6 ms·

Somewhat related: I've long wondered why ATM cards don't have something similar. 1234 is my regular PIN. 1235 is my help I'm being robbed PIN -- it dispenses t

by jerrya 15y ago

Somewhat related: I've long wondered why ATM cards don't have something similar. 1234 is my regular PIN. 1235 is my help I'm being robbed PIN -- it dispenses the cash, calls the cops, and tags the video.

masklinn 15y ago
Probably because the SIM standard has no provision for two local PINs.
- hoi 15y ago
  Lock doesn't have to be from the SIM side, can be from the OS side.
  - masklinn 15y ago
    On ATM cards? Is that a joke?
polymatter 15y ago
Will people change banks for it (compared to say, vague promises of better customer service)? Will people pay a premium for it (compared to say, offering more air miles)? I'd be willing to bet that for most people it simply isn't worth the investment for them.
- brk 15y ago
  Will people remember to use 1235 ONLY in an emergency? And never accidentally use it? And never use it when they feel "threatened" by the scary looking hipster hanging out by the ATM? I would tend to guess it would cause more problems than it solves.
  - atakan_gurkan 15y ago
    Exactly! I would just be repeating what you say, but I'll say it anyhow. False positive rate must be considered before putting such a measure in place.
ryanwaggoner 15y ago
Sounds really cool, but I'm not sure what problem it actually solves. Typical ATM robbery today probably ends with the cash coming out of the machine and the robber running away, hopefully without injuring or killing their victim. Victim calls police, they take a report, get the video from the ATM cam, bank refunds the stolen cash, done. In the scenario that you're proposing, the only advantage is that police are called about 30 seconds sooner. But my guess is that in the vast majority of cities in the US, that 30 seconds won't be enough to catch the criminals. Not to mention that if this became widespread (and therefore known) you've now given the victim a crude weapon that the robber may feel warrants more violence to convince the victim that they better not type in their duress code.
- elliottcarlson 15y ago
  "the only advantage is that police are called about 30 seconds sooner" Unless the thief takes off with the victims phone as well. Additionally there are sadly instances where the theft at the ATM is just the start of other crimes towards the victim.
  - ryanwaggoner 15y ago
    Unless the thief takes off with the victims phone as well. I was thinking of the best case scenario. So the robber takes the phone as well, and the person calls it in 15 minutes later when they get to a phone. When the average police response time is about ten minutes, the difference between a call being placed 30 seconds after the robbery and 15 minutes after is pretty much nil. Additionally there are sadly instances where the theft at the ATM is just the start of other crimes towards the victim. True. So maybe the advantage here is that the police are alerted to the fact that a crime is taking place. But let's say the victim is kidnapped or something at this point. Are the police going to be able to do anything? They'll show up 5-15 mins after the emergency call and find an empty parking lot. What then? I guess this might be helpful for situations in which the robber takes the money but then hangs around the ATM to beat or rape the victim. But I doubt this is terribly common. And as soon as it becomes commonplace for people to have duress codes, they'll start taking the victim elsewhere instead of staying near the ATM. Or they'll just kick the shit out of the victim to impress upon them the foolishness of using such a code. Actually, that's an interesting thought experiment. You're held up at gunpoint (or knifepoint) at an ATM. You have a duress code (that you remember). The criminal knows these are common and threatens you not to use it. Do you?
marquis 15y ago
That would be an excellent idea in countries where people are taken hostage to empty out their bank accounts overnight to get the maximum withdrawal over 2 days.
- zalew 15y ago
  I remember ATMs were turned off overnight to stop these kind of crimes in big cities of Brazil. Don't know if it's still relevant.
nradov 15y ago
It's a nice idea but wouldn't work in practice. If the "help" PIN is always 1 higher then there would be too many false alarms due to pressing the wrong button. Or if the "help" PIN is totally different then victims will forget under stress.
- jmonegro 15y ago
  Also, robbers would know there is such thing as a "help" pin, therefore rendering it useless. It's not a good idea in practice.
  - Angostura 15y ago
    It wouldn't render it useless if the behaviour of the machine was identical (other that sending a silent alert) and still dispensed the cash.
ChrisCooper 15y ago
I think the double-PIN makes sense in the ATM case (because you don't want to alert the robber to your scheme), but in the phone case I think multiple PINs is far too complex. Why not just have e.g. "swipe left to unlock to guest mode" or something similar? Then you can still have it be locked, but with the same old PIN; it will be far more attractive to users.
Lost_BiomedE 15y ago
My girlfriend worked at bank that did this. The alert PIN was your PIN backwards. I don't know if they still do this or not.
- gillygize 15y ago
  Out of curiosity, do you know what happened if the pin number was a palindrome? Did they restrict your selection to prevent that?
  - Lost_BiomedE 15y ago
    Yes, they restricted the selection. They also encouraged each number to be unique.
    - botker 15y ago
      That's a funny requirement. Requiring uniques reduces password strength.
      - slowpoke 15y ago
        Bank PINs aren't really about password strength though. To prevent brute force, they simply block access after n tries (usually n = 3). They are just a way of preventing access to the card in case of loss or theft. So as long as there are enough combinations to make the chance of a successful brute force after three tries small enough, it doesn't really matter how strong the password is. For online banking, there are usually added security schemes and the PIN isn't used at all.
    - etcet 15y ago
      For the interested: enforcing no palindromes and unique digits reduces the number of possible PINs by about a factor of 2, bringing it down to 5040 4-digit combinations. [JS code] http://pastebin.com/3A46BP1C http://pastebin.com/3A46BP1C
      - 15y ago
drumdance 15y ago
I would forget the emergency pin. Maybe if they recognized a backward PIN, but I would probably be so flustered while being mugged that I couldn't enter it backward.
therandomguy 15y ago
You should change your pin to something more difficult. Just saying.
huhtenberg 15y ago
Bank machines have this. Diebold ATMs could be configured to send a "distress signal" when their safe was opened and the last number of the combination lock was off by 1. The option was off by default, because it required additional hardware hook-up (for the signaling), but it was there.
rimantas 15y ago
People have trouble remembering one PIN, memorizing two would be too much for many.
jcurbo 15y ago
Several of the PIN-activated access control systems I've used have a similar concept, usually called a duress code or such. Your normal PIN would be 1234 but if you are being forced to enter under duress you put in 1235, and a silent alarm is set off.
furyg3 15y ago
Seems to me a better idea is that you put in a code, which locks your account for a few hours and displays a "this ATM is broken" message, taking it offline for a few mins.
russss 15y ago
This is known as a "Duress Code" and it's sometimes found in alarm systems as a code which will disarm the alarm and still call the police. http://en.wikipedia.org/wiki/Duress_code http://en.wikipedia.org/wiki/Duress_code
- generators 15y ago
  cool. someone here is publishing an idea, and there is wikipedia page for it. ironic. :)
seiwyn 15y ago
I used to intern at a company that manufactured credit cards. If I recall correctly, this actually is in place in South American countries. Due to relatively low fraud rates, credit and debit card security in the US is far behind the rest of the world. Edit: Somewhat replying to a sibling comment. In countries with less effective police, they originally put withdrawal limits on the cards, but this just caused muggers to hold their victims until the victim's account was drained. Further Edit: I couldn't find any online sources for this information, so I could be remembering incorrectly.
jiggy2011 15y ago
What about simply having an emergency gun dispenser inside the ATM?

