Jackpotting: Fraudsters in the US Targeting ATMs for Latest Fraud Trend
- ATM “jackpotting” is now a leading U.S. ATM fraud trend, exploiting hardware and software weaknesses
- Criminals also abuse ATMs via infinite money glitches, skimming, card trapping, and physical theft
- Banks must encrypt ATM components, harden devices, and deploy AI to detect ATM check fraud
Which deposit channel are you most concerned about when it comes to fraud? Each financial institution will have a different opinion due to their experience and geographic location -- but, for many, ATMs are ranked near the top. Some of the concerning factors include isolated location of the ATM, the ability for anyone to wear a face cover to avoid video detection, and the fact that they contain cash, which is almost impossible to trace.
However, as noted in a podcast by Bank Customer Experience Podcast, a fraud trend that has been circulating in Europe is reaching the United States -- and it's more concerning than ever.
ATM “jackpotting” has become the dominant form of ATM fraud in the U.S., driven by organized criminal crews exploiting technical gaps and human complacency. In the discussion, host Bradley Cooper and his guests describe jackpotting as the process of taking remote control of the dispenser so the machine pays out cash on command.
Attackers start by opening the ATM’s “top hat” -- the upper cabinet that houses the PC core -- rather than the safe itself. From there, they either pull the hard drive to load malware or, in newer campaigns, plug directly into exposed PCIe ports on the motherboard to issue commands that force the ATM to spit out cash.
ATMs Are Major Targets
Just recently, ATMs have become a favorite target for criminals. Aside from jackpotting, there was the ever popular “infinite money glitch” at JPMorgan Chase ATMs where the systems briefly allowed customers to deposit large counterfeit or unfunded checks and then pull out most of the money before the checks bounced days later. By late August 2024, videos on TikTok and other platforms were glamorizing the maneuver as a harmless “hack,” showing masked users feeding bogus checks into Chase machines and walking away with stacks of cash, which triggered copycats and lines at branches in several cities.
Additionally, there are several other ways criminals are leveraging ATMs for fraud, including:
- Skimming Devices -- Attaching hardware or overlays to card readers to capture your card details.
- Hidden Cameras -- Tiny, concealed cameras placed above keypads or within the machine’s surroundings record you entering your PIN.
- Shoulder Surfing -- Thieves standing close by to watch you enter your PIN or to see how much cash you withdraw.
- Card Trapping -- Criminals manipulate ATM card slots, so your card gets stuck. They’ll wait for you to leave in frustration, then remove your card themselves.
Or, criminals can just do it the old fashion way... Just over a year ago, we reported on a criminal using his vehicle to literally rip an ATM off the side of a bank branch.
Protecting ATMs from Fraud
In the case of jackpotting, it's important to ensure that you are encrypting ATM hard drives and locking down PCIe access points while adding robust physical protections, intelligent video analytics, and alarms that specifically monitor the top hat. Just as important are procedures: every alarm should trigger video review at the exact time of the event and, if the cabinet was opened, proactive steps like disabling the ATM or emptying cash before criminals return.
However, jackpotting is only one scheme to address. As noted in a NICE Actimize report, 18% of check fraud occurs at ATMs. Financial institutions need to have the proper tools available to detect both on-us and deposit fraud. Many ATMs see hundreds, if not thousands, of checks deposited daily through ATMs, and it's impossible for humans to review each of them. FIs should deploy AI technology to analyze transactional data and images of checks, sending suspected fraudulent items into a queue that can be reviewed by trained fraud analysts.
ATMs are a convenient banking method -- from grabbing quick cash to depositing checks. With over 500,000 ATMs in the US, financial institutions need to ensure that their ATMs are secure -- both physically and digitally.
