Automated Teller Machines which can read the MM code contain a special MM box and sensor to read and verify the MM code. The MM box was for a long time considered a well-guarded secret; cash machine manufacturers do not access or service the box. The MM code consists of two components, one stored on the magnetic stripe, and one hidden inside the card's material. During MM code verification, a cryptographic operation is performed to check that the MM code on the magnetic stripe corresponds to the hidden one. The presence of the keyed cryptographic operation means that the correct MM code for a counterfeit cannot be calculated from the magnetic stripe information alone without knowledge of the key – it must be read from the original card itself.
In order to remain effective, the MM code relied on the obscurity of the reading mechanism and the expense and difficulty of embedding a code once known. Since the arrival of the EMV chip-based payment protocols, the MM code has reduced significance in combatting card counterfeiting.
The MM feature is encoded in the middle layer of an ISO/IEC 7810 card as a bar code formed by two materials with different electrical properties.4 A capacitive sensor head near the magstripe reader observes the changing capacitance as the card is moved past the sensor and decodes the represented number. This sensor works in a similar fashion to the magnetic read head found in a magstripe card reader, except that it senses not a change in magnetic flux, but a change in the dielectric constant of the card's material. It reads a second data stripe that, unlike the magstripe, cannot easily be rewritten with off-the-shelf equipment.
In addition to capacitive MM code, which has been widely used in Germany since the early 1980s, a range of similar technologies have been proposed or patented, but have never been widely deployed in ATM cards:
Wolfgang Rankl and Wolfgang Effing (1999). Handbuch der Chipkarten. 3rd edition (in German). Hanser Verlag. ↩
"MM-Merkmal" (in German). Archived from the original on 2009-05-22. Retrieved 2008-01-10. https://web.archive.org/web/20090522165336/http://www.kartensicherheit.de/ww/de/pub/oeffentlich/sicherheitsprodukte/mm_merkmal.php ↩
Carsten Meyer (July 1996). "Nur Peanuts — Der Risikofaktor Magnetkarte". c't (in German). Heise Zeitschriften Verlag. p. 94. http://www.heise.de/ct/96/07/094/ ↩
"Security Supervision and Management: The Theory and Practice of Asset Protection". 2007. p. 365. https://books.google.com/books?id=Ehc1omWy6iMC ↩