How ATMs Work: From Card Insertion to Cash in Hand

What happens the moment you insert your card

An ATM isn’t a single box — it’s a small cluster of specialized machines working in concert. A CPU runs the on-screen interface and coordinates everything else. A reader, magnetic-stripe or chip, identifies the card the instant you insert it. A dedicated, shielded keypad, known in the trade as the EPP4, is built specifically to accept and encrypt the PIN you’re about to type. Add to that a display, function buttons or a touchscreen, a receipt printer, and, inside the vault, the mechanism that actually dispenses banknotes.

Newer machines have largely abandoned proprietary electronics and dedicated microcontrollers in favor of hardware architectures closer to an ordinary personal computer, with USB connections for peripherals and Ethernet for networking. It’s not unlike the shift described in the history of computers: hardware that grows more standardized over time, less “special-purpose machine” and more a straightforward combination of common parts wired together.

Practical example: picture the ATM as an automated bank teller running through three steps, never at the same time — first it checks your ID (the reader scans the card), then it asks for a password only you should know (the shielded keypad encrypts the PIN), and only then does it call your bank for the green light before it opens the cash drawer.

The PIN gets encrypted before it ever leaves the machine

The moment you type your PIN is when the most sensitive part of the whole system kicks in — security has to hold from that very first instant, not sometime later. The PIN you enter has to match the one stored on the card’s chip, if it has one, or the one held in the issuing bank’s database. But that comparison never happens against a plain-text number: it gets encrypted immediately, inside the shielded keypad itself, using algorithms like DES or, more commonly in newer systems, Triple DES.

What makes this possible is a device with a specific history: the HSM, or Hardware Security Module. The first one was invented by Mohamed Atalla, who filed the relevant U.S. patent in March 1972 and founded the Atalla Corporation, also known as Utimaco Atalla, that same year. The device, nicknamed the “Atalla Box,” was launched commercially in 1973: it encrypted the PIN and the ATM’s messages, and protected even offline devices with an unguessable PIN-generating key. The system consisted of a card-reader console, two customer PIN pads, an intelligent controller, and a built-in electronic interface package — a customer would type in a secret code, and the device, using a microprocessor, would transform it into a different code destined for the teller’s side of the system.

HSM products descended from that original invention protected 250 million card transactions a day worldwide as of 2013, and by 2014 secured the majority of ATM operations globally. PIN encryption, in other words, isn’t a recent addition to banking security — it’s as old as the networked ATM itself.

The language an ATM uses to ask for permission

Once encrypted, the PIN still has to reach the card-issuing bank so it can grant, or deny, permission for the withdrawal. That exchange follows an international standard called ISO 8583, which emerged in the late 1980s and has been updated more than once, in 1993 and again in 2003. It’s not some isolated technical detail: it’s the shared language behind authorization traffic for networks like Mastercard and Visa, and it’s also used by point-of-sale (POS) terminals in stores, alongside numerous other financial institutions.

An ISO 8583 message breaks down, roughly, into three parts: a four-digit message type indicator (which flags, for instance, whether this is an authorization request or a response), a set of data fields that can number up to 128 in the original specification (card number, amount, merchant information, authorization outcome), and a bitmap that marks which of those fields are actually present in the message. The transaction starts at the ATM, crosses a series of intermediate networks, and arrives at the issuing bank’s system, which approves or declines the request within a defined time window. It’s a process governed by fixed, repeatable rules, not unlike the way an algorithm follows precise steps to reach a verifiable result. On top of PIN encryption, traffic between the ATM and the transaction processor can be further protected with methods like SSL — the same encrypted-communication principle behind much of how the internet works whenever you visit a secure site.

Dispensing the cash

Only after the bank gives its approval does the ATM move to its final step: dispensing. Inside the vault, the dispensing mechanism counts and releases the requested banknotes; the same protected enclosure often houses a cheque-processing module, tamper sensors (magnetic, thermal, seismic, or gas), dedicated locks, and journaling systems that log every operation. The architecture is built, from the ground up, to make cash withdrawal as automatic as possible, while placing everything of value — cash, encryption keys, internal mechanisms — behind physical barriers as solid as the digital ones.

A history with more than one father

Who invented the ATM? The honest answer is: no single person, and no single country either. In 1960, Luther Simjian patented an “automated deposit machine,” the Bankograph, which accepted coins, cash, and cheques but couldn’t dispense money; an experimental unit was installed in New York by the City Bank of New York in 1961 and removed six months later due to lackluster customer interest.

The machine generally regarded as the true ancestor of the modern ATM appeared on June 27, 1967, when a cash machine was installed at a Barclays branch in Enfield, north of London, unveiled by actor Reg Varney as part of the launch publicity. The project was built by a team led by John Shepherd-Barron for the firm De La Rue (the system was called DACS, De La Rue Automatic Cash System); Shepherd-Barron later said the idea came to him while thinking about a chocolate-bar vending machine, with cash swapped in for chocolate. But that machine beat its rivals by a razor-thin margin: just nine days ahead of a competing Swedish device (called Bankomat, built by a company named Metior) and a month ahead of the British Chubb MD2, developed by Smith Industries Chubb. Three different systems, arriving almost at once, in the same corner of the world.

