Losing a credit card due to automatic user behavior
11–20 of 62 posts
Re: Losing a credit card due to automatic user behavior
#12Interesting, in the Netherlands almost all ATMs work in the same way as Germany, take the card first before it gives you the money. However the other part about paying a lot in cash seems strange to me? And a fee on card payments while cash withdrawal is free if the exact opposite of my Dutch card. Paying in shops is free, cash withdrawal within the country is also free (not sure if all banks do this), but taking cas…
Re: Losing a credit card due to automatic user behavior
#13Interesting, in the Netherlands almost all ATMs work in the same way as Germany, take the card first before it gives you the money. However the other part about paying a lot in cash seems strange to me? And a fee on card payments while cash withdrawal is free if the exact opposite of my Dutch card. Paying in shops is free, cash withdrawal within the country is also free (not sure if all banks do this), but taking cas…
Re: Losing a credit card due to automatic user behavior
#14There's also an attack on ATMs called the "Lebanese Loop"[2] which requires that the ATM try to retain a card. So there's a security problem with retaining cards.
[1] https://www.pcisecuritystandards.org/pdfs/PCI_ATM_Security_G... [2] https://en.wikipedia.org/wiki/Lebanese_loop
Re: Losing a credit card due to automatic user behavior
#15Unfortunately I can't provide a reference, but I distinctly remember reading that the user flow at German ATMs is specifically designed to minimize forgotten card incidents.
Re: Losing a credit card due to automatic user behavior
#16Earlier quoted context omitted.
For what it's worth, every ATM I've ever used here (a major city in the US) has made you take the card back before continuing the transaction. That said, they've all used a "insert card -> remove card -> enter PIN -> perform transaction" flow rather than the "insert card -> enter PIN -> remove card -> perform transaction" flow mentioned in the article.
Interesting! We've noticed the behaviour described in the article at several ATMs in Montreal. Maybe a Québécois thing?
I see really only one potential advantage for doing it this way: you can provide other transactions after dispensing cash. So you could get some cash and then afterwards check your balance, for example, without having to re-enter card and PIN code. With the "international model", cash withdrawals are always the last transaction in the series as the card will always be withdrawn as part of the transaction. Nevertheless, I would judge this "convenience factor" as far less important as the protection against forgotten cards.
But maybe someone here works in the Canadian banking industry and has some clues? Maybe the recording of the withdrawal transactions works differently and the ATM needs the card for a short period after the money has been dispensed? I don't know...
Re: Losing a credit card due to automatic user behavior
#17It surprises me, reading about it now, that it could be different in any other part of the world. That Flow A is the correct solution is not obvious, but it should be obvious to anyone who's studied human behavior and human error, which should be anyone involved in the design of ATMs. The form of "goal fixation" Jenny mentions is a very common pattern in human errors.
Re: Losing a credit card due to automatic user behavior
#18Bank of America switched years ago to "Insert card, remove card, enter PIN, take money, take receipt." Capturing invalid cards, while often done with early ATMs, turns out not to be all that useful as a fraud prevention measure. It's not required by the current PCI standard for ATMs.[1] There's also an attack on ATMs called the "Lebanese Loop"[2] which requires that the ATM try to retain a card. So there's a security…
Re: Losing a credit card due to automatic user behavior
#19Bank of America switched years ago to "Insert card, remove card, enter PIN, take money, take receipt." Capturing invalid cards, while often done with early ATMs, turns out not to be all that useful as a fraud prevention measure. It's not required by the current PCI standard for ATMs.[1] There's also an attack on ATMs called the "Lebanese Loop"[2] which requires that the ATM try to retain a card. So there's a security…
"Insert card, remove card, ..." makes even more sense than returning the card right before the money!