Secure ATM Using Card Scanning Plus OTP

An ATM system with two-step security. The user scans their card to log in, and an OTP sent by SMS is required before any cash withdrawal.

The user registers and logs in; passwords are stored as salted hashes, never in plain text. Data is encrypted before it is stored or sent, using the algorithm chosen for the project. Only a user with the right key, OTP or credential can decrypt or access the data. Every access is logged so the admin can review suspicious activity.

Symmetric encryption (AES, DES) uses one shared key for encryption and decryption and is fast. Asymmetric encryption (RSA) uses a public key to encrypt and a private key to decrypt, which solves key sharing but is slower.

A hash is one-way, so even the administrator cannot recover the password. We add a random salt and use a slow hash such as bcrypt so stolen hashes are hard to crack.

It follows a three-tier architecture: the browser shows the user interface, the server-side code handles logic and validation, and the MySQL database stores records. Requests travel over HTTP and responses are rendered as HTML or JSON.

All queries use prepared statements with bound parameters, so user input is never joined into the SQL text. Inputs are also validated on the server.

We followed an iterative (incremental) model: requirements and a basic design first, then modules built and tested one by one, with the guide's feedback after each review. It suits a project where requirements become clearer as we build.

Unit testing of each module, integration testing of the complete flow and system testing with real inputs. Test cases with expected and actual results are listed in the report, including invalid inputs.

The current version is tested on a limited dataset or number of users. Future work includes deploying on the cloud, adding more features or languages, improving accuracy with more data and building a mobile version.