ATM Card Reader Validation Against Skimmers and Shimmers

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Unauthorized devices such as skimmers and shimmers are compromising card readers at ATMs and POS devices, capturing user data without permission, necessitating real-time validation of both the card and card reader to prevent unauthorized transactions.

Innovation Solution

Implementing smart transaction processing cards and card readers with integrated sensors and machine learning algorithms to measure capacitance and magnetic fields, coupled with two-way communication using dynamic validation codes, to detect anomalies and validate the authenticity of the card and card reader before processing transactions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional card readers without validation mechanisms are used, then device simplicity and ease of operation are maintained, but security against unauthorized devices is compromised

Engineering Contradiction:

ImprovesecurityVSAvoidvalidation mechanism complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system performs validation of the card reader and card in advance before the actual transaction takes place. A validation code is generated and verified beforehand to ensure the card reader is legitimate and not a skimming device, preventing unauthorized data capture before it can occur.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A computing platform acts as an intermediary between the card reader and the transaction processing system. This intermediary generates and verifies validation codes, providing a security layer that doesn't require complex changes to the basic card reader hardware while maintaining simplicity for the end user.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If real-time validation codes are implemented, then detection of unauthorized devices is improved, but transaction processing time increases

Engineering Contradiction:

Improveunauthorized device detectionVSAvoidtransaction processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The validation process uses a simplified approach by only requiring verification of a validation code rather than performing comprehensive security checks. This partial validation provides sufficient security to detect skimming devices while minimizing the time added to the transaction process.

Inventive Principle:

Principle #16Partial or excessive action

3Reliability

If encryption and decryption processes are added to validate cards and readers, then security against data capture is improved, but computational overhead and processing complexity increase

Engineering Contradiction:

Improvedata protectionVSAvoidencryption processing complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system uses disposable, single-use validation codes that are generated and consumed in one transaction. Each validation code is unique and time-limited, providing strong security without requiring complex cryptographic systems. The simplicity of the validation code approach reduces computational overhead while maintaining robust security against data capture.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

Applied Scientific Principles

This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.

Function Achieved in This Case

Effectively detects and alerts users and organizations to the presence of unauthorized devices, preventing unauthorized transactions by ensuring real-time validation and potential compromise detection.

Implementation Method 1

capacitance data received from a transaction processing card and/or a card reader

Methodology Applied

Scientific EffectCapacitance: Capacitance

Implementation Method 2

magnetic field data captured by a transaction processing card and/or a card reader

Methodology Applied

Scientific EffectMagnetic field: Magnetic Field

Data Source

PatentUS20250363484A1Unauthorized Activity Detection at Automated Teller Machine

Publication Date: 2025.11.27 BANK OF AMERICA CORP

AI summary

Arrangements for providing unauthorized activity detection are provided. A computing platform may receive a request for transaction from a transaction processing card via a card reader of a transaction processing device. The computing platform may dynamically generate a validation code. The computing platform may transmit the validation code to the transaction processing card. In some examples, the computing platform may receive, from the transaction processing card, an encrypted version of the validation code. The code may be encrypted by the transaction processing card using a key associated with the transaction processing card. The computing platform may attempt to decrypt the encrypted code with a key associated with the transaction processing device. If the decryption is successful, the transaction may continue. If decryption is not successful, the transaction may be denied and a notification indicating that the transaction processing card is compromised may be generated and transmitted to a computing device.