As an anti tamper measure, the ATM will not just pull in the card and read it; instead, it's movement is somewhat randomised, as to increase the difficulty of obtaining an illicit read.
(At least the ATMs in my country are said to usually do that)
As a result, the ATM's read head might pass over the detection spot multiple times.
Maybe you can force the measurement device to move only in one direction, but if I were to design the ATM, it would detect inconsistent, physical card movement.
> Maybe you can force the measurement device to move only in one direction, but if I were to design the ATM, it would detect inconsistent, physical card movement.
That would be very prone to false positives. Weather variations (temperature, humidity), card types, dirt (grease , dust) and foreign objects (stickers on the card) etc etc would all make the card movement inconsistent.
I don't think so. If you don't know how it moves, you can not read meaningful data (if it moves forward/backward). That's the whole point of that counter measure.
If they [the ATMs] do this and can read the card, then they can also check that the measured movement matches what the controller sent to the motor driver. Heck, depending on the driver they could just let it measure back EMF (e.g. some Trinamic stepper drivers can do that).
When running backwards and forwards you get the same sequence 3 times, once in reverse. It seems to me like that could be detected and reversed statistically with good odds. Especially if you take into account the 'total length' of the card swipe and have a lower bound on the distance of a jitter. (so you don't have to worry about 10 01 10 being a jitter)
Doesn't the track data contain the card number? (Not looked into mag stripe cards in a while so my knowledge of them is rusty). If it does doesn't the card number itself contain a check digit? If so if a skimmer recorded everything it saw passing though it the data could be recalculated like how rocqua stated.
Sure the data wouldn't be immediately available and require some post processing but unless the skimmer only recorded a fixed length I can see that method of protection bypassed very quickly and easily.
I know your posting about the skim detection tool but it just seems to me like a bad method of trying to defeat skimmers. I would guess such systems are used for trying to detect a "Lebanese loop" which traps the card when it tries to eject.
As a result, the ATM's read head might pass over the detection spot multiple times.
Maybe you can force the measurement device to move only in one direction, but if I were to design the ATM, it would detect inconsistent, physical card movement.