ATM jackpotting malware takes control of an ATM’s computer and attempts to direct its cash dispenser to release money. It is different from a black-box attack, which uses an external device to communicate with the dispenser, and from card skimming, which targets card and PIN data. Banks and ATM operators reduce risk through layered software, physical-security and monitoring controls; no single measure guarantees protection.
How does ATM jackpotting malware work?
Europol defines jackpotting as malware taking control of an ATM PC to direct its cash dispenser to dispense money. In broad terms, an attacker gains access to an ATM or its computer, uses malicious software to reach the dispenser-control path, and tries to make the machine release cash. The definition describes the objective, not a single deployment method: particular cases can differ in how access is obtained and how commands are sent.
Europol’s IOCTA 2015 distinguishes several logical ATM attack types. Its categories help clarify what an incident is targeting:
- Jackpotting: malware takes control of the ATM PC to direct the cash dispenser.
- Software skimming: malware on the ATM PC intercepts card and PIN data rather than commanding a cash payout.
- Black boxing: an attacker’s external computer communicates with the cash dispenser and directs it to dispense cash. Europol describes this as a jackpotting variant, but it is a different access mechanism from malware controlling the ATM PC.
- Man-in-the-middle: an attacker manipulates communication between the ATM PC and the merchant acquirer’s host system. Europol says the malware must be present at a high software layer on the ATM PC or in the acquirer’s network.
Public accounts sometimes use “jackpotting” loosely for attacks that make an ATM pay out. When comparing an incident with Europol’s categories, the key distinction is whether malware controls the ATM computer or an external device communicates with the dispenser.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- AI Motion Detection 2.0 – Driving AI to the next level, human&vehicle detection and flexible detection area are more accurate than before. For quicker locating in crucial moments, human&vehicle smart searching in recordings offers you great help.
- Tried-and-True Safe Guard – This one-stop security solution can work with TVI, AHD, CVI, CVBS & IP cameras, the kit includes 1080P cams. The 8CH 3K lite DVR can hook up with 1080P@30fps or 3K/5MP@20fps cams. Therefore, you can also DIY it with other cameras in your home.
- Reliable 24/7 Continuous Recording – With a pre-installed 1TB HDD(Support up to 10TB HDD), providing 24/7 surveillance recording for you. Upgraded H.265+ saves more storage space and uses less bandwidth, recording videos longer and smoother viewing.
- Smart Dual-Light Effectively Guard Your Home – This newly upgraded security system offers you a crisp full color night vision, IR mode and color night vision switch flexibly. Once detect intruders, immediate pushes pop up on your phone, securing your peace of mind day&night.
- Color Night Vision & IP67 Weatherproof – Built-in IR lights and white lights, these cameras can see up to 100ft in B&W night vision, full-color night vision up to 66ft. Rated IP67, these wired cameras can brave all weather, and stand from cold to hot.
How is jackpotting different from a black-box attack or card skimming?
| Technique | Access path in Europol’s description | Primary target | Defensive emphasis supported by the cited sources |
|---|---|---|---|
| Jackpotting malware | Malware takes control of the ATM PC | Cash dispenser | BIOS and operating-system hardening; restrict external boot; alarms and physical controls |
| Black-box attack | An external device communicates with the dispenser; physical access to wiring occurred in the 2021 case below | Cash dispenser | Limit physical access; use surveillance and alarms |
| Software skimming | Malware runs on the ATM PC | Card and PIN data | Operating-system hardening and physical inspection or monitoring are relevant general layers; the cited material does not set out a distinct skimming control framework |
| Man-in-the-middle | Communication between the ATM PC and acquirer host is manipulated | Transaction communications | Secure relevant ATM and acquirer software and network layers; the cited material does not specify a complete control program |
The defensive emphases in this comparison synthesize Europol’s definitions and recommendations; they are not a separate formal framework published by Europol.
What do documented cases show?
Tyupkin: malware used against ATM computers
In a release dated 7 January 2016, Europol reported the disruption of a criminal group that used Tyupkin ATM malware and said eight people were arrested. Europol described the Trojan as being physically launched at an ATM; attackers used the PIN pad to submit commands that manipulated cash cassettes. This is a documented malware case, not evidence that all ATM cash-out attacks use the same access method. Europol’s 2016 Tyupkin case release
Rank #2
- 【AI Motion Detection 2.0】Driving AI to the next level, human&vehicle detection and flexible detection area are more accurate than before. For quicker locating in crucial moments, human&vehicle smart searching in recordings offers you great help.
