Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
3 clarify that "verifying your PIN using your ATM card" is a hypothetical scenario used to explain why the actual system is not like that.
source | link

This occurs because of two reasons:

  1. It is more secure and banks want to save on bandwidth.

    The bank usually stores your PIN in hashed form in its database. To be able to verify the PIN you've entered at the ATM, the ATM has to send to the bank server the hash of the PIN you've entered. These two hashes are then compared to check if the PIN you've entered is correct and only then, are you allowed to perform transactions. Of course, it is a rudimentary approach to security. There are things like replay and man-in-middle attacks to consider (for more info, read Challenge-response authentication).

    Instead of doing this, the bank can send your PIN together with the transaction itself, verifying your PIN and transaction at the same time. This saves bandwidth, and is potentially more secure since the attack window is decreased. For example, if the bank authenticates your session from the moment you've entered your PIN, it gives any potential attacker time to intercept the connection and make their own transaction(s).

    On the other hand, a proper secure connection is difficult to implement and bugs do occur. A one-off verification when you make a transaction allows the bank to identify you securely and saves bandwidth. Ultimately, it still depends on the ATM machine in question, since the bank can always verify your PIN at the start of each session and for each subsequent transaction.

  2. ATM cards do not store your PIN in the magnetic stripe. (Chip cards do.)

    In contrast to some answers, ATM cards cannot and will not store your PIN. The purpose of the ATM card is to achieve two factor authentication: something you have (the card) and something you know (the PIN). There have been instances where the ATM card has been breached by attackers.

    The ATM has to connect to the bank servers to verify you are who you say you are. ATM cards can and have been duplicated before (skimming). By verifying yourIf the PIN could be verified off-line using youronly the data on the magnetic stripe on the ATM card, itattackers could brute-force attack all 9999 possible PINs fairly rapidly with an off-line attack. So the system is easydesigned to require contacting the bank for each guess, making it more difficult for attackers to steal your ATM card, change it and withdraw all your money.

This occurs because of two reasons:

  1. It is more secure and banks want to save on bandwidth.

    The bank usually stores your PIN in hashed form in its database. To be able to verify the PIN you've entered at the ATM, the ATM has to send to the bank server the hash of the PIN you've entered. These two hashes are then compared to check if the PIN you've entered is correct and only then, are you allowed to perform transactions. Of course, it is a rudimentary approach to security. There are things like replay and man-in-middle attacks to consider (for more info, read Challenge-response authentication).

    Instead of doing this, the bank can send your PIN together with the transaction itself, verifying your PIN and transaction at the same time. This saves bandwidth, and is potentially more secure since the attack window is decreased. For example, if the bank authenticates your session from the moment you've entered your PIN, it gives any potential attacker time to intercept the connection and make their own transaction(s).

    On the other hand, a proper secure connection is difficult to implement and bugs do occur. A one-off verification when you make a transaction allows the bank to identify you securely and saves bandwidth. Ultimately, it still depends on the ATM machine in question, since the bank can always verify your PIN at the start of each session and for each subsequent transaction.

  2. ATM cards do not store your PIN in the magnetic stripe. (Chip cards do.)

    In contrast to some answers, ATM cards cannot and will not store your PIN. The purpose of the ATM card is to achieve two factor authentication: something you have (the card) and something you know (the PIN). There have been instances where the ATM card has been breached by attackers.

    The ATM has to connect to the bank servers to verify you are who you say you are. ATM cards can and have been duplicated before (skimming). By verifying your PIN using your ATM card, it is easy for attackers to steal your ATM card, change it and withdraw all your money.

This occurs because of two reasons:

  1. It is more secure and banks want to save on bandwidth.

    The bank usually stores your PIN in hashed form in its database. To be able to verify the PIN you've entered at the ATM, the ATM has to send to the bank server the hash of the PIN you've entered. These two hashes are then compared to check if the PIN you've entered is correct and only then, are you allowed to perform transactions. Of course, it is a rudimentary approach to security. There are things like replay and man-in-middle attacks to consider (for more info, read Challenge-response authentication).

