Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
More than 700 ATM-jackpotting incidents were reported in the United States during 2025, causing losses exceeding $20 million, according to an FBI advisory issued February 19, 2026. The FBI said approximately 1,900 such incidents had been reported since 2020.
That is a sharp concentration of reported activity in 2025, although the public advisory does not provide a complete year-by-year series or a precise percentage increase. Jackpotting primarily targets an ATM’s cash inventory and dispensing controls—not necessarily customers’ bank accounts.
The numbers behind the 2025 increase
| Measure | Reported figure | What it means |
|---|---|---|
| Incidents since 2020 | Approximately 1,900 | Reported U.S. incidents; not necessarily unique machines or criminal campaigns |
| Incidents in 2025 | More than 700 | The FBI’s reported total for the year |
| 2025 losses | More than $20 million | The FBI’s nationwide estimate |
The FBI describes jackpotting as malware-enabled activity that exploits physical and software weaknesses to make ATMs dispense cash without a legitimate transaction. The advisory uses the word incidents; it does not establish that more than 700 unique ATMs were involved.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The loss figure also has a different scope from figures in individual prosecutions. For example, the Justice Department said on February 20, 2026, that a broader investigation had produced charges against 93 defendants and attributed more than $6 million in losses, plus at least $1.74 million in attempted losses, to the charged conspiracy. That prosecution-specific figure should not be substituted for the FBI’s nationwide estimate.
#1 Best Overall
- 1080P HD USB Camera with CMOS IMX323 Sensor: This USB industrial camera features a 1920×1080 resolution CMOS IMX323 sensor, delivering sharp images and accurate color reproduction for industrial inspection and PCB repair. With 30fps high frame rate, it supports MJPEG/YUY2/H.264 compression formats. The H.264 compression of this USB camera reduces bandwidth usage by 50% for smooth live streaming (Windows software for H.264 capture is provided).
- Manual Zoom Lenses for USB Industrial Camera: Equipped with a 2.8-12mm CS mount varifocal lens, this industrial USB camera offers flexible manual zoom control—easily adjust focal length to switch between wide-angle views (for large-area inspections) and close-up precision (for tiny PCB components).
- 0.01Lux Low Light USB Camera Performance: As a professional industrial inspection camera, it adopts a 2MP 1/2.9 IMX323 Color CMOS sensor, enabling it to capture clear images even in 0.01Lux low light conditions. This low light USB camera is ideal for various dim environments in industrial applications.
- Plug-and-Play USB Camera with Wide Compatibility: This mini USB camera is plug-and-play, requiring no driver installation. With a 4pin to USB connector, it easily connects to PCs and is compatible with Linux, Windows, Android, and Mac OS. Suitable for various devices like kiosks, vending machines, and computers for video conference.
- Versatile Applications of 1080P USB Camera: The 1080P USB camera is widely used in industrial settings such as video surveillance system, industrial inspection, PCB repair, ATM monitoring, and robotic vision. It also works well for live streaming, video conference, dashcam, and applications needing gesture tracking, iris recognition, depth and motion detection, thanks to its 0.01Lux low-light sensitivity and low distortion lens.
What ATM jackpotting means
ATM jackpotting is the unauthorized manipulation of an ATM so it dispenses cash outside the normal authorization process. The machine may release money without a customer card, PIN, account debit, or valid transaction.
That makes jackpotting different from several familiar forms of ATM crime:
- Skimming steals card data or PINs so criminals can conduct fraudulent transactions.
- Cash trapping physically prevents cash from reaching the customer.
- Black-box attacks use an external device to send unauthorized commands to the cash dispenser.
- Traditional robbery or burglary involves stealing the machine or forcing open its cash compartment.
- Account takeover drains money through a customer’s bank account rather than directly manipulating the ATM’s dispenser.
In a jackpotting incident, the immediate target is often the institution’s physical cash inventory. Customers may still face outages, empty machines, reduced cash availability, or safety risks, but jackpotting does not automatically mean their card numbers, PINs, or account balances were exposed.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How the attacks work
The attack chain crosses the physical and cyber boundaries:
Physical access → malware or device manipulation → unauthorized ATM commands → cash dispense → rapid collection and concealment
Rank #2
- H.265/H.264 5MP POE IP Security mini ip Camera, POE(Power Over Ethernet),Resolution: 5MP@25fps;4MP@25Fps,3MP@30Fps
- POE Function,Power Over Ethernet,One Cable Transfer Data&Power
- Plug&Play,O-N-V-I-F,Motion Detect&Email Alert,FTP
- Remotely View By Free Mobile Phone App: XMEYE, Support smart mobile phone app,Tablet PC
At a defensive, high level, the pattern generally involves three stages:
- Access: Criminals gain access to an ATM’s maintenance compartment, internal components, storage, service ports, or a connected system. Some attacks may instead use an external device.
