Andrew Stone, 32, used the publication to stage a "dry run" in what was supposed to be an exercise in monitoring "hole in the wall" security systems.
Armed with the knowledge he gleaned, he used a telephoto lens to film secretly Abbey National customers withdrawing their cash. He then cloned their cards.
Detectives who arrested him and his "able and willing lieutenant", Russell Poynter, 47, who was jailed for four-and-a-half years, believed the pair could have been part of a wider conspiracy involving more than pounds 1m.
At Southwark Crown Court in south London, judge Peter Fingret was told how Stone was invited by the editor to Which? magazine's offices in Marylebone, central London, while on day release from Ford Open Prison where he was serving nine months for a credit card offence.
Passing sentence the judge said: "I am astounded that Which? magazine should involve themselves with, to their knowledge, a convicted fraudster, a fraudster who was in fact serving a sentence of imprisonment when they approached him and did business with him.
"This was a sophisticated, well-planned and carefully executed conspiracy to steal from unsuspecting bank customers," he said.
"Stone was clearly the brains behind the development and the implementation of the scheme and he exploited the knowledge gained by him from working for Which?"
The Consumers' Association, publishers of Which?, said yesterday that it was disappointed by the judges comments
"Which? magazine did nothing unlawful," said Steve Harris, Consumers' Association communication director. "It acted in the public interest, with the full knowledge of the banks involved, to highlight a problem with cashpoint security.
"This problem has been improved as a direct result of the research, potentially saving consumers hundreds of thousands of pounds.
"Mr Stone learned nothing from the research carried out for Which? that he could not have learnt elsewhere. The fraud perpetrated by Mr Stone involved the use of camera technology to copy cards - the Which? research did not."