ATM Jackpotting: Black Box Attack Forces ATM to Dispense All Cash
US Secret Service and FBI warned that ATM jackpotting attacks — where criminals attach a device to the ATM's internals and command it to dispense all cash — had reached the United States after years of success in Europe and Latin America.
Background
ATM jackpotting attacks do not require stealing card data — they attack the cash dispenser mechanism directly. European and Latin American banks had reported attacks since 2010. The first confirmed US jackpotting attacks were reported in January 2018.
The Attack
ATM jackpotting uses two main techniques: Ploutus-style attacks (attaching a laptop to the ATM's internal computer via USB or serial cable and running malware that commands the cash dispenser), and "black box" attacks (physically opening the ATM top cabinet and attaching a device that connects to the ATM's ATM dispenser bus, then issuing commands directly). Attackers dress as ATM technicians to access the ATM's internal components. Once connected, the device can command the dispenser to release all available cash. A "money mule" waits at the ATM to collect bills as they dispense.
Response
The US Secret Service issued a confidential advisory to financial institutions. ATM manufacturers Diebold Nixdorf and NCR published security guidance. Banks began requiring additional physical security on ATM top cabinets. Some ATMs were upgraded to encrypt the communication bus between the ATM computer and dispenser.
Outcome
ATM jackpotting attacks emptied machines of tens to hundreds of thousands of dollars per attack. The combination of physical access (technician impersonation) and digital command execution made it a hybrid physical-cyber attack. Hundreds of ATMs were hit across the US in 2018.
Key Takeaways
- ATM top cabinets should be secured with tamper-evident seals and alarm systems that detect unauthorised opening
- ATM dispenser communication buses should use encrypted, authenticated protocols resistant to direct command injection
- ATM monitoring systems should alert on unusual cash dispense patterns — rapid full-dispense in non-business hours is a clear indicator
- ATM technician impersonation is a known attack vector — verify identity of anyone claiming to service ATMs