- Manipulation: Malicious code is placed on the ATM or introduced through a connected device or system.
- Dispensing: The malware or manipulated system communicates with the cash-dispensing functions and causes cash to be released outside the ordinary authorization flow.
Justice Department documents describe variants of the Ploutus malware family as issuing unauthorized commands to an ATM’s Cash Dispensing Module. Prosecutors have also alleged that the malware could delete evidence of its presence. These are descriptions of alleged behavior in specific cases, not proof that every jackpotting incident uses the same malware.
The FBI identifies eXtensions for Financial Services, commonly called XFS, as relevant to the threat. XFS is a software interface layer that lets ATM applications communicate with devices such as cash dispensers. It is not itself malware, and its use does not mean that every XFS deployment is vulnerable. The defensible concern is that malicious software may abuse ATM device interfaces to issue unauthorized commands.
The Justice Department’s description of the alleged deployment chain provides further context.
Why ATMs remain exposed
The available evidence does not identify a single new zero-day vulnerability responsible for the 2025 increase. Instead, the risk appears to arise from several weaknesses that can reinforce one another:
Rank #3
- Samsung by Hanwha XNB-H6241A
- Legacy operating systems and hardware that are difficult or impossible to patch.
- Physical access to maintenance compartments and service ports.
- Generic, default, widely circulated, or poorly controlled keys.
- Weak remote-management controls and shared administrator credentials.
- Unprotected removable storage and unauthorized boot paths.
- Inadequate application allowlisting.
- ATMs located in lightly supervised sites such as malls, convenience stores, and gas stations.
- Organized crews that divide reconnaissance, deployment, activation, and cash collection among different participants.
Security researchers cited by Dark Reading highlighted several of these conditions. They are useful explanations of the attack surface, but should not be treated as independently measured causes of the nationwide increase.
The governance problem is just as important as the technical problem. A bank, independent ATM deployer, processor, maintenance contractor, alarm company, and cash operator may each control part of the system. Operators should be able to identify who owns the hardware, operating system, network connection, cash, alarms, software image, and incident response.
What role did Ploutus play?
Ploutus is a family of ATM malware and variants designed to make an ATM dispense cash without a legitimate transaction. DOJ documents describe alleged deployment through direct manipulation of ATM storage or an external device, interaction with ATM device-control interfaces, and possible evidence deletion.
Ploutus activity does not necessarily imply that customer card data was stolen. Jackpotting can succeed by attacking the machine’s dispensing functions while leaving customer-account systems outside the immediate attack path.
What prosecutors allege
The Justice Department has linked a large alleged conspiracy to members and associates of Tren de Aragua. Those claims must be kept within their legal scope. Prosecutors and court documents may connect particular defendants and incidents to the alleged conspiracy, but that does not establish that the organization conducted every U.S. jackpotting incident or that all nationwide activity had the same motive.
On February 20, 2026, DOJ said six additional defendants had been charged, bringing the total to 93 charged defendants in the broader investigation described in that release. DOJ attributed more than $6 million in losses and at least $1.74 million in attempted losses to the charged conspiracy. The defendants are presumed innocent unless proven guilty.
Additional cases illustrate that the threat was not confined to one location:
- In Connecticut, prosecutors described a scheme involving more than $500,000 allegedly stolen from at least nine ATMs during August 2025. One attempted theft was reportedly prevented by a software patch, an example of why timely updates can matter even though patching alone is not a complete defense.
- Massachusetts prosecutors announced charges involving alleged attacks and attempted attacks across several New England states.
- On July 14, 2026, federal prosecutors in Nevada announced an indictment alleging approximately $76,000 in ATM theft. The allegations have not been proven, and the defendants are presumed innocent.
These cases demonstrate continuing publicly announced activity in 2026, but they do not establish a comparable national 2026 trend. The available FBI figures do not answer whether 2026 is running above or below 2025.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What ATM operators and financial institutions should do
1. Control physical access first
- Replace default or widely circulated locks and keys.
- Restrict, authorize, and log technician access.
- Inspect cabinets, service panels, storage media, ports, and seals.
- Install tamper switches and alarms that reach a staffed response function.
- Improve lighting and camera coverage at exposed locations.
- Use dual control or documented authorization for maintenance access.
2. Harden the ATM software stack
- Patch supported ATM operating systems and vendor software.
- Use secure boot and hardware-backed integrity checks where supported.
- Enforce application allowlisting.
- Disable unused ports and boot paths.
