Two 14 year olds used an online user manual to find out how much money was in the machine, adjust surcharges and see transaction details

Two Canadian 14-year-olds successfully managed to take control of an ATM in their lunch hour using an old manual, and forcing the Bank of Montreal (BMO) to upgrade its security systems.

Matthew Hewlett and Caleb Turon found an old ATM service manual online and used it to access the operator mode of a cash machine in Winnipeg when they discovered that the bank had not changed the default password.

"We thought it would be fun to try it, but we were not expecting it to work," Hewlett told the Winnipeg Sun.

'Go away. This ATM has been hacked'

The boys guessed the default password and gained entry to the operator mode of the ATM, giving them access to the welcome screen, details of how much money it was carrying and how many transactions it had carried out that day – as well as being able to adjust surcharges for withdrawals.

Hewlett and Turon told Bank of Montreal staff that they had “hacked” the ATM, but the staff did not believe their claims, asking them for proof of the access.

After asking permission, they returned to the ATM, changed the welcome message from "Welcome to the BMO ATM" to read "Go away. This ATM has been hacked”, printed off internal documentation and changed the surcharge amount to one cent.

'Assisting with BMO security'

Returning to the bank with the documentation in hand, the staff took them seriously and contacted the head of security for the bank.

The two boys, who did this all in their lunch hour from school, were now late for class, but were issued a note to excuse their tardiness by the bank’s financial services co-ordinator, as they were “assisting BMO with security”.

"Customer information and accounts and the contents of the ATM were never at risk and are secure," said Ralph Marranca, BMO's director of media relations in a statement.

The bank, which has more than 900 branches across Canada with over seven million customers as well as operations in the US, said it was aware of the incident and has taken steps to prevent unauthorised access, which may have entailed changing the default passwords on its ATMs.

• Despite running the discontinued Window XP, ATMs are not at risk of hacking, if their security settings are appropriately set