Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The FBI says criminals reported more than 700 malware-enabled ATM jackpotting incidents in the United States during 2025, causing more than $20 million in losses. The agency’s February 19, 2026, FLASH alert also counts approximately 1,900 reported incidents since 2020.
Jackpotting is not primarily a scheme to steal customers’ card numbers. It is a cyber-physical attack that compromises an ATM and makes it dispense cash from the bank’s or ATM operator’s supply without a legitimate withdrawal.
What the FBI’s numbers mean
According to the FBI alert:
- Approximately 1,900 reported jackpotting incidents occurred in the United States since 2020.
- More than 700 of those incidents occurred in 2025.
- Those 2025 incidents produced more than $20 million in losses.
These are reported incidents, not necessarily a complete count of every attack. The figures are also rounded: “more than 700” does not mean exactly 700, and “more than $20 million” does not mean exactly $20 million. The alert does not, by itself, provide a complete annual breakdown, geographic table, ATM-model list, or confirmed malware attribution for every incident.
Using the rounded figures only, the 2025 losses imply a rough lower-bound average of more than $28,500 per reported incident. That is not an FBI-reported average and should not be treated as one; individual losses may vary substantially.
#1 Best Overall
- 1080P HD USB Camera with CMOS IMX323 Sensor: This USB industrial camera features a 1920×1080 resolution CMOS IMX323 sensor, delivering sharp images and accurate color reproduction for industrial inspection and PCB repair. With 30fps high frame rate, it supports MJPEG/YUY2/H.264 compression formats. The H.264 compression of this USB camera reduces bandwidth usage by 50% for smooth live streaming (Windows software for H.264 capture is provided).
- Manual Zoom Lenses for USB Industrial Camera: Equipped with a 2.8-12mm CS mount varifocal lens, this industrial USB camera offers flexible manual zoom control—easily adjust focal length to switch between wide-angle views (for large-area inspections) and close-up precision (for tiny PCB components).
- 0.01Lux Low Light USB Camera Performance: As a professional industrial inspection camera, it adopts a 2MP 1/2.9 IMX323 Color CMOS sensor, enabling it to capture clear images even in 0.01Lux low light conditions. This low light USB camera is ideal for various dim environments in industrial applications.
- Plug-and-Play USB Camera with Wide Compatibility: This mini USB camera is plug-and-play, requiring no driver installation. With a 4pin to USB connector, it easily connects to PCs and is compatible with Linux, Windows, Android, and Mac OS. Suitable for various devices like kiosks, vending machines, and computers for video conference.
- Versatile Applications of 1080P USB Camera: The 1080P USB camera is widely used in industrial settings such as video surveillance system, industrial inspection, PCB repair, ATM monitoring, and robotic vision. It also works well for live streaming, video conference, dashcam, and applications needing gesture tracking, iris recognition, depth and motion detection, thanks to its 0.01Lux low-light sensitivity and low distortion lens.
What is ATM jackpotting?
ATM jackpotting is a form of cyber-physical theft. Criminals combine physical access to an ATM with unauthorized software or another control mechanism to take over the cash-dispensing process.
- Attackers gain access to the ATM’s service area or internal components.
- They exploit weaknesses in physical access controls, service interfaces, removable media, or the machine’s operating environment.
- Malware or other unauthorized software is introduced or executed.
- The ATM is instructed to dispense cash outside the normal authorization process.
- Criminals or cash-out crews collect the money.
The FBI identified malware from the Ploutus family among tools associated with these attacks. That does not mean Ploutus was used in every reported incident.
This is a high-level explanation. Details such as access methods, activation procedures, exploitable configurations, or cash-dispensing commands would create unnecessary risk and are not needed to understand the threat.
Recommended Free Tools
Jackpotting versus skimming and other ATM crimes
| Attack | Primary target | What is stolen | Typical result |
|---|---|---|---|
| Card skimming | The customer’s card data and PIN | Account credentials or card information | Fraudulent withdrawals or purchases |
| ATM jackpotting | The ATM’s hardware and software | Cash held inside the machine | The ATM dispenses money without a valid customer withdrawal |
| Cash trapping | The cash-dispensing mechanism | A customer’s attempted withdrawal | Cash is retained instead of being delivered |
| Physical burglary | The ATM enclosure or safe | Cash and equipment | The machine is forced open, removed, or damaged |
The FDIC Office of Inspector General describes jackpotting as malware placed on an ATM to enable illegal dispensing from the bank’s cash supply. That distinction matters: the FBI’s more-than-$20-million 2025 figure should not be presented as money directly taken from consumers’ checking accounts.
