fee. The EC card can also be used for POS payments in Germany and is useful since many more shops accept EC card payments compared to credit card payments in Germany...

The debit card of Berliner Sparkasse works that way (paying in shops and domestic, Sparkasse-owned ATM is free, taking out money abroad isn’t). However, you can’t pay too much with that debit card outside Germany, so they have this “travel pack credit card” – taking out money with it abroad is free (if the ATM allows it), but using it otherwise still incurs a transaction fee.

Don't forget the fee they take if your account and the money you withdraw are different currencies. ;)

Usually such German cards use the Visa/Mastercard foreign exchange rate for ATM transactions (no extra fee) and POS transactions (plus currency conversion fee, but no additional fee for using abroad).

In Sweden (and possible in other countries) the ATMs let you choose whether you want to let the ATM (or bank that the ATM belongs to) do the conversion from Euro to Swedish Kronor or your own bank. If you pick the latter option, your bank might charge you for the conversion, I never had the case that the Swedish bank charged for it.

This is known as "dynamic currency conversion" and gives you a much worse deal than letting them charge you in a foreign currency (even when your bank has high fees). The way they do it is by offering a really bad exchange rate. In fact, the Swedish bank charges you for that, it's just hidden in the exchange rate.

Oh really? I never bothered to check the exchange rate. Good to know, I'll let my German bank do the conversion from now on!

One solution to the problem of user flow A vs user flow B is to dispense the cash and return the card simultaneously and together. The "together" part is admittedly difficult to engineer but perhaps the card slot could be placed just above the cash dispenser, so both are in your line of sight.

Good idea! If both the money and the card could be taken in the same movement, that would make it very convenient.

I went to Japan a couple of years ago and one of the ATMs we used had an internal conveyor system of some kind, which resulted in it ejecting the card with the cash and receipt simultaneously from the same slot. I've always wondered why those weren't more standard, it seemed much more efficient.

Most Japanese machines I've encountered would also throw a fit and beep and yell at you if you left something in a slot for more than a second. I don't recall any German ATMs audibly remining my of my inefficiency.

I lost my (German) credit card exactly the same way in Bangkok. Unlike the author, I never received my card back and had to order a replacement card, which takes ages to ship to the other side of the world. Never travel without a second credit card.

Hey, could you share some information on how do you make those awesome graphics? :)

My girlfriend (the author) is out hiking right now. :) She uses Illustrator and Sketch AFAIK. You can see more of her work on her profile: https://www.jennylettow.com/ Feel free to contact her via email to ask for details!

Thanks for using the word "awesome" in combination with my graphics! Nice to hear :-) I did these graphics with (Adobe) Illustrator. Usually I make a rough sketch first, scan it, import it into Illustrator and start to rebuild it as a vector graphic.

    Website is offline
    No cached version of
    this page is available.

    Error 522
    Connection timed out

I'm commenting because I want to come back and find this later, but I don't want to upvote without reading, and I don't have a unified bookmark list, so bookmarking won't help if I subsequently use a different machine.

Edit: Now read it - thanks for the cache reference

Google has it cached:

https://webcache.googleusercontent.com/search?q=cache:AUPocA...

WTF was this down-voted ?!? There are times when I really, really do not understand the mentality and/or reasoning, if any, of some of the people here.

Sorry for that... working on getting it back up right now!

And we're back!

Not for long it seems.

I had to take down the server for a minute to install a WP caching plugin, it should be back up soon!

I had to take the server down for a minute to install a caching plugin... check back soon!

Reply on news.ycombinator.com