Hacker News Reader

Comment by sid0 | Hacker News Reader

I believe this is a US-only problem. I haven't seen that sort of ATM in the last ten years where I'm from (India), and I was pretty shocked to see them in the US.

View on HN

First, I don't believe it's a problem but merely a different procedure. Second, in France (and most of Western Europe I think), all ATM's keep your card for the simple reason that the magnetic stripe (the part of the card that's in contact with the ATM when you swipe) is never used, to my knowledge. It's the chip that is used to verify the identity, locally record the transaction and more.

Is that the reason? The chip on the card is positioned so that readers can be designed to only need the card inserted about halfway.

I think it has more to do with giving the machine the ability to not give the card back. :-)

What possible use case exists for that ability? The card's generally blocked after a set number of incorrect attempts anyway, so it's not as if it could be used anywhere else.

ATMs that keep your card for the duration of the transaction only serve to decrease trust in the mechanism.

The card's generally blocked after a set number of incorrect attempts anyway, so it's not as if it could be used anywhere else.

Remember, credit cards originated before there was universal ubiquitous connectivity. It's still no guarantee (think of a small merchant at some outdoor festival). EMV (Chip and PIN) cards have an offline mode which an bad guy can use. http://www.cl.cam.ac.uk/~mkb23/interceptor/

ATMs that keep your card for the duration of the transaction only serve to decrease trust in the mechanism.

In the past, there were modes that allowed you to overdraw your account with an ATM. I imagine this was done in consideration for unreliable communications links or banks that needed downtime in their account balances for batch transaction processing.

"Trust" is a deep and strange concept, but at the end of the day US ATM cards are only a mag stripe and a 4-digit PIN. We'd best not expect too much from them. :-)

Dip ATMs (where you insert your card then pull it out) wouldn't have any trouble with chips either. I can see why it'd be an issue with swipe ATMs though.

I still think ATMs that eat your card up are terrible.

If you don't have a chip on your card, an ATM must ask the issuing bank to validate your PIN each time you type it in. Almost all communicate using the ISO-8583 protocol.

ISO-8583 defines two response codes that cause an ATM to retain your card:

41 - Pickup card (lost card) 43 - Pickup card (stolen card)

It is up to the issuing bank to decide whether to return those codes, or not.

Having had a machine in Romania keep (and supposedly destroy) my card in the first week of a 10-week visit in 2004, I can attest that this is not a US-only thing.

Reply on news.ycombinator.com