MM code

The MM code is a "machine-readable modulated" feature that has been added to German debit cards during manufacture as an anti-counterfeiting measure since 1979. It was developed by "Gesellschaft für Automation und Organisation" in Munich for the German ec-Card system and MM verification devices have been added to German ATMs from 1982 onwards. If a payment card contains an MM code as well as a magnetic stripe, any fraudster who counterfeits the card but fails to read and duplicate the MM code on to the copy will be detected when trying to use the counterfeit in an Automated Teller Machine.

Automated Teller Machines which can read the MM code contain a special MM box which contains the circuitry to read the MM code. This box sits more than an inch away from the card. It is unclear whether the MM code is read optically from a distance during acquisition of the card from the slot, or if there is some kind of read head positioned closer to the card and connected to the MM Box. Cash machine manufacturers do not access or service the box. The MM code consists of two components, one stored on the magnetic stripe, and one hidden. During MM code verification, a cryptographic operation is performed to check that the MM code on the magnetic stripe corresponds to the hidden one. The presence of the keyed cryptographic operation means that the correct MM code for a counterfeit cannot be calculated from the magnetic stripe information alone without knowledge of the key -- it must be read from the original card itself.

In order to remain effective the MM code relies the continued obscurity of the reading mechanism, and possibly also on the expense and difficulty of embedding a code once known. Since the arrival of the EMV chip-base payment protocols, the MM code has reduced significance in combatting card counterfeiting.

Misunderstandings about MM Code encoding

Public information on the MM code is somewhat limited. A variety of theories have been proposed, some of which are the result of confusion between the MM code and other proprietary anti-counterfeiting schemes.

The first class of explanation proposes that the MM code is encoded into the magnetic stripe using read and write heads operating diagonally to the direction of swipe in the reader. With appropriate signal processing, these can read and encode a small amount of additional data which is polarised in a different axis to the ISO standard tracks.

The second class concerns encoding the code onto the plastic base of the card using special inks (probably a bar code), or reading a code which is inherently embedded as part of the plastic manufacturing process for each batch. Such a code may only be visible under infrared illumination (or other invisible wavelength).

A third class considers encoding the code using the electrical properties of the plastic card, such as capacitance. Such an explanation requires a read head within close proximity to the card.