Experts warn of rising cyber-physical threat at ATMs

Three Bay Area residents were charged after a late-night "jackpotting" caper that emptied two ATMs at Savings Bank of Mendocino County of more than $100,000, according to investigators. Surveillance footage showed two masked suspects arriving in a Toyota Prius, opening the ATM cabinets with a generic key, installing electronic devices, then returning and using a phone to trigger cash-dispense commands, the San Francisco Chronicle reported. Police later traced the rental car to Daly City and arrested three suspects on grand theft and conspiracy charges.

"Jackpotting" refers to cyber-physical attacks that force an ATM to spit out cash without debiting any cardholder account—typically after attackers gain cabinet access and either load malware or connect a "black box" that issues dispense commands. The U.S. Secret Service first warned U.S. banks about jackpotting in 2018, noting that perpetrators may use malware or specialized electronics once they have physical access to the machine.

The Ukiah case echoes techniques seen elsewhere this year. In May, Illinois authorities charged three men who allegedly used a key to open an ATM and attempted to override its systems; police recovered an unauthorized ATM key and electronics after an alarm interrupted the attack. In New York, federal prosecutors charged six men over four jackpotting events that netted more than $400,000 across three counties.

A growing risk

Industry groups say the risk is growing as criminals blend low-tech entry (generic/master keys, pried panels) with off-the-shelf hardware and insider know-how. The ATM Industry Association (ATMIA) has repeatedly flagged jackpotting and related terminal attacks, urging deployers to harden both physical locks ("mind your top hat") and logical controls, and to improve remote monitoring and incident response.

Security advisers add that layered defenses are essential: newer firmware, disabling unused ports, protected USBs, tamper-evident seals, authenticated technician access, and monitoring for anomalous dispense behavior. Consulting briefs in 2024–2025 note that incidents have trended upward since the first U.S. cases in 2018 as tools proliferate.

Who's at risk? Banks, credit unions, and merchants that host retail ATMs all face exposure. Standalone and lobby units with weaker physical protections are particularly attractive because a short, after-hours window can be enough to install a device and walk away before remotely "cash-out" commands are sent later. The threat does not directly debit cardholders, but financial institutions and independent ATM deployers absorb the losses and service disruption.

Law enforcement and ATMIA guidance converge on the same takeaway: tighten physical access, verify technicians, upgrade software, and watch for unusual dispense patterns in real time. The Ukiah arrests underscore how quickly a small crew can drain machines—and why layered defenses and rapid detection matter for every site hosting an ATM.

Notice to readers: These are archived articles. Contact information, links and other details may be out of date. We regret any inconvenience.