Defending Against Jackpotting Threats: A Modern Guide for Financial Institutions

As cybercrime evolves, financial institutions face increasingly sophisticated attacks targeting the heart of their operations: the ATM. One of the most alarming trends is jackpotting, a technique where criminals manipulate an ATM’s internal systems to force it to dispense cash—no card, PIN, or legitimate transaction required. According to the U.S. Attorney’s Office, jackpotting involves exploiting ATM vulnerabilities, so the terminal distributes cash without debiting an account.

While cardholders typically aren’t affected, these attacks create significant operational and financial risk for banks and credit unions.

What Jackpotting Looks Like Today

Recent activity shows a rise in what’s known as hard‑drive‑based jackpotting attacks. Criminal groups—often well‑organized and highly coordinated—physically access the ATM’s upper cabinet, where the PC is housed. Once inside, they remove the hard drive, infect it with malware off‑site, and return later to reinstall it and execute the theft.

Before striking, attackers usually perform covert reconnaissance, taking photos, observing technician routines, and assessing environmental vulnerabilities.

This physical access is often obtained by:

• Forcing open the cabinet

• Using ATM keys purchased online

• Cutting or prying open the PC housing

After malware is installed, criminals send commands to the ATM to empty its cassettes. Sometimes they use a mobile phone or hotspot to create a remote connection designed to evade firewalls and network monitoring tools.

Notably, these vulnerabilities affect ATMs from all manufacturers—no model is inherently immune.

Signs Your ATM May Have Been Targeted

Indicators of an Attempted Attack

• The ATM unexpectedly powers off

• Missing or tampered hard drive

• Visible interior damage

• Damage to the external fascia

Indicators of a Successful Attack

• Large settlement discrepancies or cash out‑of‑balance

• Damage to both the exterior and interior of the machine

These signs often appear after criminals force open the top of the ATM, remove the PC hard drive for malware installation, and later return to execute commands that release cash without any user interaction.

Why Jackpotting Has Become Such a High‑Priority Risk

When the U.S. Secret Service first raised alarms about jackpotting in 2018, it was considered an emerging cyber‑physical hybrid threat. Since then, attacks have grown more frequent and more coordinated. Criminals now routinely combine physical intrusion, malware injection, and specialized electronics to exploit system weaknesses.

As the digital and physical layers of ATM technology become increasingly intertwined, institutions must adopt a multi‑layered security posture to keep pace with sophisticated attackers.

A Path Forward: Strengthening ATM Security

Mitigating jackpotting requires a blend of physical safeguards, software protections, and proactive monitoring. While the original source article outlines the nature of the threat, institutions should consider the following high‑value strategies:

1. Reinforce Physical Barriers

• Employ barrier gates, restricting access to those without permissions

• Implement intrusion detection sensors

• Utilize and routinely audit unique access keys

2. Lock Down the ATM PC

• Use encrypted hard drives

• Implement BIOS and USB lockdowns

• Add tamper‑evident controls to prevent off‑site drive manipulation

3. Improve Operational Awareness

• Deploy surveillance focused specifically on ATM vestibule activity

• Monitor for unusual power cycles, cabinet openings, or hard drive removal

• Use integrated alerting across physical alarms and IT systems

4. Strengthen Network and Endpoint Security

• Use application allow‑listing to block unauthorized executables

• Encrypt internal communications

• Limit remote access pathways and eliminate unused ports

5. Conduct Regular Risk Assessments

• Evaluate ATM placement and environmental exposure

• Review network segmentation practices

• Test incident response processes for both cyber and physical breaches

Conclusion

Jackpotting is no longer a fringe threat, it is a highly coordinated, technically advanced attack that targets the core of ATM operations. By understanding how attackers gain access, recognizing early warning signs, and implementing layered defenses, financial institutions can significantly reduce their exposure and strengthen overall security resilience.