Listen to this Post
A New Generation of ATM Crime
ATMs were built around a simple promise: insert a card, prove who you are, receive the amount authorized by your bank. Jackpotting turns that trusted process upside down. Instead of stealing credentials or manipulating a bank account, criminals attack the machine itself, attempting to make it dispense its physical cash without a legitimate transaction ever taking place.
That makes ATM jackpotting one of the clearest examples of modern physical-cybercrime. The attacker may need physical access to the machine, but the final theft can depend on malware, malicious commands, compromised software, or specialized hardware. In other words, the vault is physical, but the attack path increasingly has a digital component.
A recent FBI investigation in Kansas illustrates just how seriously law enforcement is treating this threat. Five Venezuelan nationals pleaded guilty to conspiracy to commit bank larceny after investigators uncovered a scheme to compromise ATMs in Wamego and Manhattan and force them to release cash.
The operation ultimately failed, but the case exposes a much bigger problem: criminals are learning that an ATM can be attacked like a computer—and that the money sitting inside it can become the final payload.
Five Defendants Plead Guilty
Luis Alberto Velasquez-Artigas, 27; Royder Adrian Figuera-Perez, 29; Javier Mejia Jr., 27; Gabriel Alexjandro Corales-Garcia, 33; and Italo Lizandro Corrales-Carrillo, 26, traveled from Indiana to Kansas in December 2025, according to the U.S. Attorney’s Office for the District of Kansas.
Their objective was not a conventional bank robbery.
Instead, investigators say the group targeted ATM hardware and attempted to deploy malware capable of instructing the machines to dispense cash.
Velasquez-Artigas has already been sentenced to nine months in prison, while the remaining four defendants are awaiting sentencing.
The Attack Was Designed in Two Stages
According to court documents, the operation followed a two-stage model.
First, one member of the group would physically approach a selected ATM and attempt to install malicious software.
The second stage would occur later, when the criminals transmitted a command intended to make the compromised ATM dispense money.
That separation is important.
It means the person physically touching the ATM does not necessarily have to be the person controlling the machine when the cash is released. A criminal group can divide responsibilities between reconnaissance, physical intrusion, technical control, transportation and cash collection.
This is precisely what makes physical-cyber attacks so challenging to defend against.
The Wamego Attempt Triggered an Alarm
The first attempt did not go according to plan.
At an ATM in Wamego, the attempt to install malware triggered an alarm. Law enforcement responded before the suspects could return to complete the operation.
The criminals therefore failed to reach the final stage of the attack.
But the failed attempt was valuable to investigators because it provided evidence of how the group was operating and helped establish the connection between the suspects and the targeted machines.
Manhattan Became the Second Target
The group subsequently targeted an ATM in Manhattan.
Investigators say the suspects successfully approached the machine, but they still could not force it to dispense cash.
Surveillance footage captured the activity at both locations. The investigation moved quickly, and the suspects were arrested within days.
What might have become a successful cash-out operation instead became evidence of an increasingly organized ATM attack methodology.
What Exactly Is ATM Jackpotting?
ATM jackpotting is essentially an attempt to turn an ATM into an unauthorized cash dispenser.
Unlike ordinary card fraud, the criminal does not necessarily need a victim’s bank card, PIN or online banking credentials.
The objective is to manipulate the
In a successful attack, the criminals can potentially empty cash cassettes without corresponding withdrawals from customer accounts.
That distinction is critical.
A conventional fraudulent transaction may leave extensive banking records. Jackpotting can instead create a situation where physical currency disappears because the machine itself was manipulated.
The Physical-Cyber Hybrid Makes Jackpotting Dangerous
6
Jackpotting sits between traditional burglary and malware-based intrusion.
The attacker may need a service key, physical access, an exposed interface, an endoscope or another method of reaching the machine’s internal components.
Once access is obtained, however, the attack can become highly technical.