by jerrya 15y ago

masklinn 15y ago

Probably because the SIM standard has no provision for two local PINs.

hoi 15y ago
Lock doesn't have to be from the SIM side, can be from the OS side.
- masklinn 15y ago
  On ATM cards? Is that a joke?

polymatter 15y ago

Will people change banks for it (compared to say, vague promises of better customer service)? Will people pay a premium for it (compared to say, offering more air miles)? I'd be willing to bet that for most people it simply isn't worth the investment for them.

brk 15y ago
Will people remember to use 1235 ONLY in an emergency? And never accidentally use it? And never use it when they feel "threatened" by the scary looking hipster hanging out by the ATM? I would tend to guess it would cause more problems than it solves.
- atakan_gurkan 15y ago
  Exactly! I would just be repeating what you say, but I'll say it anyhow. False positive rate must be considered before putting such a measure in place.

ryanwaggoner 15y ago

Sounds really cool, but I'm not sure what problem it actually solves. Typical ATM robbery today probably ends with the cash coming out of the machine and the robber running away, hopefully without injuring or killing their victim. Victim calls police, they take a report, get the video from the ATM cam, bank refunds the stolen cash, done. In the scenario that you're proposing, the only advantage is that police are called about 30 seconds sooner. But my guess is that in the vast majority of cities in the US, that 30 seconds won't be enough to catch the criminals. Not to mention that if this became widespread (and therefore known) you've now given the victim a crude weapon that the robber may feel warrants more violence to convince the victim that they better not type in their duress code.