Who bears the financial loss?
The immediate financial victims are generally banks, credit unions, independent ATM deployers, retailers or venues that own or host machines, and sometimes cash-management partners or insurers, depending on contractual and policy terms.
Rank #2
- H.265/H.264 5MP POE IP Security mini ip Camera, POE(Power Over Ethernet),Resolution: 5MP@25fps;4MP@25Fps,3MP@30Fps
- POE Function,Power Over Ethernet,One Cable Transfer Data&Power
- Plug&Play,O-N-V-I-F,Motion Detect&Email Alert,FTP
- Remotely View By Free Mobile Phone App: XMEYE, Support smart mobile phone app,Tablet PC
Consumers can still be affected indirectly through:
- Temporary ATM shutdowns or reduced cash availability.
- Service interruptions at branches, stores, or transit locations.
- Higher security and operating costs that may eventually affect fees.
- Exposure to a separate compromise if a particular ATM is tampered with or behaves abnormally.
Jackpotting is therefore different from a customer account takeover. A machine can be compromised and emptied even when no customer’s card credentials were stolen.
Why did attacks increase in 2025?
The FBI alert establishes the increase but does not prove a single cause. Several conditions may contribute:
- Reusable malware families, including Ploutus.
- Criminal specialization among intrusion teams and cash-out crews.
- Weak physical controls around ATM service access.
- Legacy or unsupported operating environments.
- Insufficient monitoring for unauthorized software, hardware, or configuration changes.
- Organized activity spanning intrusion, malware deployment, and cash collection.
- Improved detection or reporting in 2025.
The available figures do not establish that one criminal group, ATM manufacturer, operating system, or vulnerability caused the national increase. They also do not show whether the rise reflects more completed thefts, more attempts being reported, better detection, or a combination of factors.
Warning signs for ATM operators
Operators and financial institutions should investigate combinations of physical, software, and cash-reconciliation anomalies. Potential indicators include:
Rank #3
- Samsung by Hanwha XNB-H6241A
- An ATM door-open alert outside a scheduled maintenance window.
- Unexpected low-cash or no-cash conditions.
- Unauthorized devices connected to the machine.
- Evidence that a hard drive or other internal component was removed.
- An unexpected out-of-service state.
- Unusual tampering or unexplained service activity.
- Cash depletion that does not match authorized transactions or normal demand.
None of these signs proves jackpotting by itself. Low cash may result from legitimate demand, replenishment delays, or a sensor error. An out-of-service condition may be ordinary hardware failure, and a technician may legitimately connect equipment during a documented maintenance window.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →These are operator and staff indicators—not a reason for consumers to open, inspect, or tamper with an ATM.
How banks and ATM operators can reduce the risk
1. Strengthen physical security
- Review ATM locks, access panels, and service-key controls.
- Restrict access to authorized employees, technicians, and vendors.
- Audit who accessed each machine and when.
- Use cabinet, door, and tamper alerts where supported.
- Check machines for unauthorized hardware or unexpected access.
- Use camera coverage and remote verification for sensitive service events.
2. Harden the ATM operating environment
- Use application controls or allowlisting where the ATM manufacturer supports them.
- Restrict removable media and unused ports or interfaces.
- Protect internal storage with encryption or other approved controls.
- Monitor for unauthorized executables, configuration changes, and devices.
- Apply supported security updates and maintain an accurate software and hardware inventory.
- Replace unsupported or end-of-life machines when secure maintenance is no longer practical.
Controls must be tested against the ATM’s approved software and processor environment. A conventional corporate endpoint-security product may be unsupported or unsafe on a production ATM unless the manufacturer and processor approve it. Allowlisting can prevent unauthorized execution but may disrupt legitimate legacy applications if deployed without testing. Storage encryption improves protection but can complicate recovery and hardware replacement.
3. Improve monitoring and operations
- Centralize door, cash-level, service-state, and dispense-event monitoring across the fleet.
- Reconcile cash promptly against authorized transactions.
- Investigate unexplained dispense events and abnormal cash depletion.
- Segment ATM management systems from broader corporate networks where possible.
- Document maintenance windows and vendor chain-of-custody procedures.
- Train branch staff, ATM operators, and service providers to recognize indicators.
Real-time monitoring can shorten the time between compromise and detection, but it also creates alert volume. A monitoring program needs clear escalation rules and staff who can respond outside normal business hours.