System	Where and when	How it worked
DACS (Barclays / De La Rue)	Enfield, United Kingdom, June 27, 1967	Paper vouchers marked with carbon-14, later paired in a follow-up model with a 4-digit PIN; no magnetic stripe
Bankomat (Metior)	Sweden, nine days later	Rival Swedish system, among the first in the world
Chubb MD2	United Kingdom, a month later	Developed by Smith Industries Chubb; also used a single-use token, not a card

It was on that same Chubb MD2 that a group of engineers at Smiths Group developed, in 1965, the idea of a PIN tied to the card — an invention credited to James Goodfellow, who filed the relevant British patent in May 1966 together with Anthony Davies. Among these pioneering systems, incidentally, only a third device, the Speytec, already used a card with a magnetic stripe on the back; both DACS and the Chubb MD2 instead accepted a single-use token or voucher retained by the machine.

The ATM crosses the Atlantic, and goes networked

In the United States, the ATM arrived shortly after, driven by Donald Wetzel, a department head at Docutel, who got to work after studying the European experience firsthand. On September 2, 1969, Chemical Bank installed a prototype ATM at its Rockville Centre branch in New York, backed by an advertisement promising the bank would open at 9 a.m. and never close again. In 1995, the Smithsonian National Museum of American History formally recognized Docutel and Wetzel as the inventors of the networked ATM — one linked to a central system rather than tied to a single, isolated branch; by 1974, Docutel had captured 70% of the U.S. market.

The internal hardware followed the broader arc of computing history too: in April 1971, the company Busicom began building ATMs based on the first commercial microprocessor ever made, the Intel 4004. In December 1972, the IBM 2984 went into service at a Lloyds Bank branch in Brentwood, England, described as a genuinely modern ATM; that machine gave rise to the “Cashpoint” trademark, registered by Lloyds but since adopted, in everyday British usage, as a generic term for any cash machine. The missing piece for a true shared ATM network spanning multiple banks arrived only on February 3, 1979, in Denver, Colorado, with the first switching system built to link ATMs across different institutions.

The EMV cryptogram: a code that never repeats

The most recent chapter of this story concerns the EMV standard (named after its original backers, Europay, Mastercard, and Visa), which governs how chip cards work. The crucial difference from the old magnetic stripe is this: chip technology validates the card’s authenticity and generates, for every single transaction, a one-time security code known as a cryptogram, which can’t be reused afterward. The number stored on a magnetic stripe, by contrast, never changes — copying it with a skimmer is enough, on its own, to reuse it indefinitely.

According to figures published by EMVCo — the organization owned by the major international payment networks that manages and updates the EMV specifications — more than 15.6 billion EMV cards were in circulation worldwide as of September 2026, powering 96% of in-store transactions in more than 80 countries. It’s worth keeping in mind that this figure is self-reported by the organization that manages the standard, and not an independent third-party estimate, even if it lines up with the everyday experience of anyone who pays by card.

The most common frauds, and how to guard against them

Despite encryption, HSMs, and one-time cryptograms, ATMs remain a target for very different kinds of criminals, and not every scheme relies on technology. Some are purely physical: in Japan, criminal gangs have used trucks fitted with heavy construction equipment to tear entire machines out of the ground; in the Netherlands, a technique known as “plofkraak” seals an ATM’s openings with silicone and floods the vault with combustible gas before setting it off (the number of ATMs in the country dropped from 20,000 to 5,000, partly for this reason). In Germany, despite more than 300 million euros spent on additional security, the federal criminal police office estimated that 60% of attacks on ATMs in the country still succeeded in 2024.

Other frauds are subtler, and target customers directly:

• Skimming (card cloning): a hidden device placed over the card slot reads the magnetic stripe or chip, often paired with a tiny hidden camera aimed at the keypad to capture the PIN.
• Card trapping: a device, sometimes called a “Lebanese loop,” jams the card inside the reader; the customer, assuming it’s lost, walks away frustrated, and the criminal retrieves it afterward. It’s a technique that has seen a resurgence in regions like Europe, where chip-and-PIN cards have become more common: it copies no data at all, it just traps the physical object.
• Jackpotting: a more sophisticated attack in which criminals drill a small hole in the machine, disconnect the existing hard drive, and attach an external one through an industrial endoscope, forcing the ATM to dispense cash without any authorized transaction.

One of the earliest known cases of a rigged ATM dates to 1993, at a shopping mall in Manchester, Connecticut, where the “Bucklands Boys” gang modified a Fujitsu machine to steal data from unsuspecting customers’ cards.

Practical example: the U.S. Secret Service, which responds to hundreds of skimming incidents every year, recommends a few simple habits: prefer ATMs located inside bank branches or near drive-up windows; check for obvious signs of tampering, like broken lights or a keypad that looks raised or loosely attached; always cover the keypad with your hand while entering a PIN; and, when paying by card in a store, choose contactless or chip payment over the magnetic stripe.

What to do if your card gets stolen

Banca d’Italia sums up PIN protection with two simple principles: secrecy (nobody but the rightful cardholder should ever know it) and separation (the PIN and the card should never be kept together, since that would make a fraudulent withdrawal easier if both are stolen). If a card is lost or stolen, the first step is to call the bank’s hotline right away to block it, and only then file a police report: unlike stolen cash, which is gone for good, a card blocked in time can bring the financial loss down to zero.

If the block comes too late, regulations still cap the cardholder’s liability at 50 euros for unauthorized transactions, as long as they’re reported promptly. Italy’s Banking and Financial Ombudsman has also ruled that a short gap between the theft and its fraudulent use, combined with the presence of the chip and correct PIN entry, can point to the cardholder having kept their credentials reasonably secure. Contactless payments, which don’t require a PIN below 50 euros and rely on radio waves, carry a statistically low risk too — though keeping some distance from other people in crowded places remains a sensible precaution against unauthorized transactions.