Keywords

1 Introduction

Transactions in ATM channel have become a basic and recurring activity in people. In Peru, 41% of people over the age of 18 are clients of a bank or financial institution, and the most used channel among them is still the ATM. A study from IPSOS Peru indicates that 76% use ATM to carry out a transaction, positioning this channel over branches, banking, agents and other digital channels [1]. This high demand of the channel is reflected in the number of ATM that the country has an approximate of 107 ATM per 100 thousand adult inhabitants [2]. This establishes to Peru as the second country with greater access to ATMs in the region.

However, in some cases, the interaction between users and ATMs could be frustrating and inconvenient. If we consider that a good interface design is necessary to raise Usability levels, it is evident that with regard to ATM, there is still much to do to improve the design of its interfaces [3].

Although there is little information on how to design interfaces for ATM, especially if we compare it with the amount of principles and guidelines that have been proposed for web interfaces [4], they have begun to propose guidelines, principles and heuristics focused on ATMs [5], and also formal methods for designing specific interfaces for ATMs [6].

The ATM machine, given its operations with cash and sensitive customer information, safety issues must be a priority. Nevertheless, it is not easy to bring these security elements to users, so it is necessary to incorporate an adequate process to design for reaching a good User Experience (UX). UX is understood as “the feeling, emotional response, assessment and satisfaction of the user regarding a product, the result of the phenomenon of interaction with the product and interaction with its supplier” [7]. It is considered of great importance to incorporate security aspects from the beginning of the interface design, considering the balance between User Experience points and security [8].

In this sense, in the context of an adequate UX, Usability and Security are closely related, and although they are sometimes considered as opposed, they are an important part of the overall experience. In that sense, the balance should be sought and both factors considered for better interfaces [9].

2 Relevant Concepts

2.1 Automatic Teller Machine

Automatic Teller Machine (ATM) is a computerized telecommunications device that provides, in real time, access to the clients of a financial institution to their bank accounts in a public space without intervention of the administration of the financial institution [10]. The customer commonly is identified by inserting the card and entering a personal identification number (PIN). This process allows customers to service themselves and to perform the operations available according to their bank.

2.2 User Experience

According to ISO 9241, user experience is a person’s perceptions and responses that result from the use or anticipated use of a product, system or service. Three aspects that influence the User Experience are the following: the system, the user and the context of use [11].

2.3 Security

Security is interpreted as the perception of security that customers have when making a transaction from the beginning to the end of it. The lack of security perception causes the client not to use a certain channel to carry out their transactions. For this reason, perceived security is the extent to which a customer believes that a channel is safe to perform their bank transaction [12].

2.4 User Interfaces

A User interface is the component of a system with which the users interact, receive information and control to perform tasks in the system [12]. An example of an ATM user interface is shown in Fig. 1.

Fig. 1.
figure 1

Main screen ATM HSBC-México (HSBC, 2019)

Full size image

3 Literature Review

In the literature, we did not found a consolidated and validated list of guidelines for ATM security, but some recommended practices were found that increase the perception of customer security when interact with ATM. The search was carried out in the databases: Scopus, IEEEXplore, ACM Library Digital and SpringerLink, with a PICOC chain and between 2010–2019, we obtained 9 relevant articles as a result. The guidelines collected are based on the need to convey to users confidence and clarity when interacting with ATMs [13].

In addition, we considered the security requirements of the PCI DSS [14], handbook TCR [15] and resolutions of the Superintendence of Banking and Insurance of Peru [16, 17] have been reviewed. PCI DSS is the global data security standard, adopted by card brands for all entities that process, store or transmit cardholder data and/or confidential authentication data. Table 1 shows the security guidelines collected in a first proposal.

Table 1. ATM security guidelines collected
Full size table

4 Validation

To validate the security guidelines compiled for ATM, an interview was conducted with seven experts, four domain experts from the three main national banks and three experts on ATM interface design. We asked for their expert opinion on each guideline and was requested a score from 1 to 5 according to the importance considered for each guideline. Table 2 shows the score of each expert about each guideline.

Table 2. Expert evaluation about guidelines
Full size table

According to the results of the interviews and the scores, we decided to make some modifications by integrating the information collected, with the aim of grouping similar topics, clarifying the scope of each guideline and giving a more complete definition. The updated list of guidelines is shown in the Table 3.

Table 3. Security guidelines
Full size table

5 Conclusions and Future Work

This work showed that there are points related to the perception of security that contribute significantly to the User Experience on the ATM domain. One of the most important points was the one that covers the subject of sensitive customer information that is displayed on the screen, for reasons of shoulder-surfing and insecurity.

We consider that these seven proposed guidelines cover important aspects for the client when interacting with an ATM. These guidelines will be more or less important depending on a set of factors: the area where the ATM is located, current date and time, customer profile, if the ATM is inside or outside a branch, among others. However, since the ATM channel is characterized by having different types of customers, locations, and features, of, we recommend considering the present proposal in any processes of design, redesign or evaluation of ATM interfaces.

Finally, we consider as future work, the validation of this proposal in real cases in the industrial context, specifically in ATM design and redesign projects.