4. Prepare for incident response
If an operator suspects jackpotting, it should preserve logs, camera footage, machine images, service records, transaction data, and physical evidence. It should isolate affected systems in a way that does not destroy evidence, secure the machine, and coordinate with its incident-response, legal, insurance, and law-enforcement contacts.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The FBI-related guidance asks organizations to provide information such as the date, time, location, type of activity, number of people involved, equipment used, submitting organization, and point of contact. Organizations should contact their local FBI field office and report appropriate information through the FBI’s Internet Crime Complaint Center.
What a recent DOJ case adds—and what it does not
In a February 20, 2026, announcement, the Justice Department said six additional defendants were charged in an international ATM jackpotting investigation, bringing the total charged in that case to 93. Prosecutors alleged that the scheme caused more than $6 million in losses and attempted additional thefts.
That case illustrates the organized nature of some jackpotting activity, but it is not an explanation for all approximately 1,900 FBI-reported incidents. Charging announcements describe allegations, not final findings, and case-specific losses should not be combined with the FBI’s national total as though they measure the same population.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What consumers should know
Consumers do not need to panic about the FBI’s figures, but they should treat unusual ATM behavior seriously.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Do not use an ATM that appears damaged, has unexplained equipment attached, or behaves unusually.
- Keep your receipt and record the amount requested and received.
- Contact your bank immediately if a withdrawal fails, is incomplete, or does not match your account records.
- Report unexpected account activity promptly through your bank’s official fraud channel.
- Do not open or attempt to inspect the ATM yourself.
These precautions also help with skimming, cash trapping, ordinary machine errors, and disputes over incomplete withdrawals. They do not prevent the operator-side compromise that defines jackpotting.
Best Value
- 2MP FHD Auto IR Night Vision with Wide Viewing Angle: 2MP Super HD USB camera with 24pcs IR led lights,up to 90 degree wide viewing angle,capture more clearer and sharper images and video,great fit for driveway,hallways,indoor outdoor dog pet baby security monitoring etc.
- High Speed 480P@100fps Dome Camera:Usb camera with 480P 100fps high frame rate,recording more smoothly and stable,easy setup with plug and play,free driver,waterproof camera with Aluminum box housing fit for indoor and outdoor,residential areas retail store, business. Dome camera mini webcam with wide application for use in ATM machine,kiosk,vending machine,simple security system,teaching system,interactive.
- Experience Magnificent Full-HD 1080P with CMOS OV2710 Image Sensor. This USB Webcam comes with enhanced capability utilizing the 1/2.7” CMOS OV2710 image sensor. Wide 90 degree viewing angle,Android,PC Windows,Linux,Raspeberry Pi and Mac.Waterproof and durable,it could be widely applicable to indoor/outdoors.store,home,office,school,bus,taxi in snowy/rainy/sunny days.
- Dome Camera Full HD 1080P USB Webcam:Desktop Laptop Computer Web Camera,High Speed 100fps Indoor Outdoor Security Camera,Audio IR Night Vision Web Cam,Plug&Play,Dome Webcam for Windows/Android/Mac.High speed 2 megapixel dome usb camera 640X480@100fps,Max resolution:1920X1080.
- USB 2.0/Plug&Play/Free Driver usb dome camera.This usb dome camera is plug and play,free driver,Platform Compatibility:Skype,Youtube,Yahoo!@Messenger,MSN,Zoom,instant messaging applications.We want to ensure the safety of our customers,their loved ones,homes,and businesses and you’ll receive a full 1-year US Warranty and Lifetime Support provided directly from Webcamer_usb.
What remains unknown
The FBI’s headline figures leave important questions unanswered. Publicly available information does not establish:
- A complete year-by-year incident count.
- Whether attacks are concentrated in particular states or regions.
- Which ATM manufacturers or operating environments are most affected.
- How losses are distributed across incidents.
- How many reports concern attempted attacks versus completed cash theft.
- What share of incidents involved Ploutus or another particular malware family.
- How much of the increase reflects improved detection and reporting.
Those limits are important when comparing FBI reports with DOJ prosecutions, insurer claims, or industry surveys. Each source may use different definitions and cover different populations.
The bottom line for financial institutions
ATM jackpotting is a direct attack on the cash machine, not simply another form of card fraud. The FBI’s 2025 figures show a serious increase in reported U.S. activity, but they should be read as rounded, reported totals rather than a complete census of ATM crime.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The strongest response combines controlled physical access, ATM-compatible software hardening, fleet-wide monitoring, vendor accountability, cash reconciliation, network segmentation, and evidence-preserving incident response. A software-only defense is insufficient because the attack depends on both cyber and physical weaknesses.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
