Recommended Free Tools
The FBI says criminals carried out more than 700 reported ATM-jackpotting incidents in the United States during 2025, with losses exceeding $20 million. Its February 19, 2026, FLASH alert also counts approximately 1,900 incidents reported since 2020. Those figures describe aggregate reports; they do not establish an audited exact loss, that every incident successfully dispensed cash, or that consumers lost $20 million from their bank accounts.
ATM jackpotting is a cyber-physical theft technique aimed at the machine and its cash supply. Attackers obtain physical access, compromise the ATM with malware or an unauthorized device, and manipulate software that controls the dispenser. Banks, independent ATM deployers, cash owners and other operators are usually the direct financial victims.
What the FBI reported
| Measure | FBI wording and scope |
|---|---|
| Alert | FLASH-20260219-001, issued February 19, 2026 |
| Incidents since 2020 | Approximately 1,900 reported ATM-jackpotting incidents in the United States |
| Incidents in 2025 | More than 700 reported incidents |
| 2025 losses | More than $20 million associated with those incidents |
The FBI’s bulletin is an official threat alert containing attack descriptions, indicators, reporting instructions and mitigations. “More than” matters: the alert does not provide a precise audited total, an average loss, or a breakdown by state, manufacturer, operator or malware variant. The primary source is the FBI FLASH alert.
What ATM jackpotting means
Jackpotting is an attack on an ATM’s local operating environment rather than a normal customer’s bank account. At a high level, the chain is:
#1 Best Overall
- 1080P HD USB Camera with CMOS IMX323 Sensor: This USB industrial camera features a 1920×1080 resolution CMOS IMX323 sensor, delivering sharp images and accurate color reproduction for industrial inspection and PCB repair. With 30fps high frame rate, it supports MJPEG/YUY2/H.264 compression formats. The H.264 compression of this USB camera reduces bandwidth usage by 50% for smooth live streaming (Windows software for H.264 capture is provided).
- Manual Zoom Lenses for USB Industrial Camera: Equipped with a 2.8-12mm CS mount varifocal lens, this industrial USB camera offers flexible manual zoom control—easily adjust focal length to switch between wide-angle views (for large-area inspections) and close-up precision (for tiny PCB components).
- 0.01Lux Low Light USB Camera Performance: As a professional industrial inspection camera, it adopts a 2MP 1/2.9 IMX323 Color CMOS sensor, enabling it to capture clear images even in 0.01Lux low light conditions. This low light USB camera is ideal for various dim environments in industrial applications.
- Plug-and-Play USB Camera with Wide Compatibility: This mini USB camera is plug-and-play, requiring no driver installation. With a 4pin to USB connector, it easily connects to PCs and is compatible with Linux, Windows, Android, and Mac OS. Suitable for various devices like kiosks, vending machines, and computers for video conference.
- Versatile Applications of 1080P USB Camera: The 1080P USB camera is widely used in industrial settings such as video surveillance system, industrial inspection, PCB repair, ATM monitoring, and robotic vision. It also works well for live streaming, video conference, dashcam, and applications needing gesture tracking, iris recognition, depth and motion detection, thanks to its 0.01Lux low-light sensitivity and low distortion lens.
- Criminals gain physical access to the ATM’s service area or internal components.
- They introduce malware or an unauthorized device, or alter storage used by the machine.
- The malicious code communicates with the dispenser through the ATM software stack.
- The machine is instructed to release cash outside the normal card, account and bank-authorization process.
- Cash-out crews collect money, potentially from several machines operated by one institution.
The FBI names the Ploutus malware family and the ATM software layer called eXtensions for Financial Services (XFS). XFS allows ATM applications to control functions such as dispensing. If attackers can issue commands through that layer, the dispenser can be directed without a valid payment card or customer authorization. The alert describes observed activity; it does not mean every ATM uses the same operating system, XFS implementation or Ploutus variant.