Malware can potentially interact with ATM software, communicate with components controlling the cash dispenser, or attempt to circumvent safeguards that normally require an authorized transaction.
Some attacks also use external malicious hardware—often described as a “black box”—to communicate with the ATM and trigger unauthorized dispensing.
The physical barrier and digital control layer therefore become part of the same attack surface.
Criminals Are Scouting ATM Models Before Attacking
One of the most concerning details in the Kansas case is the allegation that the group specifically scouted ATM models they considered more susceptible to malware installation.
That suggests something beyond opportunistic theft.
It indicates reconnaissance.
Cybercriminals routinely perform reconnaissance against internet-facing systems before attempting exploitation. Jackpotting crews can apply the same logic to physical infrastructure.
They can identify manufacturers, ATM models, software configurations, physical layouts and potential weaknesses before deciding which machines are worth targeting.
The ATM therefore becomes another endpoint that criminals can fingerprint.
The Numbers Show a Growing Problem
An FBI report cited in the release reportedly identified approximately 1,900 jackpotting cases since 2020.
More than 700 incidents were recorded in 2025 alone, with losses exceeding $20 million.
The numbers demonstrate why financial institutions cannot dismiss jackpotting as an exotic or isolated technique.
The threat is developing alongside the broader evolution of cybercrime.
Criminal groups increasingly look for systems where digital manipulation can produce immediate physical or financial consequences. ATMs are particularly attractive because their purpose is to store and dispense physical money.
Why Jackpotting Can Be Hard to Detect
Traditional banking security systems are designed to detect suspicious transactions.
Jackpotting challenges that assumption.
If an ATM dispenses cash without a corresponding customer withdrawal, investigators may initially see the event as a hardware failure, operational anomaly or unexplained cash discrepancy.
The attack may not involve a compromised customer account at all.
That means financial institutions need visibility at the machine level—not just at the account and transaction level.
ATM telemetry, physical tamper alerts, software integrity monitoring and cash-dispenser events can become crucial evidence during an investigation.
The ATM Is Now an Endpoint
For years, organizations have been taught to think about endpoints as laptops, desktops, smartphones, servers and cloud workloads.
That definition is no longer sufficient.
An ATM is effectively a specialized computer connected to sensitive financial infrastructure.
It has an operating system, applications, firmware, storage, communications interfaces and peripheral hardware.
It also has something most corporate computers do not:
a physical vault containing cash.
That combination makes ATM security particularly attractive to attackers.
Deep Analysis
Understanding the Attack Chain
A simplified jackpotting attack can be viewed as a chain of stages:
Reconnaissance → Physical Access → Malware/Implant Installation → Command & Control → Dispenser Manipulation → Cash Collection
Every stage presents an opportunity for defenders to intervene.
The objective for defenders should therefore be to break the chain as early as possible.
Defensive Investigation Commands
Security teams investigating suspicious ATM-related infrastructure can begin by reviewing endpoint and network telemetry.
For Linux-based monitoring infrastructure, administrators can inspect recent authentication activity with:
last -a
Review active network connections:
ss -tulpn
Inspect running processes:
ps aux --sort=-%cpu
Search system logs for unusual authentication or service activity:
journalctl --since "24 hours ago"
Check recently modified files:
find /var -type f -mtime -1 2>/dev/null
Review scheduled tasks that could potentially establish persistence:
crontab -l
These commands are defensive investigation examples, not jackpotting instructions. In a real ATM environment, forensic procedures should follow the manufacturer’s security architecture and the institution’s incident-response plan.
Windows-Based Investigation
Where ATM infrastructure uses Windows components, defenders can review recent system events through PowerShell:
Get-WinEvent -LogName System -MaxEvents 100
Inspect active network connections:
Get-NetTCPConnection | Sort-Object State
Review recently created processes:
Get-Process | Sort-Object StartTime -Descending
Check Windows services:
Get-Service | Sort-Object Status, DisplayName
Again, the goal is not to manipulate an ATM but to identify suspicious behavior on systems legitimately managed by the security team.
