ATM jackpotting compromises the ATM or its cash-dispenser control path so a machine can release cash without a normal customer transaction. Banks and ATM operators look for a combination of physical-access alerts, device and software changes, suspicious processes, and unexpected cash depletion—not just unusual card withdrawals. It is different from an issuer-side “cash-out,” which abuses bank or processor systems and accounts to produce withdrawals.
What ATM jackpotting means
In jackpotting, the target is the ATM itself or the software path that controls its dispenser. The FBI says its February 19, 2026 U.S. FLASH describes Ploutus malware abusing the eXtensions for Financial Services (XFS) software layer—the layer that lets ATM software communicate with hardware—to issue dispensing commands outside the ordinary authorization path. The attack is aimed at the machine, not at a cardholder’s account, and the machine may pay out without a card or bank authorization. The FBI reports 1,900 ATM jackpotting incidents since 2020, including more than 700 incidents and over $20 million in losses in 2025; these are figures in the FBI’s U.S. advisory, not global totals. FBI FLASH, February 19, 2026
How the attack works
Compromising the ATM’s control path
For normal withdrawals, an ATM communicates with the bank and then operates its dispenser as part of an authorized transaction. Jackpotting disrupts that path by gaining control of the ATM or the software that can command its hardware. The FBI says Ploutus can interact directly with ATM hardware, allowing a payout that does not follow the standard customer-and-bank authorization flow.
Physical access and malware installation
In documented methods described by the FBI, attackers open an ATM’s front or service area and modify or replace its hard drive, or connect an external device carrying malware, then reboot the machine. The FBI’s advisory says a malware family may work across manufacturers with limited adjustment when Windows is the exploited platform. These are reported access methods, not a universal sequence: other incidents may use different routes, and the details do not establish that every compromised ATM was accessed in the same way. FBI FLASH
#1 Best Overall
- AI Motion Detection 2.0 – Driving AI to the next level, human&vehicle detection and flexible detection area are more accurate than before. For quicker locating in crucial moments, human&vehicle smart searching in recordings offers you great help.
- Tried-and-True Safe Guard – This one-stop security solution can work with TVI, AHD, CVI, CVBS & IP cameras, the kit includes 1080P cams. The 8CH 3K lite DVR can hook up with 1080P@30fps or 3K/5MP@20fps cams. Therefore, you can also DIY it with other cameras in your home.
- Reliable 24/7 Continuous Recording – With a pre-installed 1TB HDD(Support up to 10TB HDD), providing 24/7 surveillance recording for you. Upgraded H.265+ saves more storage space and uses less bandwidth, recording videos longer and smoother viewing.
- Smart Dual-Light Effectively Guard Your Home – This newly upgraded security system offers you a crisp full color night vision, IR mode and color night vision switch flexibly. Once detect intruders, immediate pushes pop up on your phone, securing your peace of mind day&night.
- Color Night Vision & IP67 Weatherproof – Built-in IR lights and white lights, these cameras can see up to 100ft in B&W night vision, full-color night vision up to 66ft. Rated IP67, these wired cameras can brave all weather, and stand from cold to hot.
A U.S. Department of Justice account of an alleged scheme describes reconnaissance, testing how an ATM responds when opened, malware installation by drive modification or replacement or an external device, and commands to the Cash Dispensing Module. The DOJ also alleged that malware in that case was designed to delete evidence. Those are allegations concerning that case, not findings about all defendants or a description that applies to every jackpotting incident. U.S. Department of Justice case account
A historical variation
Europol’s 2016 description of the Tyupkin malware provides a historical example in which attackers directly manipulated cash cassettes and entered commands through an ATM’s PIN pad. It illustrates that jackpotting methods can vary; current operational guidance is better represented by the FBI’s 2026 advisory. Europol’s Tyupkin description
Rank #2
- 【AI Motion Detection 2.0】Driving AI to the next level, human&vehicle detection and flexible detection area are more accurate than before. For quicker locating in crucial moments, human&vehicle smart searching in recordings offers you great help.
- 【Tried-and-True Safe Guard】This one-stop security solution can work with TVI, AHD, CVI, CVBS & IP cameras, the kit includes 1080P cams. The 8CH 3K lite DVR can hook up with 1080P@30fps or 3K/5MP@20fps cams. Therefore, you can also DIY it with other cameras in your home.
- 【Reliable 24/7 Continuous Recording】With a pre-installed 1TB HDD(Support up to 10TB HDD), providing 24/7 surveillance recording for you. Upgraded H.265+ saves more storage space and uses less bandwidth, recording videos longer and smoother viewing.
- 【Smart Dual-Light Effectively Guard Your Home】This newly upgraded security system offers you a crisp full color night vision, IR mode and color night vision switch flexibly. Once detect intruders, immediate pushes pop up on your phone, securing your peace of mind day&night.