- 【Tried-and-True Safe Guard】This one-stop security solution can work with TVI, AHD, CVI, CVBS & IP cameras, the kit includes 1080P cams. The 8CH 3K lite DVR can hook up with 1080P@30fps or 3K/5MP@20fps cams. Therefore, you can also DIY it with other cameras in your home.
- 【Reliable 24/7 Continuous Recording】With a pre-installed 1TB HDD(Support up to 10TB HDD), providing 24/7 surveillance recording for you. Upgraded H.265+ saves more storage space and uses less bandwidth, recording videos longer and smoother viewing.
- 【Smart Dual-Light Effectively Guard Your Home】This newly upgraded security system offers you a crisp full color night vision, IR mode and color night vision switch flexibly. Once detect intruders, immediate pushes pop up on your phone, securing your peace of mind day&night.
- 【Color Night Vision & IP67 Weatherproof】Built-in IR lights and white lights, these cameras can see up to 100ft in B&W night vision, full-color night vision up to 66ft. Rated IP67, these wired cameras can brave all weather, and stand from cold to hot.
Black-box attacks: an external device reached the dispenser
On 29 July 2021, Europol reported arrests in a Poland-led investigation into attacks in at least seven European countries. Europol estimated that €230,000 had been stolen across the attacks. Its account says suspects gained access to ATM wires by drilling holes or melting parts, connected a laptop and sent relay commands. Europol described this as a black-box attack; the account does not establish that malware was used in those attacks. Europol’s 2021 black-box case release
What historical figures can—and cannot—tell us
Europol reported that European ATM Security Team (EAST) statistics recorded 51 cash-out or jackpotting incidents in 2014. That is a historical figure for incidents reported in 2014, cited by Europol in 2015—not a current rate, a worldwide count or a measure of today’s risk. Europol’s 2015 notice citing EAST’s 2014 figure
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- 【Local & Remote Control】 The home security camera system support local view & control, no need WiFi, true play & plug. For remote control, support dual-band WiFi 2.4GHz/5GHz connectivity. WiFi pro technology offers 100ft installation distance, suitable for indoor/outdoor use.
- 【Corded Powered, 24/7 Recording】 Hiseeu security camera system, 24/7 wired power of cameras and NVR support 24/7 recording, no dropouts or battery hassles. 3 recording modes (24/7 recording, motion-triggered recording, or customized recording ), total flexibility.
- 【1TB Storage, No Monthly Fee】 Security camera system pre-installed in 1TB hard drive, massive local storage (No subscription fee!) offering over 45 days of continuous 24-hour recording. H.265+ bandwidth optimization Delivers 50% bandwidth reduction compared to H.264 while maintaining 4K/8MP resolution, enabling stable transmission even in low-bandwidth environments.
- 【Expand to 10CH & IP66 Waterproof 】 The NVR security camera system is coming with 4pcs 5MP cameras+1pc 4K NVR with 10" Monitor, it supported to expand to 10CH, scalability to secure large homes or businesses. Operates flawlessly in heavy snow, high winds, and sub-zero temperatures
- 【Motion Sensor/AI Human Detection】 Motion detection of the wireless wifi security camera system give you 24/7 uninterrupted protection. Smartly distinguishes people from false alarms (like pets or shadows), sending alerts only for real threats by AI human detection
Europol’s 2016 assessment linked ATM exposure at the time to outdated or insecure operating systems and the shift toward standardized PC hardware. It also warned that standardized APIs could make malware reusable across devices. In the investigations it described, most digitally facilitated ATM attacks involved black boxing rather than malware. Those are findings from that assessment, not claims that every ATM today has the same weaknesses or that the same attack mix prevails now. Europol, IOCTA 2016, “Payment Fraud”
How can banks and ATM operators defend against jackpotting?
Europol’s recommendations combine technical safeguards with controls that reduce or expose physical access. They are layers for reducing opportunity and improving detection, not a guarantee or a complete current security standard.
