This exact questioned is actually answered! This questioned is an example of a Forcing Function described in the book Design of Everyday Things by Donald A. Norman
Forcing Function Defined
Forcing functions are a form of physical constraint: situations in
which the actions are constrained so that failure at one stage
prevents the next step from happening. Starting a car
has a forcing function associated with it—you must put the ignition
key into the ignition switch. Some time ago, the button that activated
the starter motor was separate from the ignition key, so that it was
possible to attempt to start the car without the keys; the error was
made frequently. In most modern automobiles, the starter switch is
activated by turning the key—an effective forcing function that makes
you use the key to do the operation.
Using a bank or credit card to withdraw money from an automatic
teller machine, then walking off without the card. This was a
frequent enough error that many machines now have a forcing function:
you must remove the card before the money will be delivered. Of
course, you then can walk off without your money, but this is less
likely than forgetting the card because money is the goal of using the
machine. The possibility exists so the forcing function isn’t
perfect.
ATM as a Forcing Function
Forcing functions are the extreme case of strong constraints that make
it easy to discover erroneous behavior. Not every situation allows
such strong constraints to operate, but the general principle can be
extended to a wide variety of situations. In the field of safety
engineering, forcing functions show up under other names, in
particular as specialized methods for the prevention of accidents.
Three such methods are interlocks, lockins, and lockouts.
The Three Types of Forcing Functions
An interlock forces operations to take place in proper sequence
(figure 5.4). Microwave ovens and television sets use interlocks as
forcing functions to prevent people from opening the door of the oven
or taking off the back of the television set without first turning off
the electric power: the interlock disconnects the power the instant
the door is opened or the back removed. The pin on a fire extinguisher
or hand grenade and the safety on a rifle are other examples of
interlocks; these forcing functions prevent the accidental use of the
devices.
A lockin keeps an operation active, preventing someone from
prematurely stopping it. The sad stories of those who turn off word
processors without first saving their work could be avoided with the
use of a lockin. Suppose the on-off switch were a “soft” switch, not
really disconnecting the power, but sending a signal to the program to
quit, checking that all files had been saved, and then, after all the
appropriate housekeeping operations had been completed, turning off
the power. (Of course, a normal power switch should also exist as an
override for special situations or for when a software problem causes
the soft switch to fail.)
A lockout device is one that prevents someone from entering a place
that is dangerous, or prevents an event from occurring. A good example
of a lockout occurs in stairways of public buildings, at least in the
United States (figure 5.5). In cases of fire, people have a tendency
to flee in panic, down the stairs, down, down, down, past the ground
floor and into the basement, where they are trapped. The solution
(required by the fire laws) is not to allow simple passage from the
ground floor to the basement.
The ATM is a Lockout Forcing Function.