Live data from Hacker News

Losing a credit card due to automatic user behavior

jenny.berlin

11–20 of 62 posts

Re: Losing a credit card due to automatic user behavior

#12
post #9

Interesting, in the Netherlands almost all ATMs work in the same way as Germany, take the card first before it gives you the money. However the other part about paying a lot in cash seems strange to me? And a fee on card payments while cash withdrawal is free if the exact opposite of my Dutch card. Paying in shops is free, cash withdrawal within the country is also free (not sure if all banks do this), but taking cas…

We (my girlfriend, who is the author, and I) are with the German DKB bank, which offers a free checking account, EC card and credit card. You basically have two accounts with them, one connected to the EC card and one to the credit card. The credit card can be used for free cash withdrawals worldwide and POS payments in Germany, but if you use it to pay outside Germany, they charge a 1.75% fee. The EC card can also be used for POS payments in Germany and is useful since many more shops accept EC card payments compared to credit card payments in Germany...

Re: Losing a credit card due to automatic user behavior

#13
post #9

Interesting, in the Netherlands almost all ATMs work in the same way as Germany, take the card first before it gives you the money. However the other part about paying a lot in cash seems strange to me? And a fee on card payments while cash withdrawal is free if the exact opposite of my Dutch card. Paying in shops is free, cash withdrawal within the country is also free (not sure if all banks do this), but taking cas…

The debit card of Berliner Sparkasse works that way (paying in shops and domestic, Sparkasse-owned ATM is free, taking out money abroad isn’t). However, you can’t pay too much with that debit card outside Germany, so they have this “travel pack credit card” – taking out money with it abroad is free (if the ATM allows it), but using it otherwise still incurs a transaction fee.

Re: Losing a credit card due to automatic user behavior

#14
Bank of America switched years ago to "Insert card, remove card, enter PIN, take money, take receipt." Capturing invalid cards, while often done with early ATMs, turns out not to be all that useful as a fraud prevention measure. It's not required by the current PCI standard for ATMs.[1]

There's also an attack on ATMs called the "Lebanese Loop"[2] which requires that the ATM try to retain a card. So there's a security problem with retaining cards.

[1] https://www.pcisecuritystandards.org/pdfs/PCI_ATM_Security_G... [2] https://en.wikipedia.org/wiki/Lebanese_loop

Re: Losing a credit card due to automatic user behavior

#15
post #11

Unfortunately I can't provide a reference, but I distinctly remember reading that the user flow at German ATMs is specifically designed to minimize forgotten card incidents.

Interesting, if you (or someone else) has any source for this, I'd love to read it! I'd say that ALL ATMs should be designed to minimize those incidents though... :)

Re: Losing a credit card due to automatic user behavior

#16
post #7
post #6

Earlier quoted context omitted.

For what it's worth, every ATM I've ever used here (a major city in the US) has made you take the card back before continuing the transaction. That said, they've all used a "insert card -> remove card -> enter PIN -> perform transaction" flow rather than the "insert card -> enter PIN -> remove card -> perform transaction" flow mentioned in the article.

Interesting! We've noticed the behaviour described in the article at several ATMs in Montreal. Maybe a Québécois thing?

That would make sense, as I have noticed the same thing in Québec City and was rather confused about it. For me, returning the card first makes so much sense that I wondered how people could implement this differently. A lot of people will grab the cash, their brains will subconsciously tell them "I have what I came here for" and they will leave - without their card.

I see really only one potential advantage for doing it this way: you can provide other transactions after dispensing cash. So you could get some cash and then afterwards check your balance, for example, without having to re-enter card and PIN code. With the "international model", cash withdrawals are always the last transaction in the series as the card will always be withdrawn as part of the transaction. Nevertheless, I would judge this "convenience factor" as far less important as the protection against forgotten cards.

But maybe someone here works in the Canadian banking industry and has some clues? Maybe the recording of the withdrawal transactions works differently and the ATM needs the card for a short period after the money has been dispensed? I don't know...

Re: Losing a credit card due to automatic user behavior

#17
As far as I can tell France universally uses "Flow A" (get your card back first, then your cash). When I started using ATMs, in the late 80s, I remember that "Flow A" and "Flow B" were about equally common, then in a relatively short span of time all the banks switched to A.

It surprises me, reading about it now, that it could be different in any other part of the world. That Flow A is the correct solution is not obvious, but it should be obvious to anyone who's studied human behavior and human error, which should be anyone involved in the design of ATMs. The form of "goal fixation" Jenny mentions is a very common pattern in human errors.

Re: Losing a credit card due to automatic user behavior

#18
post #14

Bank of America switched years ago to "Insert card, remove card, enter PIN, take money, take receipt." Capturing invalid cards, while often done with early ATMs, turns out not to be all that useful as a fraud prevention measure. It's not required by the current PCI standard for ATMs.[1] There's also an attack on ATMs called the "Lebanese Loop"[2] which requires that the ATM try to retain a card. So there's a security…

"Insert card, remove card, ..." makes even more sense than returning the card right before the money!

Re: Losing a credit card due to automatic user behavior

#19
post #18
post #14

Bank of America switched years ago to "Insert card, remove card, enter PIN, take money, take receipt." Capturing invalid cards, while often done with early ATMs, turns out not to be all that useful as a fraud prevention measure. It's not required by the current PCI standard for ATMs.[1] There's also an attack on ATMs called the "Lebanese Loop"[2] which requires that the ATM try to retain a card. So there's a security…

"Insert card, remove card, ..." makes even more sense than returning the card right before the money!

Only if using the magnetic stripe. If the transaction is authorised using the smartcard chip on the card, the PIN is (AFAIK) used to unlock the authorisation on the chip and thus needs to be entered while the card is in the machine.
Post reply on HN