Firmware Integrity Should Become a Priority
ATM security cannot rely exclusively on antivirus software.
Firmware and system components should be protected through integrity controls and allowlisting wherever technically possible.
If only authorized firmware, binaries and configurations can execute, the attacker has fewer opportunities to introduce malicious components.
Firmware verification should also be paired with secure update procedures.
An ATM that accepts unauthorized software changes effectively provides attackers with an alternative route into the financial institution’s physical cash infrastructure.
Tamper Detection Can Stop the Attack Early
Physical security remains one of the strongest defenses against jackpotting.
Tamper sensors can detect unusual opening attempts or changes to protected components.
When those sensors are integrated with centralized monitoring, security teams can rapidly investigate a machine rather than waiting for an unexplained cash shortage.
The most effective model is layered:
Physical protection + tamper detection + software integrity + network monitoring + rapid response.
No single control should be expected to stop every attack.
Network Segmentation Matters
ATMs should not have unnecessary connectivity to critical enterprise systems.
Strong segmentation can reduce the potential impact of a compromised ATM or associated management infrastructure.
Security teams should carefully examine which systems an ATM can communicate with and whether those connections are genuinely required.
Unexpected outbound connections, unexplained administrative traffic or communication with unauthorized infrastructure should receive immediate attention.
Encryption Protects the Command Path
Communication between ATM components and authorized management systems should use strong encryption and authentication.
The goal is straightforward:
Even if an attacker reaches the network, they should not be able to impersonate trusted infrastructure or inject unauthorized instructions.
Encryption alone is not enough, but without it, attackers may have additional opportunities to manipulate communications.
Authentication Needs to Be More Than a Password
Administrative access to ATM management systems should use strong authentication and tightly controlled privileges.
Privileged access should be limited to personnel who actually need it.
Where supported, organizations should use phishing-resistant authentication, privileged access management, hardware-backed credentials and detailed administrative logging.
Every privileged action should be attributable to an individual or controlled service identity.
Monitoring Should Look for Physical and Digital Signals Together
One of the most important lessons from jackpotting is that security data cannot exist in separate silos.
Consider an ATM reporting:
An unexpected cabinet-opening event.
A new process appearing on the system.
An unusual administrative login.
An unexpected network connection.
A cash-dispenser activation without a normal transaction.
A software-integrity violation.
Each event alone might appear manageable.
Together, they could represent an active attack.
Security operations centers should therefore correlate physical sensors, endpoint telemetry, ATM transaction data and network activity.
Rapid Response Can Prevent the Final Cash-Out
Timing matters enormously.
If an institution detects physical tampering but waits hours to investigate, attackers may have enough time to return and complete the operation.
An alarm should therefore trigger an appropriate response workflow.
That could include remotely disabling affected functions where supported, dispatching security personnel, isolating suspicious infrastructure and preserving forensic evidence.
The fastest way to reduce financial loss is often to interrupt the attack before the dispenser becomes the final stage.
Jackpotting Is a Warning About Legacy Infrastructure
The broader issue extends beyond individual criminals.
Many financial institutions operate technology that must remain reliable for years.
That creates a difficult security challenge.
An ATM cannot always be replaced as easily as an employee laptop. Hardware deployments are expensive, geographically distributed and tightly connected to operational processes.
This can create an environment where older systems remain in service long after their security assumptions have become outdated.
Criminals understand this.
Legacy infrastructure can become an attractive target precisely because organizations are reluctant to replace it quickly.
What Undercode Say:
- ATMs Should Be Treated Like High-Value Endpoints
The Kansas case demonstrates that ATM security belongs inside the cybersecurity conversation, not only physical security.
- The Attack Surface Is Bigger Than the Banking Network
A bank can have excellent online security and still suffer losses if attackers compromise the machines holding physical cash.
- Physical Access Is Not a Simple Problem
Attackers can combine social engineering, stolen service credentials, specialized tools and technical knowledge to cross the physical boundary.
