Cardless methods remove the physical card, but they do not remove the need to prove identity. SMS codes, QR scans, NFC taps, and voice prompts each rely on different trust signals, and each can be weakened by interception, device theft, or social engineering. Layered controls reduce the chance that a single stolen factor becomes enough to authorize cash withdrawal.
Why cardless ATM access still needs more than one proof of identity
Cardless withdrawal changes the shape of the login, not the trust problem. An ATM still has to decide whether the person at the terminal, the phone in hand, and the code or prompt being entered belong together, and whether that combination is strong enough to release cash. That means the control design has to resist stolen devices, intercepted codes, replay, and coercion.
Cardless channels also vary in strength. A QR flow, a one-time SMS code, an NFC tap, and a voice prompt do not fail in the same way, so a bank that treats them as interchangeable can create an avoidable single point of compromise. Layered authentication is the practical answer because it forces an attacker to defeat more than one trust signal before a withdrawal is approved.
In practice, that layering is about binding the session to the right customer, the right device, and the right transaction context. If one factor is weak or exposed, the remaining checks should still hold the line long enough for the transaction to be blocked, stepped up, or challenged. That is why cardless access is usually designed as a controlled authentication flow rather than a simple replacement for the card.
Which trust signals matter most in a cardless ATM flow?
The strongest flows use factors that are difficult to copy across channels. Something the customer knows, something they have, and something the system can verify about the transaction or device each add a different layer of resistance. If the method depends only on a code sent to the same phone that may already be compromised, the design is much weaker than it first appears.
SMS, QR, and voice can all work as part of a broader scheme, but each carries a different risk profile. SMS is vulnerable to interception, SIM swapping, and message forwarding. QR-based flows can be redirected if the user is tricked into scanning the wrong code. Voice prompts can be abused through social engineering or call forwarding. NFC and app-based approvals are often better, but only when the device and session are also protected.
Phishing-resistant authentication is the direction of travel for stronger cardless designs, because it reduces the chance that a reusable secret or an easily relayed one-time code becomes enough to withdraw cash. For a useful technical baseline on authentication strength and assurance levels, see NIST SP 800-63 Digital Identity Guidelines.
How layered controls reduce the chance of cash-out abuse
Layering helps because compromise usually happens at the weakest point in the chain, not at every point at once. If the phone is stolen, a second factor tied to device possession and user verification still matters. If the code is intercepted, a device-bound approval or step-up challenge can stop the withdrawal. If the customer is socially engineered, transaction limits and contextual checks can slow the attacker down enough for fraud controls to react.
The same principle shows up repeatedly in real incidents involving authentication bypass, token theft, and MFA fatigue. A stolen factor becomes most dangerous when the environment accepts it as sufficient on its own. That is why banks and payment providers should design cardless atm authentication as a layered decision, not a single yes-or-no prompt.
That design logic is reflected in practical MFA guidance as well. NHIMG’s MFA Guide and Passwordless and Passkeys Guide both explain why phishing-resistant methods and careful recovery design matter when a single weak factor would otherwise become a cash-out path.
Risk and Threat Considerations
Cardless ATM access changes the attacker target from the plastic card to the broader authentication path, which can include the mobile device, the messaging channel, the app session, or the customer interaction itself. The main risk is that an otherwise convenient method becomes a fast withdrawal path if one factor is stolen, relayed, or socially engineered.
Failure mechanism: The attacker exploits the weakest available trust signal, such as SMS interception, device theft, QR redirection, or voice-based social engineering, and then uses that signal to satisfy a withdrawal flow that was treated as if it were stronger than it really is.
Impact: The result can be unauthorized cash withdrawal, account takeover, fraud loss, and a control failure that is hard to reverse once cash has left the ATM.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | IAL/AAL/FAL — Identity Assurance, Authenticator Assurance, and Federation Assurance | Cardless ATM access depends on authentication strength and assurance levels. |
| Recommendation — Use the highest applicable assurance level and prefer phishing-resistant authenticators for cash withdrawal. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | The ATM flow must authenticate the user before cash is released. |
| IA-5 — Authenticator Management | Cardless methods rely on codes, tokens, and device-bound authenticators that must be managed safely. | |
| Recommendation — Require stronger authentication before approving withdrawal transactions. Manage authenticators so codes and tokens cannot be reused or easily intercepted. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Cardless withdrawals are an access-control decision that needs layered checks. |
| A.8.5 — Secure authentication | The question is directly about how users prove identity in a cardless flow. | |
| Recommendation — Apply layered access control before releasing funds. Use stronger authentication methods that resist interception and relay. | ||
| CIS Controls v8 | CIS-5 — Account Management | ATM withdrawal authorization depends on managed accounts, factors, and recovery paths. |
| Recommendation — Review account and authenticator lifecycle so no weak path can authorize cash withdrawals. | ||
Practitioner Guidance
What to verify: Treat the cardless flow as a multi-factor transaction approval problem, not just an authentication problem. Verify that no single factor can independently authorize cash, and confirm that the factor mix changes when device risk, location risk, or session risk rises.
Decision rule: If the method depends on SMS alone, or on any factor that can be relayed to another device, require a stronger step-up method for withdrawal approval, especially for new devices, high-value withdrawals, or unusual geography.
Common mistake: Banks often assume that removing the card automatically improves security. In practice, it only shifts the attack surface, so the control question becomes whether the replacement factors are bound tightly enough to the customer and the transaction.
Practitioner takeaway: Cardless ATM security is strongest when the system verifies more than possession of a phone or receipt of a code, because cash-out risk falls sharply only when each factor is independently useful and the overall flow resists relay, theft, and coercion.