    Instead of doing this, the bank can send your PIN together with the transaction itself, verifying your PIN and transaction at the same time. This saves bandwidth, and is potentially more secure since the attack window is decreased. For example, if the bank authenticates your session from the moment you've entered your PIN, it gives any potential attacker time to intercept the connection and make their own transaction(s).

    On the other hand, a proper secure connection is difficult to implement and bugs do occur. A one-off verification when you make a transaction allows the bank to identify you securely and saves bandwidth. Ultimately, it still depends on the ATM machine in question, since the bank can always verify your PIN at the start of each session and for each subsequent transaction.

  2. ATM cards do not store your PIN in the magnetic stripe. (Chip cards do.)

    In contrast to some answers, ATM cards cannot and will not store your PIN. The purpose of the ATM card is to achieve two factor authentication: something you have (the card) and something you know (the PIN). There have been instances where the ATM card has been breached by attackers.

    The ATM has to connect to the bank servers to verify you are who you say you are. ATM cards can and have been duplicated before (skimming). If the PIN could be verified off-line using only the data on the magnetic stripe on the ATM card, attackers could brute-force attack all 9999 possible PINs fairly rapidly with an off-line attack. So the system is designed to require contacting the bank for each guess, making it more difficult for attackers to steal your ATM card and withdraw all your money.

2 chip cards do store the PIN (at least EMV ones and older French ones)
source | link

This occurs because of two reasons:

  1. It is more secure and banks want to save on bandwidth.

    The bank usually stores your PIN in hashed form in its database. To be able to verify the PIN you've entered at the ATM, the ATM has to send to the bank server the hash of the PIN you've entered. These two hashes are then compared to check if the PIN you've entered is correct and only then, are you allowed to perform transactions. Of course, it is a rudimentary approach to security. There are things like replay and man-in-middle attacks to consider (for more info, read Challenge-response authentication).

    Instead of doing this, the bank can send your PIN together with the transaction itself, verifying your PIN and transaction at the same time. This saves bandwidth, and is potentially more secure since the attack window is decreased. For example, if the bank authenticates your session from the moment you've entered your PIN, it gives any potential attacker time to intercept the connection and make their own transaction(s).

    On the other hand, a proper secure connection is difficult to implement and bugs do occur. A one-off verification when you make a transaction allows the bank to identify you securely and saves bandwidth. Ultimately, it still depends on the ATM machine in question, since the bank can always verify your PIN at the start of each session and for each subsequent transaction.

  2. ATM cards do not store your PIN in the magnetic stripe. (Chip cards do.)

    In contrast to some answers, ATM cards cannot and will not store your PIN. The purpose of the ATM card is to achieve two factor authentication: something you have (the card) and something you know (the PIN). There have been instances where the ATM card has been breached by attackers.

    The ATM has to connect to the bank servers to verify you are who you say you are. ATM cards can and have been duplicated before (skimming). By verifying your PIN using your ATM card, it is easy for attackers to steal your ATM card, change it and withdraw all your money.

This occurs because of two reasons:

  1. It is more secure and banks want to save on bandwidth.

    The bank usually stores your PIN in hashed form in its database. To be able to verify the PIN you've entered at the ATM, the ATM has to send to the bank server the hash of the PIN you've entered. These two hashes are then compared to check if the PIN you've entered is correct and only then, are you allowed to perform transactions. Of course, it is a rudimentary approach to security. There are things like replay and man-in-middle attacks to consider (for more info, read Challenge-response authentication).

    Instead of doing this, the bank can send your PIN together with the transaction itself, verifying your PIN and transaction at the same time. This saves bandwidth, and is potentially more secure since the attack window is decreased. For example, if the bank authenticates your session from the moment you've entered your PIN, it gives any potential attacker time to intercept the connection and make their own transaction(s).