elliottcarlson 15y ago
"the only advantage is that police are called about 30 seconds sooner" Unless the thief takes off with the victims phone as well. Additionally there are sadly instances where the theft at the ATM is just the start of other crimes towards the victim.
- ryanwaggoner 15y ago
  Unless the thief takes off with the victims phone as well. I was thinking of the best case scenario. So the robber takes the phone as well, and the person calls it in 15 minutes later when they get to a phone. When the average police response time is about ten minutes, the difference between a call being placed 30 seconds after the robbery and 15 minutes after is pretty much nil. Additionally there are sadly instances where the theft at the ATM is just the start of other crimes towards the victim. True. So maybe the advantage here is that the police are alerted to the fact that a crime is taking place. But let's say the victim is kidnapped or something at this point. Are the police going to be able to do anything? They'll show up 5-15 mins after the emergency call and find an empty parking lot. What then? I guess this might be helpful for situations in which the robber takes the money but then hangs around the ATM to beat or rape the victim. But I doubt this is terribly common. And as soon as it becomes commonplace for people to have duress codes, they'll start taking the victim elsewhere instead of staying near the ATM. Or they'll just kick the shit out of the victim to impress upon them the foolishness of using such a code. Actually, that's an interesting thought experiment. You're held up at gunpoint (or knifepoint) at an ATM. You have a duress code (that you remember). The criminal knows these are common and threatens you not to use it. Do you?

marquis 15y ago

That would be an excellent idea in countries where people are taken hostage to empty out their bank accounts overnight to get the maximum withdrawal over 2 days.

zalew 15y ago
I remember ATMs were turned off overnight to stop these kind of crimes in big cities of Brazil. Don't know if it's still relevant.

nradov 15y ago

It's a nice idea but wouldn't work in practice. If the "help" PIN is always 1 higher then there would be too many false alarms due to pressing the wrong button. Or if the "help" PIN is totally different then victims will forget under stress.

jmonegro 15y ago
Also, robbers would know there is such thing as a "help" pin, therefore rendering it useless. It's not a good idea in practice.
- Angostura 15y ago
  It wouldn't render it useless if the behaviour of the machine was identical (other that sending a silent alert) and still dispensed the cash.

ChrisCooper 15y ago

I think the double-PIN makes sense in the ATM case (because you don't want to alert the robber to your scheme), but in the phone case I think multiple PINs is far too complex. Why not just have e.g. "swipe left to unlock to guest mode" or something similar? Then you can still have it be locked, but with the same old PIN; it will be far more attractive to users.

Lost_BiomedE 15y ago

My girlfriend worked at bank that did this. The alert PIN was your PIN backwards. I don't know if they still do this or not.

gillygize 15y ago
Out of curiosity, do you know what happened if the pin number was a palindrome? Did they restrict your selection to prevent that?
- Lost_BiomedE 15y ago
  Yes, they restricted the selection. They also encouraged each number to be unique.
  - botker 15y ago
    That's a funny requirement. Requiring uniques reduces password strength.
    - slowpoke 15y ago
      Bank PINs aren't really about password strength though. To prevent brute force, they simply block access after n tries (usually n = 3). They are just a way of preventing access to the card in case of loss or theft. So as long as there are enough combinations to make the chance of a successful brute force after three tries small enough, it doesn't really matter how strong the password is. For online banking, there are usually added security schemes and the PIN isn't used at all.
  - etcet 15y ago
    For the interested: enforcing no palindromes and unique digits reduces the number of possible PINs by about a factor of 2, bringing it down to 5040 4-digit combinations. [JS code] http://pastebin.com/3A46BP1C http://pastebin.com/3A46BP1C
    - 15y ago

drumdance 15y ago

I would forget the emergency pin. Maybe if they recognized a backward PIN, but I would probably be so flustered while being mugged that I couldn't enter it backward.

therandomguy 15y ago

You should change your pin to something more difficult. Just saying.

huhtenberg 15y ago

Bank machines have this. Diebold ATMs could be configured to send a "distress signal" when their safe was opened and the last number of the combination lock was off by 1. The option was off by default, because it required additional hardware hook-up (for the signaling), but it was there.

rimantas 15y ago

People have trouble remembering one PIN, memorizing two would be too much for many.

jcurbo 15y ago

Several of the PIN-activated access control systems I've used have a similar concept, usually called a duress code or such. Your normal PIN would be 1234 but if you are being forced to enter under duress you put in 1235, and a silent alarm is set off.

furyg3 15y ago

Seems to me a better idea is that you put in a code, which locks your account for a few hours and displays a "this ATM is broken" message, taking it offline for a few mins.

russss 15y ago

This is known as a "Duress Code" and it's sometimes found in alarm systems as a code which will disarm the alarm and still call the police. http://en.wikipedia.org/wiki/Duress_code http://en.wikipedia.org/wiki/Duress_code

generators 15y ago
cool. someone here is publishing an idea, and there is wikipedia page for it. ironic. :)

seiwyn 15y ago

I used to intern at a company that manufactured credit cards. If I recall correctly, this actually is in place in South American countries. Due to relatively low fraud rates, credit and debit card security in the US is far behind the rest of the world. Edit: Somewhat replying to a sibling comment. In countries with less effective police, they originally put withdrawal limits on the cards, but this just caused muggers to hold their victims until the victim's account was drained. Further Edit: I couldn't find any online sources for this information, so I could be remembering incorrectly.

jiggy2011 15y ago

What about simply having an emergency gun dispenser inside the ATM?