- 【Color Night Vision & IP67 Weatherproof】Built-in IR lights and white lights, these cameras can see up to 100ft in B&W night vision, full-color night vision up to 66ft. Rated IP67, these wired cameras can brave all weather, and stand from cold to hot.
Jackpotting versus an issuer-side ATM cash-out
“ATM cash-out” can refer to a different kind of crime. In a 2020 interview, PCI Security Standards Council (PCI SSC) describes coordinated cash-outs in which criminals compromise a bank or payment processor, manipulate card-management controls or account limits, and use new or compromised cards and accounts to make withdrawals. These withdrawals may pass through the normal ATM authorization process; the ATM itself is usually not the exploited system. PCI SSC interview, October 2020
| Comparison | ATM jackpotting | Issuer-side cash-out |
|---|---|---|
| Compromised system | The ATM, its software, or its dispenser-control path. FBI | The issuer’s or processor’s systems, including card-management controls. PCI SSC |
| How cash is released | A command to the dispenser can bypass a normal customer transaction. FBI | Withdrawals are made using accounts or cards after controls or limits have been manipulated. PCI SSC |
| Most relevant monitoring | Site access, hardware and software integrity, ATM state, and cash levels. FBI | Account and withdrawal velocity, card-management access, authorization changes, and transaction activity. PCI SSC |
| Relevant controls | Physical access restrictions, device and software integrity, and safeguards that can stop dispensing. FBI | Identity and access controls, transaction monitoring, withdrawal limits, and incident response. PCI SSC |
How banks and ATM operators detect jackpotting
No single alert proves jackpotting. Operators get a stronger indication by correlating physical, endpoint, and cash-state events—for example, an unscheduled service-door opening followed by removable-media activity, a new executable or process, and unexpected cash depletion. The FBI warns that indicators should be vetted: a logged USB connection, for example, may show that a device was connected without proving that files were accessed or executed. Whether a system records particular Windows events also depends on audit policy, configured System Access Control Lists (SACLs), and the ATM’s logging setup. FBI FLASH
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
- 【Local & Remote Control】 The home security camera system support local view & control, no need WiFi, true play & plug. For remote control, support dual-band WiFi 2.4GHz/5GHz connectivity. WiFi pro technology offers 100ft installation distance, suitable for indoor/outdoor use.
- 【Corded Powered, 24/7 Recording】 Hiseeu security camera system, 24/7 wired power of cameras and NVR support 24/7 recording, no dropouts or battery hassles. 3 recording modes (24/7 recording, motion-triggered recording, or customized recording ), total flexibility.
- 【1TB Storage, No Monthly Fee】 Security camera system pre-installed in 1TB hard drive, massive local storage (No subscription fee!) offering over 45 days of continuous 24-hour recording. H.265+ bandwidth optimization Delivers 50% bandwidth reduction compared to H.264 while maintaining 4K/8MP resolution, enabling stable transmission even in low-bandwidth environments.
- 【Expand to 10CH & IP66 Waterproof 】 The NVR security camera system is coming with 4pcs 5MP cameras+1pc 4K NVR with 10" Monitor, it supported to expand to 10CH, scalability to secure large homes or businesses. Operates flawlessly in heavy snow, high winds, and sub-zero temperatures
- 【Motion Sensor/AI Human Detection】 Motion detection of the wireless wifi security camera system give you 24/7 uninterrupted protection. Smartly distinguishes people from false alarms (like pets or shadows), sending alerts only for real threats by AI human detection
Physical and operational signals
- A service door opens outside scheduled maintenance, or a hard drive is removed unexpectedly.
- An ATM reports low or no cash, goes out of service unexpectedly, or shows a cash-state change that does not fit normal activity.
- An unauthorized device is connected or the machine’s physical condition changes.
- Suspicious surveillance or photography, probing of access points or response times, or repeat visits to multiple ATMs are observed. FDIC OIG describes these as warning signs to investigate, not proof of an attack. FDIC OIG bank alert
Endpoint and integrity signals
- Unexpected executables, scripts, directories, remote-access tools, or network connections appear.
- Abnormal autoruns, nonstandard services, unexpected process creation, or writes to sensitive files are recorded.
- Removable-media activity occurs without an approved service event.
- File hashes, software, libraries, or configuration differ from a controlled, approved baseline—the ATM’s “gold image.”
