Hacker News Reader

Comment by akgerber | Hacker News Reader

I've always wondered why newer ATMs like to retain the card until after the transaction. I've left my card in an ATM two or three times while in a rush on account of that.

View on HN

Newer/better ones will force you to take your card back before dispensing cash, which I think it's an elegant solution. Keeping your card in the first place is, I suspect, a security thing.

I have taken back my card and walked away forgetting to take my cash on two occasions when using such systems. The stupiditity of users knows no bounds.

There's a definite trade-off here: on the one hand, people are less likely to forget to take their cash; on the other hand, people who find a forgotten card in an ATM are unlikely to abuse it, but if they find cash, they'll probably just pocket it.

All the bank ATM's I've encountered here in the UK won't dispense cash until you've taken your card back out of the slot.

The first ATM I used in Thailand a few years ago, dispensed the cash and then gave the card back. Needless to say I walked off with my money and no card. That turned into a fun holiday....

Most US ATMs can detain cards. This can be done in response to a request from the issuing bank, or if the card is left in the slot after the transaction as a safeguard.

I'd suspect that they want to keep the opportunity to seize the card until the last possible moment.

I've heard that with some of these ATMs, if you enter an invalid PIN too many times, it'll kick you out and eat the card. I've never tried this, personally.

It's happened to me.

Definitely happened to me too. Also, I've noticed the ATMs at convenience stores, bars, on street corners etc are usually the swipe ones and the ones at banks are usually the keep your cards ones for some reason. To me the ones that give me card back right away are much much nicer as it's much harder for me to forget my cash than my card, and it means I only have 1 thing (which is my goal anyway) to get from the machine. It's nice that basically the ones around the places I wind up when I'm tipsy in the middle of the night are the ones that're set up so they're hardest for me to mess up.

I'm not sure if it's simply coincidence, but I've noticed that while most new ATMs (in the US) are swipe only, it seems that on ATMs that allow deposits the machine retains the card. I'm not sure if there's a reason the card is retained for deposits. I also could just be tricking myself with anecdotal evidence, but I've definitely seen new ATMs side by side with a swipe withdrawal-only and a retaining withdrawal-and-deposit.

It works well for me. I always remember I need to get my card back, but more than once I have almost walked away from the kind that return your card first without taking my cash out of the slot because I was in a hurry.

I believe this is a US-only problem. I haven't seen that sort of ATM in the last ten years where I'm from (India), and I was pretty shocked to see them in the US.

First, I don't believe it's a problem but merely a different procedure. Second, in France (and most of Western Europe I think), all ATM's keep your card for the simple reason that the magnetic stripe (the part of the card that's in contact with the ATM when you swipe) is never used, to my knowledge. It's the chip that is used to verify the identity, locally record the transaction and more.

Is that the reason? The chip on the card is positioned so that readers can be designed to only need the card inserted about halfway.

I think it has more to do with giving the machine the ability to not give the card back. :-)

What possible use case exists for that ability? The card's generally blocked after a set number of incorrect attempts anyway, so it's not as if it could be used anywhere else.

ATMs that keep your card for the duration of the transaction only serve to decrease trust in the mechanism.

The card's generally blocked after a set number of incorrect attempts anyway, so it's not as if it could be used anywhere else.

Remember, credit cards originated before there was universal ubiquitous connectivity. It's still no guarantee (think of a small merchant at some outdoor festival). EMV (Chip and PIN) cards have an offline mode which an bad guy can use. http://www.cl.cam.ac.uk/~mkb23/interceptor/

ATMs that keep your card for the duration of the transaction only serve to decrease trust in the mechanism.

In the past, there were modes that allowed you to overdraw your account with an ATM. I imagine this was done in consideration for unreliable communications links or banks that needed downtime in their account balances for batch transaction processing.

"Trust" is a deep and strange concept, but at the end of the day US ATM cards are only a mag stripe and a 4-digit PIN. We'd best not expect too much from them. :-)

Dip ATMs (where you insert your card then pull it out) wouldn't have any trouble with chips either. I can see why it'd be an issue with swipe ATMs though.

I still think ATMs that eat your card up are terrible.

If you don't have a chip on your card, an ATM must ask the issuing bank to validate your PIN each time you type it in. Almost all communicate using the ISO-8583 protocol.

ISO-8583 defines two response codes that cause an ATM to retain your card:

41 - Pickup card (lost card) 43 - Pickup card (stolen card)

It is up to the issuing bank to decide whether to return those codes, or not.

Having had a machine in Romania keep (and supposedly destroy) my card in the first week of a 10-week visit in 2004, I can attest that this is not a US-only thing.

Reply on news.ycombinator.com