MM code

An MM code (the "MM" being an abbreviation for the German "Moduliertes Merkmal") is a "machine-readable modulated" feature that has been added to German debit cards during manufacture as an anti-counterfeiting measure since 1979.^[1][2] It was developed by "Gesellschaft für Automation und Organisation" (a subsidiary of Giesecke & Devrient) in Munich for the German ec-Card system and MM verification devices have been added to German ATMs from 1982 onwards.^[3] If a payment card contains an MM code as well as a magnetic stripe, any fraudster who counterfeits the card but fails to read and duplicate the MM code onto the copy will be detected when trying to use the counterfeit in a German automated teller machine.

Automated Teller Machines which can read the MM code contain a special MM box and sensor to read and verify the MM code. The MM box was for a long time considered a well-guarded secret; cash machine manufacturers do not access or service the box. The MM code consists of two components, one stored on the magnetic stripe, and one hidden inside the card's material. During MM code verification, a cryptographic operation is performed to check that the MM code on the magnetic stripe corresponds to the hidden one. The presence of the keyed cryptographic operation means that the correct MM code for a counterfeit cannot be calculated from the magnetic stripe information alone without knowledge of the key – it must be read from the original card itself.

In order to remain effective, the MM code relied on the obscurity of the reading mechanism and the expense and difficulty of embedding a code once known. Since the arrival of the EMV chip-based payment protocols, the MM code has reduced significance in combatting card counterfeiting.

The MM feature is encoded in the middle layer of an ISO/IEC 7810 card as a bar code formed by two materials with different electrical properties.^[3] A capacitive sensor head near the magstripe reader observes the changing capacitance as the card is moved past the sensor and decodes the represented number. This sensor works in a similar fashion to the magnetic read head found in a magstripe card reader, except that it senses not a change in magnetic flux, but a change in the dielectric constant of the card's material. It reads a second data stripe that, unlike the magstripe, cannot easily be rewritten with off-the-shelf equipment.

In addition to capacitive MM code, which has been widely used in Germany since the early 1980s, a range of similar technologies have been proposed or patented, but have never been widely deployed in ATM cards:

• Angle modulation of ferromagnetic particles: A code is embedded into the magnetic stripe using read and write heads operating diagonally to the direction of swipe in the reader. With appropriate signal processing, these can read and encode a small amount of additional data which is polarised in a different axis to the ISO standard tracks.
• Infrared barcodes: The second class concerns encoding the code onto the plastic base of the card using special inks (probably a bar code), or reading a code which is inherently embedded as part of the plastic manufacturing process for each batch. Such a code may only be visible under infrared illumination (or other invisible wavelength).
• Wiegand keycards, like capacitive MM codes, embed a code into the middle layer of the card, and so are more durable and difficult to counterfeit than printed barcodes or magnetic stripes on the surface of the card.^[4]

• W Rankl and W Effing (2003). Smart Card Handbook. John Wiley and Sons. pp. 36–38. doi:10.1002/047085670X.ch3. ISBN 0-470-85668-8.
• Freimut Bodendorf and Susanne Robra-Bissantz (2003). E-Finance: Elektronische Dienstleistungen in der Finanzwirtschaft (in German). Oldenbourg. pp. 49–50. ISBN 3-486-25890-7.