The FBI recommends comparing the installed system with an approved baseline that contains vendor- and institution-approved executables, libraries, and configuration files. Its FLASH states: “Each ATM should be deployed from a controlled ‘gold image’ containing cryptographically verified executables, libraries, and configuration files approved by the vendor and the institution.” FBI FLASH
Correlating events and preserving usable logs
The FBI’s example sequence includes USB insertion (Windows Event 6416), file activity (4663), process execution (4688), service installation (4697), and cleared logs (1102). Those event numbers are useful only if the ATM is configured to record the relevant activity; a missing event is not conclusive evidence that an action did not happen. Targeted auditing of removable storage, controlled file access, and process creation, with central log retention where available, gives investigators a better chance to reconstruct a sequence than isolated alerts do. Operators can also track ATM state so suspicious changes are visible promptly. FBI FLASH
Rank #4
- AI Motion Detection 2.0: Driving AI to the next level, human&vehicle detection and flexible detection area are more accurate than before. For quicker locating in crucial moments, human&vehicle smart searching in recordings offers you great help
- Smart Dual-Light Effectively Guard Your Home: This newly upgraded security system offers you a crisp full color night vision, IR mode and color night vision switch flexibly. Once detect intruders, immediate pushes pop up on your phone, securing your peace of mind day&night
- Reliable 24/7 Continuous Recording: With a NEW surveillance grade pre-installed 1TB HDD(Support up to 10TB HDD), providing 24/7 surveillance recording for you. Upgraded H.265+ saves more storage space and uses less bandwidth, recording videos longer and smoother viewing
- Color Night Vision & IP67 Weatherproof: Built-in IR lights and white lights, these cameras can see up to 100ft in B&W night vision, full-color night vision up to 66ft. Rated IP67, these wired cameras can brave all weather, and stand from cold to hot
- Tried-and-True Safe Guard: This one-stop security solution can work with TVI, AHD, CVI, CVBS & IP cameras, the kit includes 1080P cams. The 8CH 3K lite DVR can hook up with 1080P@30fps or 3K/5MP@20fps cams. Therefore, you can also DIY it with other cameras in your home
Defenses that reduce the risk
ATM security relies on layers: limiting physical access, protecting storage and connected devices, validating software, monitoring for change, and preventing payout when multiple warning signs converge. The FBI’s and FDIC OIG’s recommendations are operator- and vendor-level controls; they need to be checked against the ATM model and production environment.
Restrict and monitor physical access
- Use threat sensors, change standard locks, and use coded hatch access that raises an alarm if the required code is not entered.
- Protect maintenance and cashbox access with barriers; use cameras and preserve footage.
- Consider unique access keys, security gates, cameras or license-plate readers, and tamper-resistant screws securing the hard drive, as recommended by FDIC OIG.
FBI physical-security guidance; FDIC OIG bank alert
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- 【Tried-and-True Safe Guard】This one-stop security solution works with TVI, AHD, CVI, CVBS & IP cameras. The 8CH 3K lite DVR can hook up with 1080P@30fps or 3K/5MP@20fps cams. Plus, the advanced sensor & smart IR capture clear images up to 100ft away
- 【AI Motion Detection 2.0】Driving AI to the next level, human&vehicle detection, flexible detection area are more accurate than before. For quicker locating in crucial moments, human&vehicle smart searching in recordings offers you great help
- 【Reliable 24/7 Continuous Recording】With a pre-installed 1TB HDD(Support up to 10TB HDD), providing 24/7 surveillance recording for you. Upgraded H.265+ saves more storage space and uses less bandwidth, recording videos longer and smoother viewing.
- 【Smart Dual-Light Effectively Guard Your Home】This newly upgraded security system offers you a crisp full color night vision, IR mode and color night vision switch flexibly. Once detect intruders, immediate pushes pop up on your phone, securing your peace of mind day&night.
- 【Color Night Vision & IP67 Weatherproof】Built-in IR lights and white lights, these cameras can see up to 100ft in B&W night vision, full-color night vision up to 66ft. Rated IP67, these wired cameras can brave all weather, and stand from cold to hot.
Protect devices, software, and remote access
- Restrict devices and software to approved items; secure removable storage and monitor device, file, and process events.
- Use disk encryption, firmware-signature checks, memory-integrity protections, component tracking, and antimalware where supported.
- Restrict remote-access IP addresses and disable or change default credentials.
- Validate software and configuration against a controlled gold image rather than treating an unfamiliar file name or one indicator as a definitive finding.
Stop cash dispensing when evidence converges
The FBI recommends considering an automatic shutdown or out-of-service state when a combination of jackpotting indicators is detected. This can limit losses while staff investigate; it should be designed and validated for the specific ATM and operating environment so a defensive trigger does not create avoidable service disruption. FBI FLASH
Quick Recap
What to do if jackpotting is suspected
- Stop access and dispensing. Follow the institution’s incident-response procedure to close the affected ATM lane and prevent further payout or tampering.
- Preserve evidence. Secure surveillance footage, ATM and security logs, device and software-integrity records, and relevant forensic evidence. Avoid actions that could overwrite logs or alter the system before responders can assess it.
- Contact the appropriate authorities. FDIC OIG advises contacting local law enforcement, the FBI/IC3, and FDIC OIG. Coordinate notifications through the institution’s established response process. FDIC OIG bank alert
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