4. Reconnaissance Is Becoming More Important
The reported targeting of specific ATM models shows that criminals may research hardware before attempting an attack.
5. Jackpotting Can Be Highly Targeted
Criminals do not necessarily need to attack hundreds of machines.
Finding a small number of vulnerable ATMs may be enough to generate significant returns.
6. Security Teams Need ATM-Specific Telemetry
Generic endpoint monitoring may not understand the significance of a cash-dispenser command.
Specialized telemetry can provide the missing context.
7. Transaction Monitoring Alone Is Insufficient
The absence of a legitimate transaction can actually be one of the strongest indicators of jackpotting.
Financial institutions should correlate transaction records with dispenser activity.
8. Physical Security Is Cybersecurity
If malware installation requires physical access, protecting the physical enclosure becomes part of the cyber defense strategy.
- Tamper Sensors Are More Valuable When Connected to SOC Workflows
A sensor that generates an isolated alarm is useful.
A sensor that automatically creates a high-priority security investigation is far more valuable.
10. Firmware Integrity Deserves More Attention
Banks should know precisely which software is authorized to execute on every ATM under their control.
11. Software Allowlisting Can Reduce Attack Opportunities
If unauthorized binaries cannot execute, attackers face another significant barrier.
12. Network Segmentation Limits Damage
An ATM should not have unrestricted access to unrelated enterprise systems.
13. Encryption Must Cover Internal Communications
Protecting communications between ATM components can reduce opportunities for command manipulation.
14. Privileged Accounts Are High-Value Targets
Administrative credentials for ATM management systems should be treated as extremely sensitive.
15. Monitoring Must Include Physical Events
Opening a cabinet can be as important as a failed login.
Security platforms should be capable of understanding both.
16. Criminals Are Learning From Cybersecurity
The same principles used in enterprise penetration testing—reconnaissance, exploitation, persistence and command execution—can be adapted to physical financial infrastructure.
- The Cash Dispenser Is the Final Payload
In ransomware, the payload may be encrypted data.
In jackpotting, the payload is physical currency.
18. That Changes the Economics of Cybercrime
A successful intrusion can immediately produce a tangible financial return.
- ATM Manufacturers Are Part of the Security Equation
Financial institutions cannot solve every vulnerability independently.
Hardware and software vendors must build stronger security into ATM architectures.
20. Banks Need Better Vendor Visibility
Organizations should understand the software versions, firmware configurations and management interfaces deployed across their ATM fleets.
21. Patch Management Must Include ATMs
Specialized hardware should not be excluded from vulnerability-management programs simply because it is not a conventional workstation.
- Incident Response Plans Should Include Cash Theft
A bank’s incident-response playbook should explicitly define what happens when an ATM shows signs of compromise.
23. Evidence Preservation Matters
Surveillance footage, alarm logs, transaction records, system logs and network telemetry can become critical evidence.
24. Physical Surveillance Remains Powerful
The Kansas investigation reportedly benefited from surveillance footage.
Technology and traditional investigative methods can complement one another.
25. Criminal Groups Can Divide Responsibilities
One person may perform physical access while another controls the technical side.
This makes attribution and detection more complicated.
- The Threat Is Not Limited to One Country
The techniques used in ATM attacks can cross borders just as easily as other forms of cybercrime.
27. Financial Institutions Should Assume Targeted Reconnaissance
Security teams should understand which ATM models are deployed and which configurations could attract attackers.
28. Security Testing Should Include Physical Scenarios
Penetration testing that examines only network infrastructure may miss weaknesses in ATM deployment.
29. Red Teams Can Help Expose Weaknesses
Authorized security testing can identify physical and digital attack paths before criminals do.
- Zero-Trust Principles Can Apply to ATM Infrastructure
Every administrative connection should be authenticated, authorized and monitored.
31. Remote Management Deserves Special Scrutiny
Centralized ATM management can improve operational efficiency, but it can also create a high-value control plane.