Jackpotting versus skimming and other ATM fraud
| Threat | Primary target | Typical mechanism | Direct victim |
|---|---|---|---|
| Jackpotting | ATM software, hardware and cash supply | Physical compromise plus malware or an unauthorized device | Bank, ATM operator or cash owner |
| Skimming | Payment-card data and PINs | Overlay, hidden reader or camera captures card information | Customer accounts and payment networks |
| Cash trapping | Cash or card slot | Physical obstruction diverts cash or retains a card | Customers and sometimes operators |
| Banking-system fraud | Accounts or financial systems | Credential theft, malware or transaction manipulation | Customers and financial institutions |
A jackpotting-compromised machine does not automatically mean a user’s checking account was drained. Customers can still face outages, suspicious activity or secondary risks, and should avoid an ATM that appears damaged or tampered with.
Rank #2
- H.265/H.264 5MP POE IP Security mini ip Camera, POE(Power Over Ethernet),Resolution: 5MP@25fps;4MP@25Fps,3MP@30Fps
- POE Function,Power Over Ethernet,One Cable Transfer Data&Power
- Plug&Play,O-N-V-I-F,Motion Detect&Email Alert,FTP
- Remotely View By Free Mobile Phone App: XMEYE, Support smart mobile phone app,Tablet PC
How attackers reach the machine
The FBI describes physical access as central to the observed attacks. Methods include opening a face panel or maintenance area, removing a hard drive and connecting it to another computer, replacing the original drive with a prepared one, or attaching an unauthorized external device. The FDIC Office of Inspector General also warns that criminals may watch locations, photograph machines, test alarm response and observe cash-replenishment routines.
This physical stage is why network monitoring alone is insufficient. A local drive or USB device can stage malware without first producing an obvious remote intrusion.
Rank #3
- Samsung by Hanwha XNB-H6241A
Warning signs for operators
Physical and operational signs
- An ATM door or maintenance hatch opens outside a documented service window.
- The machine becomes unexpectedly unavailable or reports an unexplained low-cash condition.
- A hard drive is removed, or an unapproved USB keyboard, hub, phone or storage device is attached.
- Cameras show surveillance, photography, unusual vehicles or unexplained alarms near the machine.
Digital signs
The FBI lists unexpected executables including Newage.exe, Color.exe, Levantaito.exe, NCRApp.exe, sdelete.exe, Promo.exe, WinMonitor.exe, WinMonitorCheck.exe and Anydesk1.exe. Other signals include unapproved TeamViewer or AnyDesk installations, unexpected IP connections, abnormal Windows autoruns, new services, USB-insertion events and files or processes outside the approved baseline.
No filename, hash, IP address or event proves compromise by itself. Legitimate maintenance can create similar evidence, so investigate indicators alongside physical access, service records, cash reconciliation and process history.
A practical response to suspected jackpotting
- Take the ATM out of service when safe and operationally feasible, and prevent further dispensing.
- Preserve the scene. Avoid casual rebooting, reimaging, drive replacement or file deletion before forensic decisions are made.
- Secure evidence. Preserve CCTV and access-control footage; record door events, cash levels, maintenance history, connected devices and system logs.
- Notify responsible parties. Contact the ATM operator, bank security team, vendor, incident-response personnel and law enforcement.
- Report to the FBI. Use the local FBI field office directory or the Internet Crime Complaint Center. Include location, date and time, machine manufacturer and model, vendor contact, activity observed and available logs.
The FDIC OIG recommends closing the ATM lane, preserving surveillance and treating the location as a potential crime scene. Restoring service quickly may be necessary, but doing so before evidence collection can destroy information needed to identify the intrusion.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How banks and ATM operators can reduce risk
Harden physical access
- Replace generic keys and standard locks with unique or stronger access controls.
- Add gates, barriers, tamper-resistant screws and maintenance-hatch alarms.
- Use hood or vestibule alarms, vibration sensors and temperature-change sensors where appropriate.
- Cover the ATM, approach routes, service areas and likely vehicle positions with cameras, and retain footage long enough for investigations.
- Compare planned maintenance with door-open and device-connection events.
Protect boot and hardware integrity
- Use device or hardware allowlisting to restrict unauthorized drives, phones, keyboards, hubs and USB devices.
- Enable disk encryption, signed firmware, boot-time integrity checks and TPM-based controls where the ATM vendor supports them.
- Maintain a bill of materials for hardware and software.
- Test Windows memory-integrity settings in a vendor-approved environment before deployment.
Control software and endpoints
- Maintain a verified gold image for each ATM model and software configuration.
