# is there any reason why ATMs don't support throw-away passwords for withdrawal without card yet? **URL:** \ **Category:** Factual Questions\ **Created:** [March 7, 2011, 3:08am UTC](https://boards.straightdope.com/t/is-there-any-reason-why-atms-dont-support-throw-away-passwords-for-withdrawal-without-card-yet/573739 "2011-03-07T03:08:57Z")\ **Posts on this page:** 5\ **Page:** 2
**Author:** ![glowacks](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/glowacks/32/5548_2.png) [@glowacks](https://boards.straightdope.com/u/glowacks)\ **Post date:** [March 8, 2011, 10:56pm UTC](https://boards.straightdope.com/t/is-there-any-reason-why-atms-dont-support-throw-away-passwords-for-withdrawal-without-card-yet/573739/21 "2011-03-08T22:56:43Z")
> [@gotpasswords](#): > > Pretty much so - Something called the “natural” PIN for your account is generated by encrypting the account number with the bank’s PIN generating key and a little mathematical hand-waving later, a four or six-digit PIN is born. > > You don’t know what your natural PIN is, and probably don’t want to. You want to know “your” PIN. So you punch in your PIN on the Atalla terminal at the banker’s desk when you first set up the account, and what you’ve entered is mathematically compared against the natural PIN and the difference, or offset, is encoded on the magnetic stripe. Your self-selected PIN and the natural PIN are not encoded on the card. > > At the ATM, when you enter your PIN, the ATM mathematically combines your entry with the PIN offset it read from the mag stripe and sends that down the wire to the bank. Your PIN is not transmitted. The bank decrypts that against its PIN generating key and if the result is the natural PIN, it allows the transaction. If your offset is recorded on your card, then all someone has to do is know how to generate your natural PIN from your account number and how the PINs are compared. Thus it seems like it could be said that your PIN is encrypted on the card: if you know the decryption scheme, all the information necessary to obtain a card’s PIN is on the card. If that’s the case, the production of natural PINs and the comparison technique need to be kept closely guarded secrets, or at least the seed for their algorithms. ---
**Author:** ![Gleena](https://avatars.discourse-cdn.com/v4/letter/g/b3f665/32.png) [@Gleena](https://boards.straightdope.com/u/Gleena)\ **Post date:** [March 9, 2011, 4:38am UTC](https://boards.straightdope.com/t/is-there-any-reason-why-atms-dont-support-throw-away-passwords-for-withdrawal-without-card-yet/573739/22 "2011-03-09T04:38:37Z")
Here’s something you’re not considering, but one of the many reasons why this (or something like it) isn’t possible. [Systems Modernisation](http://findarticles.com/p/articles/mi_hb4849/is_6_2/ai_n54724229/). I many cases around the world, banks have only just begun - and in some cases not yet begun but shortly will - modernising systems from the 70’s, 80’s and in some cases even earlier. Most of these banks still operate batch systems, and not real time. Banks (believe it or not) actually want to give you nifty stuff like this (and say, real time banking from various platforms.) But many/most are held back by organically grown systems. Over the years bits and pieces have been added on, programmed in, sporadically replaced. When Fortan and Cobol are still running your core systems, and you rely on overnight batching instead of real time running, the then stuff you ask for becomes impossible to achieve. Some of this was going to be/started to be in progress prior to the GFC. Some banks (US/European ones in particular) will be delayed in starting even now. I have a little insider knowledge on this and beyond security concerns, which are real and have been pointed out, the main reason so much of this stuff you can dream up can’t be implemented is that the banking systems in the majority of the world are too anitquated to handle it. They are _solid_ systems, don’t get me wrong, but they are old and they hold back innovation. But for all the skepticism, banks know that most people have an account. The only want to get more people is to take them from competitors. The way you take them from competitors is to have more stuff people want. They need to moderise to do this. I would say this is the main reason what you ask for hasn’t been implemented. ---
**Author:** ![clairobscur](https://avatars.discourse-cdn.com/v4/letter/c/839c29/32.png) [@clairobscur](https://boards.straightdope.com/u/clairobscur)\ **Post date:** [March 9, 2011, 8:57am UTC](https://boards.straightdope.com/t/is-there-any-reason-why-atms-dont-support-throw-away-passwords-for-withdrawal-without-card-yet/573739/23 "2011-03-09T08:57:53Z")
> [@iamthewalrus\_3](#): > > Can’t they just add lights? > > I’m not at all in favor of iris scans or fingerprinting for casual id purposes, but this seems like an _exceedingly_ minor issue. Not for me. I don’t want _anybody_ to have my fingerprints, iris scan or DNA in its computer files. ---
**Author:** ![gotpasswords](https://avatars.discourse-cdn.com/v4/letter/g/c57346/32.png) [@gotpasswords](https://boards.straightdope.com/u/gotpasswords)\ **Post date:** [March 9, 2011, 12:14pm UTC](https://boards.straightdope.com/t/is-there-any-reason-why-atms-dont-support-throw-away-passwords-for-withdrawal-without-card-yet/573739/24 "2011-03-09T12:14:05Z")
[QUOTE=glowacks] If your offset is recorded on your card, then all someone has to do is know how to generate your natural PIN from your account number and how the PINs are compared. Thus it seems like it could be said that your PIN is encrypted on the card: if you know the decryption scheme, all the information necessary to obtain a card’s PIN is on the card. If that’s the case, the production of natural PINs and the comparison technique need to be kept closely guarded secrets, or at least the seed for their algorithms. [/QUOTE] The PGKs are **extremely** well-guarded. You think we’re anal about server root passwords? Those are practically public knowledge compared to the PIN systems. ---
**Author:** ![Irishman](https://avatars.discourse-cdn.com/v4/letter/i/b487fb/32.png) [@Irishman](https://boards.straightdope.com/u/Irishman)\ **Post date:** [March 9, 2011, 10:41pm UTC](https://boards.straightdope.com/t/is-there-any-reason-why-atms-dont-support-throw-away-passwords-for-withdrawal-without-card-yet/573739/25 "2011-03-09T22:41:23Z")
> [@clairobscur](#): > > Not for me. I don’t want _anybody_ to have my fingerprints, iris scan or DNA in its computer files. You misunderstand. The minor issue is not the bank having your scans, the minor issue is the lack of lighting. [Previous page](https://boards.straightdope.com/t/is-there-any-reason-why-atms-dont-support-throw-away-passwords-for-withdrawal-without-card-yet/573739.md?page=1)