32. Centralized Control Requires Strong Isolation
Compromising one management system could potentially expose many machines.
33. Automated Detection Should Be Correlation-Driven
The strongest detections will combine several weak signals into one meaningful alert.
- Cash Reconciliation Can Become a Security Signal
Unexpected differences between recorded transactions and physical cash should trigger investigation.
- Criminals Will Continue Looking for Physical-Digital Convergence
ATMs are only one example of infrastructure where cyber access can produce physical consequences.
36. Smart Infrastructure Creates Smart Attack Surfaces
As physical systems become more software-controlled, traditional criminals gain more opportunities to use cyber techniques.
37. Security Investment Must Follow the Money
Systems that directly control valuable physical assets deserve proportionally strong defenses.
38. Jackpotting Is a Strategic Warning
The attack demonstrates how criminals can bypass conventional banking controls by targeting the infrastructure around the transaction.
39. The Best Defense Is Layered
Physical locks, tamper sensors, secure firmware, segmentation, authentication, monitoring and rapid response must work together.
40. The Biggest Lesson Is Simple
An ATM is not merely a box that contains cash.
It is a computer-controlled financial system sitting in a public environment—and criminals increasingly understand exactly what that means.
✅ Five Venezuelan Nationals Pleaded Guilty
The supplied report states that Luis Alberto Velasquez-Artigas, Royder Adrian Figuera-Perez, Javier Mejia Jr., Gabriel Alexjandro Corales-Garcia and Italo Lizandro Corrales-Carrillo pleaded guilty to conspiracy to commit bank larceny.
The case was investigated by the FBI and prosecuted by the U.S. Attorney’s Office for the District of Kansas.
✅ The Scheme Targeted ATMs in Kansas
The reported targets were in Wamego and Manhattan, Kansas, after the group traveled from Indiana in December 2025.
The operation involved an attempted physical installation followed by an intended remote cash-dispensing command.
✅ Jackpotting Is a Real Physical-Cyber Threat
ATM jackpotting can involve physical access combined with malicious software or hardware intended to cause unauthorized cash dispensing.
The technique differs from ordinary card theft because the attack focuses on controlling the ATM rather than necessarily compromising a customer’s bank account.
⚠️ The Exact Statistics Require Context
The reported figures—approximately 1,900 incidents since 2020, more than 700 in 2025 and losses exceeding $20 million—come from an FBI report cited by the original release.
Those figures should be interpreted within the
Prediction
(+1) ATM Security Will Become More Integrated With Cybersecurity
As ATM attacks increasingly combine physical intrusion with malware and remote control, financial institutions will likely bring ATM monitoring deeper into security operations centers.
Future ATM defenses will increasingly combine tamper sensors, endpoint integrity, network telemetry, behavioral analytics and transaction monitoring.
The strongest systems will not simply ask whether an ATM is online. They will ask whether its physical state, software state, network behavior and cash activity all make sense together.
(+1) AI Will Improve Detection of ATM Anomalies
Machine-learning systems could eventually establish behavioral baselines for individual ATM fleets and flag unusual combinations of physical and digital events.
An ATM that suddenly communicates with an unfamiliar host while experiencing a physical tamper event and an abnormal dispenser command should immediately stand out.
(-1) Criminals Will Continue Targeting Older ATM Infrastructure
Legacy hardware is unlikely to disappear overnight.
Where older machines lack modern integrity controls, stronger authentication or sophisticated tamper detection, attackers may continue looking for weaknesses that newer systems have already eliminated.
(+1) Physical-Cyber Defense Will Become a Core Financial Security Discipline
The Kansas case points toward a broader future in which cybersecurity teams must protect not only data and accounts but also machines that directly control physical assets.
The boundary between cybersecurity and physical security is disappearing.
And when the asset behind that boundary is a vault full of cash, attackers have every reason to keep testing it.
▶️ Related Video (88% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