- Compare files, hashes, executables, libraries and configuration files against that baseline.
- Prefer application allowlisting, with antimalware or EDR only after compatibility testing with the ATM vendor and XFS middleware.
- Remove unauthorized remote-access tools and change default credentials.
- Test security changes in pre-production before fleet rollout.
Log and correlate high-value events
Centralize logs for removable-media access, USB connections, process creation, command lines where appropriate, file and object access, service installation, security-log clearing and audit-policy changes. The FBI illustrates a possible Windows sequence using Event IDs 6416 (device connection), 4663 (audited file access), 4688 (process creation), 4697 (service installation) and 1102 (security-log clearing). These are detection signals, not a universal signature.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteBest Value
- 2MP FHD Auto IR Night Vision with Wide Viewing Angle: 2MP Super HD USB camera with 24pcs IR led lights,up to 90 degree wide viewing angle,capture more clearer and sharper images and video,great fit for driveway,hallways,indoor outdoor dog pet baby security monitoring etc.
- High Speed 480P@100fps Dome Camera:Usb camera with 480P 100fps high frame rate,recording more smoothly and stable,easy setup with plug and play,free driver,waterproof camera with Aluminum box housing fit for indoor and outdoor,residential areas retail store, business. Dome camera mini webcam with wide application for use in ATM machine,kiosk,vending machine,simple security system,teaching system,interactive.
- Experience Magnificent Full-HD 1080P with CMOS OV2710 Image Sensor. This USB Webcam comes with enhanced capability utilizing the 1/2.7” CMOS OV2710 image sensor. Wide 90 degree viewing angle,Android,PC Windows,Linux,Raspeberry Pi and Mac.Waterproof and durable,it could be widely applicable to indoor/outdoors.store,home,office,school,bus,taxi in snowy/rainy/sunny days.
- Dome Camera Full HD 1080P USB Webcam:Desktop Laptop Computer Web Camera,High Speed 100fps Indoor Outdoor Security Camera,Audio IR Night Vision Web Cam,Plug&Play,Dome Webcam for Windows/Android/Mac.High speed 2 megapixel dome usb camera 640X480@100fps,Max resolution:1920X1080.
- USB 2.0/Plug&Play/Free Driver usb dome camera.This usb dome camera is plug and play,free driver,Platform Compatibility:Skype,Youtube,Yahoo!@Messenger,MSN,Zoom,instant messaging applications.We want to ensure the safety of our customers,their loved ones,homes,and businesses and you’ll receive a full 1-year US Warranty and Lifetime Support provided directly from Webcamer_usb.
The most useful alert combines events: an unscheduled door opening, USB insertion, file change, new process or service, log clearing and abnormal cash depletion. Automatic shutdown or out-of-service behavior can limit losses, but thresholds must be tested with the vendor so a control failure does not create an unsafe or ambiguous machine state.
Constraints operators must account for
- Vendor compatibility: EDR, allowlisting, encryption and Windows policies can disrupt ATM middleware or void support if deployed without approval.
- Legacy equipment: Older machines may lack secure-boot, TPM or supported operating-system protections.
- Mixed ownership: A bank may brand or route transactions through ATMs owned by independent deployers.
- False positives: Legitimate technicians, update media and remote-support tools can resemble attack indicators.
- Evidence versus uptime: Reimaging restores availability but may erase forensic evidence.
- Cash reconciliation: Low cash can reflect ordinary demand, replenishment errors or mechanical failure; correlate it with logs and footage.
What ATM customers should know
Jackpotting primarily targets the ATM’s cash supply, not the customer’s account credentials. It is therefore different from skimming. Customers should still leave a machine that appears forced open, has unfamiliar equipment attached, shows unusual messages or is surrounded by suspicious activity. Use another ATM and report visible tampering to the operator or bank. An outage or empty cassette alone is not proof of jackpotting.
Bottom line for financial institutions
The FBI’s 2026 alert establishes a serious U.S. trend: more than 700 reported jackpotting incidents in 2025 were associated with losses exceeding $20 million, and approximately 1,900 incidents have been reported since 2020. The durable defense is layered: control physical access, enforce trusted hardware and software baselines, correlate endpoint and cash events, coordinate with vendors and preserve evidence when an ATM is suspected.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
