Why do ATMs accept any PIN?

This answer applies when the ATM uses the card's magnetic stripe, not when the card's chip is used.

The keyboard of an ATM is a completely separated device with special hardware security features (like self-destroying chips if someone tries to open it, etc.) because it's the bottleneck of the whole ATM security.

When you enter a pin, the ATM itself won't receive the PIN in plaintext, but rather get the PIN encrypted. When it sends a transaction to the main server, it cryptographically combines the encrypted PIN with the amount of money specified in the transaction to prevent attackers from modifying this amount.

If the ATM would have verified the PIN before the transaction (by sending it to the server), the specification of the amount of money couldn't be securely related to the knowledge of the PIN.

Therefore, the ATM can't verify whether the PIN is valid or not until it attempts to issue a transaction to the main bank servers (who know how to decrypt or otherwise verify the encrypted PIN).


Confirming the PIN when the card's magnetic stripe is used requires contacting the bank's server. Since this takes time (and took even more time back in the days of dialup), the ATM combines "verify the PIN" and "withdraw money" into a single contact.

The behavior might be different if the card has a chip and the ATM supports it.


Most ATMs have to deal with 2 types of cards: old, magnetic ones and newer chip cards. Magnetic cards can't verify the PIN locally. Chip cards theoretically have this ability - but it doesn't mean that this functionality isn't limited.

The behavior you've described perfectly matches magnetic card flow. But - should chip card be verified using another path? There are 2 reasons it should not:

1) Implementing brand new second path costs money. ATM manufacturer surely want's to keep costs low and reuse as much of the code as possible.

2) Presenting consistent user experience. It's easy to imagine someone with 2 cards, one magnetic and one chip. Or a customer being issued new chip card to replace old magnetic-only one. There is no need to confuse users by providing them with 2 different paths. ATMs are scary enough.

/edit: Oh, I forgot one very important thing:

Local PIN on card can be out of date.

In many banks you can change card's PIN, but there is no way the card's chip can know about it. So if ATM would check PIN locally, it would reject correct, new PIN, but allow incorrect, old PIN. And ofc PIN check would succeed and transaction would fail.

Tags:

Atm