Did you know that when a transaction is attempted at an ATM with another bank's card, the PIN check is not performed the moment the card is inserted into the ATM, but rather at the moment the selected transaction is sent for authorization? (Except for the Deposit transaction. For deposits, the PIN check is performed first, as soon as the Deposit menu is tapped; if the PIN check succeeds, the Deposit transaction proceeds.)
I don't know for certain exactly why it was designed this way, but I think the reason is to ease the transaction traffic routed through BKM.
Frankly, if I had built this system myself, I would verify the user's PIN as soon as the card is first inserted; only if the PIN were correct would I allow the user to browse the ATM menus.
In the current setup:
Let's say we lost our card and a passerby found it and inserted it into the bank's ATM. They entered the PIN incorrectly, but since the bank does not verify it first, the person who found our card ends up occupying the ATM by browsing through its menus.
Which is more likely: someone who is not the cardholder occupying the ATM, or the actual cardholder inserting their card, browsing through the menus, and removing the card without completing any transaction? You decide 🙂
