Automated Teller Machine

Overview

An automated teller machine is two machines bolted together: a certified Safe / Vault holding the cash and the Cash Dispenser Mechanism, and an upper Upper Cabinet holding a PC, a card reader, a PIN pad, a screen, and a printer. The split is deliberate, everything a thief wants is behind several hundred kilograms of CEN-graded steel, while everything a service technician touches daily is behind a simple Service Lock.

The machine is a thin client. It holds no account data; every withdrawal is authorised in real time by the bank host over the Network Module, using ISO 8583 messages inside TLS. The local Core PC & Network only sequences hardware and renders screens.

Transaction flow

A session begins when the Card Reader draws the card inside. The Card Transport Motor positions it on the EMV Contact Head for an ISO 7816 chip dialogue; the Magstripe Head is read as fallback, and the NFC Reader supports tap-to-start. The reader keeps the card captive for the whole session, partly so it can be confiscated on a hot-card response, partly so the customer cannot leave mid-dispense. The Anti-Skimming Module jams the throat against parasitic skimmers and the Card Slot Shutter blocks foreign objects.

The PIN never exists in plaintext outside the Encrypting PIN Pad. Keystrokes from the EPP Keypad are encrypted inside the EPP Secure Module, a potted processor wrapped in tamper meshes; drilling or freezing it zeroises the keys (PCI PTS requirement). The encrypted PIN block travels to the host for verification under DUKPT key management. A Privacy Shield and the Consumer Camera address the lower-tech attacks.

The host's approval arrives as a dispense authorisation, and the mechanical part begins. Each Currency Cassette holds roughly 2,000 notes of one denomination, identified by an ID tag; a spring platen keeps the stack pressed against the Pick Module, whose friction roller and counter-rotating retard wheel separate exactly one note per pick at up to 10 notes per second. Notes fly down the Note Transport at about 1 m/s past the Doubles Detector, which measures thickness in flight: doubles, skews, and taped notes divert to the Reject Bin and are re-picked, so the customer count is always exact. The Presenter & Shutter stacks the bundle, opens the shutter, and, if the customer walks away, retracts the cash after about 30 seconds and reverses the transaction. The Receipt Printer meanwhile prints and cuts the slip via its Thermal Printhead and Receipt Cutter.

Security engineering

Physical attack is met in layers. The Safe Body is graded to EN 1143-1 (CEN III–IV for bank units) against tools and torches; the Safe Door carries relock devices that fire if the Electronic Safe Lock is punched; the Anchor Kit resists ram-raid pull-outs. Gas (explosive) attacks, the dominant European threat since the 2010s, are countered by the Attack Sensor Set and the Ink Staining Unit, which floods the cassettes with indelible dye so the notes are worthless.

Logical attack gets equal treatment. Black-box attacks, cutting the cable to the dispenser and issuing dispense commands from a laptop, are defeated by the Dispenser Controller cryptographically authenticating its command session with the PC. The Encrypted SSD and TPM Module give measured boot and full-disk encryption against malware planted via the upper cabinet, and the software stack is whitelisted: the System Board runs a locked-down OS where only the signed ATM application and its CEN/XFS middleware execute.

Operations

Cash-in-transit crews exchange cassettes whole; each Currency Cassette is tamper-evident and opens only in the counting room, so street crews never touch loose notes. The Electronic Safe Lock supports one-time codes per visit. First-line maintenance, paper rolls on the Paper Roll Holder, jams, the Cabinet Heater in outdoor units, happens through the upper cabinet without opening the safe, watched by the Alarm Loop. The UPS Battery rides out brownouts long enough to complete or reverse an in-flight transaction; reconciliation depends on the dispenser's note counts matching the host journal exactly.

Accessibility is regulated: the Audio Jack provides spoken guidance, the EPP Keypad carries tactile markings, and screen layouts driven through the Function Key Strip or Touch Digitizer must meet contrast and reach standards (ADA, EN 301 549). A full lobby machine draws only about 350 W, most of the mass and cost is the steel, not the electronics.