    On the other hand, a proper secure connection is difficult to implement and bugs do occur. A one-off verification when you make a transaction allows the bank to identify you securely and saves bandwidth. Ultimately, it still depends on the ATM machine in question, since the bank can always verify your PIN at the start of each session and for each subsequent transaction.

  2. ATM cards do not store your PIN.

    In contrast to some answers, ATM cards cannot and will not store your PIN. The purpose of the ATM card is to achieve two factor authentication: something you have (the card) and something you know (the PIN). There have been instances where the ATM card has been breached by attackers.

    The ATM has to connect to the bank servers to verify you are who you say you are. ATM cards can and have been duplicated before (skimming). By verifying your PIN using your ATM card, it is easy for attackers to steal your ATM card, change it and withdraw all your money.

This occurs because of two reasons:

  1. It is more secure and banks want to save on bandwidth.

    The bank usually stores your PIN in hashed form in its database. To be able to verify the PIN you've entered at the ATM, the ATM has to send to the bank server the hash of the PIN you've entered. These two hashes are then compared to check if the PIN you've entered is correct and only then, are you allowed to perform transactions. Of course, it is a rudimentary approach to security. There are things like replay and man-in-middle attacks to consider (for more info, read Challenge-response authentication).

    Instead of doing this, the bank can send your PIN together with the transaction itself, verifying your PIN and transaction at the same time. This saves bandwidth, and is potentially more secure since the attack window is decreased. For example, if the bank authenticates your session from the moment you've entered your PIN, it gives any potential attacker time to intercept the connection and make their own transaction(s).

    On the other hand, a proper secure connection is difficult to implement and bugs do occur. A one-off verification when you make a transaction allows the bank to identify you securely and saves bandwidth. Ultimately, it still depends on the ATM machine in question, since the bank can always verify your PIN at the start of each session and for each subsequent transaction.

  2. ATM cards do not store your PIN in the magnetic stripe. (Chip cards do.)

    In contrast to some answers, ATM cards cannot and will not store your PIN. The purpose of the ATM card is to achieve two factor authentication: something you have (the card) and something you know (the PIN). There have been instances where the ATM card has been breached by attackers.

    The ATM has to connect to the bank servers to verify you are who you say you are. ATM cards can and have been duplicated before (skimming). By verifying your PIN using your ATM card, it is easy for attackers to steal your ATM card, change it and withdraw all your money.

1
source | link

This occurs because of two reasons:

  1. It is more secure and banks want to save on bandwidth.

    The bank usually stores your PIN in hashed form in its database. To be able to verify the PIN you've entered at the ATM, the ATM has to send to the bank server the hash of the PIN you've entered. These two hashes are then compared to check if the PIN you've entered is correct and only then, are you allowed to perform transactions. Of course, it is a rudimentary approach to security. There are things like replay and man-in-middle attacks to consider (for more info, read Challenge-response authentication).

    Instead of doing this, the bank can send your PIN together with the transaction itself, verifying your PIN and transaction at the same time. This saves bandwidth, and is potentially more secure since the attack window is decreased. For example, if the bank authenticates your session from the moment you've entered your PIN, it gives any potential attacker time to intercept the connection and make their own transaction(s).

    On the other hand, a proper secure connection is difficult to implement and bugs do occur. A one-off verification when you make a transaction allows the bank to identify you securely and saves bandwidth. Ultimately, it still depends on the ATM machine in question, since the bank can always verify your PIN at the start of each session and for each subsequent transaction.

  2. ATM cards do not store your PIN.

    In contrast to some answers, ATM cards cannot and will not store your PIN. The purpose of the ATM card is to achieve two factor authentication: something you have (the card) and something you know (the PIN). There have been instances where the ATM card has been breached by attackers.

    The ATM has to connect to the bank servers to verify you are who you say you are. ATM cards can and have been duplicated before (skimming). By verifying your PIN using your ATM card, it is easy for attackers to steal your ATM card, change it and withdraw all your money.