Rank #4
- AI Motion Detection 2.0: Driving AI to the next level, human&vehicle detection and flexible detection area are more accurate than before. For quicker locating in crucial moments, human&vehicle smart searching in recordings offers you great help
- Smart Dual-Light Effectively Guard Your Home: This newly upgraded security system offers you a crisp full color night vision, IR mode and color night vision switch flexibly. Once detect intruders, immediate pushes pop up on your phone, securing your peace of mind day&night
- Reliable 24/7 Continuous Recording: With a NEW surveillance grade pre-installed 1TB HDD(Support up to 10TB HDD), providing 24/7 surveillance recording for you. Upgraded H.265+ saves more storage space and uses less bandwidth, recording videos longer and smoother viewing
- Color Night Vision & IP67 Weatherproof: Built-in IR lights and white lights, these cameras can see up to 100ft in B&W night vision, full-color night vision up to 66ft. Rated IP67, these wired cameras can brave all weather, and stand from cold to hot
- Tried-and-True Safe Guard: This one-stop security solution can work with TVI, AHD, CVI, CVBS & IP cameras, the kit includes 1080P cams. The 8CH 3K lite DVR can hook up with 1080P@30fps or 3K/5MP@20fps cams. Therefore, you can also DIY it with other cameras in your home
Harden the ATM computer
- Secure the BIOS so unauthorized changes to the machine’s low-level startup configuration are harder to make.
- Disable booting from external drives to limit one route for launching unauthorized software.
- Harden the operating system. Europol’s 2016 assessment identified outdated or insecure operating systems as a historical exposure; operators should treat system lifecycle and security maintenance as part of ATM protection rather than assume older machines are safe because they are dedicated devices.
Control access and improve detection
- Limit physical access to ATMs and their sensitive components.
- Use surveillance and alarm systems to help detect or deter tampering and unauthorized access.
- Consider more frequent cash-replenishment cycles. Europol includes this among its measures; it is an operational measure, not a technical prevention control.
The controls should reflect the attack path. BIOS protection, restricted external boot and operating-system hardening address risks to the ATM computer. Access limits, surveillance and alarms also matter because Europol’s documented malware and black-box cases involved physical access in different ways. A black-box incident should not be mistaken for proof of malware simply because the machine dispensed cash.
Europol and Trend Micro’s 2016 announcement described ATM malware research and gave historical context of more than three million ATMs worldwide and approximately EUR 8.6 billion in cash withdrawals per year. Those approximate figures belong to that 2016 announcement; they are not current global totals. Europol and Trend Micro’s 2016 announcement
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Best Value
- 【Tried-and-True Safe Guard】This one-stop security solution works with TVI, AHD, CVI, CVBS & IP cameras. The 8CH 3K lite DVR can hook up with 1080P@30fps or 3K/5MP@20fps cams. Plus, the advanced sensor & smart IR capture clear images up to 100ft away
- 【AI Motion Detection 2.0】Driving AI to the next level, human&vehicle detection, flexible detection area are more accurate than before. For quicker locating in crucial moments, human&vehicle smart searching in recordings offers you great help
- 【Reliable 24/7 Continuous Recording】With a pre-installed 1TB HDD(Support up to 10TB HDD), providing 24/7 surveillance recording for you. Upgraded H.265+ saves more storage space and uses less bandwidth, recording videos longer and smoother viewing.
- 【Smart Dual-Light Effectively Guard Your Home】This newly upgraded security system offers you a crisp full color night vision, IR mode and color night vision switch flexibly. Once detect intruders, immediate pushes pop up on your phone, securing your peace of mind day&night.
- 【Color Night Vision & IP67 Weatherproof】Built-in IR lights and white lights, these cameras can see up to 100ft in B&W night vision, full-color night vision up to 66ft. Rated IP67, these wired cameras can brave all weather, and stand from cold to hot.
What is established about the current threat?
The cases and statistics cited here establish that ATM malware and black-box cash-out attacks occurred in specific historical periods and locations. They do not establish current worldwide prevalence, the present deployment status of ATM operating systems or a current ranking of attack types. For banks and operators, the durable lesson is to distinguish the threat mechanisms and apply layered controls to both the ATM computer and the physical machine.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
