Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

ATMs get occasionally stolen. How easy would be for the thiefs to retieve the PINs and other information of the users that have previously used the ATM? Is there a periodic wipe of all records/logs/traces on the machine within the ATM enclosure?

share|improve this question
add comment

3 Answers

There is no way to no for sure what happens inside the ATM, but most ATMs handle transactions by connecting to a server. There is no reason that it should have to keep any record of transactions internally.

share|improve this answer
add comment

My sense is that ATM transactions processing is done mostly on the server side:

An ATM is basically a safe with a PC, an LCD monitor and some additional devices. ATMs are not on the Internet...

To clarify, they are not internet-accessible in the sense that installing cracking software on an ATM would require physical access to internals of the ATM, in advance of harvesting users' data.

Typically only an encrypted version of the PIN is stored and transmitted. There are few, if any, reported incidents of customers' personal information being retrieved from stolen ATMs. Instead, card skimming (copying data from ATM cards' magnetic strip) is the primary method used for ATM fraud.

The ATM is often severely traumatized by being pulled from its concrete foundation by a truck, with a chain wrapped around it. Even if it were not irreparably damaged, the modus operandi of ATM thieves is to open the ATM with a blow torch, which would likely impair function of anything that remained. Harvesting customer PINs, after stealing the ATM, would be unlikely. Thieves empty the cash, and abandon the ATM. ATMs are typically recovered by authorities after being incinerated, buried, submerged in lakes etc.

share|improve this answer
add comment

PINS are not stored within the ATM machines. When you type in your PIN in the keypad an offset is calculated (essentially a hash) and that is what is sent to the back end host. The hashes are not stored in the ATM either.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.