Jackpotting siphons millions of dollars off ATMs

ATM jackpotting is on the rise. According to the FBI, 1,900 jackpotting incidents have been reported since 2020. Over 700 of those incidents occurred in 2025 alone, resulting in more than $20 million in losses, the FBI said in a just-released bulletin.

Jackpotting is a high-tech crime where criminals use a combination of tactics, including malware and physical tampering, to get ATMs to dispense stored cash, resembling a slot machine hitting a jackpot.

One particular malware, known as Ploutus, targets the underlying Windows operating system that powers many ATMs. Criminals typically gain access to the machines using generic keys that can open the face of an ATM. They then infect the machine with malware, either by removing the ATMs hard drive and copying malware onto it before putting it back into the machine, or just replacing the hard drive with one that's preloaded with ATM jackpotting code.

Either way, hackers gain complete control over a compromised ATM, tricking the machine into dispensing all its stored cash, bypassing the need for PINs to access specific accounts.

"Ploutus attacks the ATM itself rather than customer accounts, enabling fast cash-out operations that can occur in minutes and are often difficult to detect until after the money is withdrawn," the FBI wrote in the bulletin. "The malware can be used across ATMs of different manufacturers with very little adjustment to the code as the Windows operating system is exploited during the compromise."

Recent arrests in Nebraska, Iowa, elsewhere

A federal grand jury in Nebraska handed down an indictment on Feb. 18, 2026, charging six individuals for ATM jackpotting. The indictment follows one handed down on Dec. 9, 2025, alleging a foreign terrorist group known as Tren de Aragua undertook jackpotting attacks across the country. That indictment charged 22 individuals for their parts in the scheme, according to reporting by several news outlets.

Meanwhile, two men were recently arrested for the attempted jackpotting of an ATM at a bank in Dubuque, Iowa, in mid-October 2025, according to reporting by the Dubuque Telegraph Herald. Surveillance footage showed a pair of vehicles at and near the bank's ATM on two separate occasions, each time triggering an alarm when an occupant of one of the vehicles opened a hood door on the bank's ATM. No money was taken in either instance.

Documents reviewed by the Telegraph Herald stated that two vehicles are often used in jackpotting attempts at outdoor ATMs, with the second vehicle acting as a spotter for the person attempting to compromise the ATM.

Defense recommendations

The FBI bulletin recommends "a targeted audit policy focused on removable storage usage, controlled file access, and process creation providing high-fidelity detection of ATM jackpotting activity with minimal system overhead."

Specific recommendations include:

• Changing the standard locks on ATM devices to prevent the use of keys widely available on the dark web.

• Installing keypads on devices that set off alarms if a code is not entered when the maintenance hatch is opened.

• Installing additional keypad barriers that prevent the cashbox and maintenance hatch from being accessed.

• Ensuring security cameras cover necessary areas and preserving footage recordings.

• Enabling hard drive encryption to prevent the introduction of malware.

• Regular auditing of ATMs to ensure all available security mechanisms are properly enabled.

Notice to readers: These are archived articles. Contact information, links and other details may be out of date. We regret any inconvenience.