- Protect BIOS and firmware settings.
- Encrypt storage and prevent unauthorized booting from removable devices.
- Maintain tested golden images and a controlled restoration process.
Hardening may be insufficient when an ATM runs unsupported software or obsolete hardware. Replacement can provide a stronger baseline, but it brings capital costs, downtime, certification requirements, logistics, and possible processor or network changes. The practical question is whether the equipment can support current patches, secure boot, strong authentication, integrity monitoring, and reliable recovery.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →3. Secure remote administration and networks
- Eliminate shared administrator credentials.
- Require multifactor authentication for remote access.
- Apply least privilege.
- Segment ATM networks from corporate and guest networks.
- Restrict outbound connections to approved destinations.
- Use allowlisted management hosts and signed software.
- Alert on unexpected remote commands, new services, removable-media events, and abnormal restarts.
- Compare cash-dispense activity with authorized transaction records.
Network monitoring is not a substitute for physical security. An attacker who gains local access may be able to manipulate an ATM even when customer-account fraud systems see no suspicious account activity.
Best Value
- 2MP FHD Auto IR Night Vision with Wide Viewing Angle: 2MP Super HD USB camera with 24pcs IR led lights,up to 90 degree wide viewing angle,capture more clearer and sharper images and video,great fit for driveway,hallways,indoor outdoor dog pet baby security monitoring etc.
- High Speed 480P@100fps Dome Camera:Usb camera with 480P 100fps high frame rate,recording more smoothly and stable,easy setup with plug and play,free driver,waterproof camera with Aluminum box housing fit for indoor and outdoor,residential areas retail store, business. Dome camera mini webcam with wide application for use in ATM machine,kiosk,vending machine,simple security system,teaching system,interactive.
- Experience Magnificent Full-HD 1080P with CMOS OV2710 Image Sensor. This USB Webcam comes with enhanced capability utilizing the 1/2.7” CMOS OV2710 image sensor. Wide 90 degree viewing angle,Android,PC Windows,Linux,Raspeberry Pi and Mac.Waterproof and durable,it could be widely applicable to indoor/outdoors.store,home,office,school,bus,taxi in snowy/rainy/sunny days.
- Dome Camera Full HD 1080P USB Webcam:Desktop Laptop Computer Web Camera,High Speed 100fps Indoor Outdoor Security Camera,Audio IR Night Vision Web Cam,Plug&Play,Dome Webcam for Windows/Android/Mac.High speed 2 megapixel dome usb camera 640X480@100fps,Max resolution:1920X1080.
- USB 2.0/Plug&Play/Free Driver usb dome camera.This usb dome camera is plug and play,free driver,Platform Compatibility:Skype,Youtube,Yahoo!@Messenger,MSN,Zoom,instant messaging applications.We want to ensure the safety of our customers,their loved ones,homes,and businesses and you’ll receive a full 1-year US Warranty and Lifetime Support provided directly from Webcamer_usb.
4. Prepare a response plan
- Isolate the affected ATM or ATM group.
- Preserve the machine, storage media, logs, and relevant video.
- Notify the bank, processor, ATM owner, vendors, and law enforcement as appropriate.
- Check nearby machines for the same indicators.
- Reconcile dispense logs, electronic journals, alarms, video, and cash inventory.
- Rotate credentials and review remote-access systems.
- Obtain forensic images before reinstallation where appropriate.
- Validate the restored image and firmware before returning the ATM to service.
- Review why physical access, malware execution, or abnormal dispensing was not detected sooner.
The FBI advisory should be used for current indicators of compromise and reporting instructions: FBI ATM-jackpotting FLASH.
What customers should know
Jackpotting is not the same as having your debit card skimmed. In many cases, the direct loss is cash held inside the ATM rather than money taken from a customer’s account.
Customers may nevertheless experience service interruptions, empty machines, branch closures, cash restrictions, or increased security activity. If an ATM behaves unusually, appears damaged, or fails to complete a transaction, leave the area and contact the institution using an official phone number. Monitor account activity as a general precaution, but do not assume that an ATM-jackpotting report automatically means customer card data was compromised.
Free tools Windows power users keep installed
One-click scans. No signup required.
What remains unknown
The public figures establish that 2025 accounted for more than 700 of approximately 1,900 reported incidents since 2020. They do not establish:
- A complete year-by-year distribution or a precise year-over-year growth rate.
- The exact number of unique machines involved.
- The proportion involving Ploutus, other malware, or black-box methods.
- How many incidents were connected to the DOJ’s charged conspiracy.
- Whether the full number of U.S. incidents increased or decreased in 2026.
The clearest conclusion is therefore narrower than the headline: ATM jackpotting activity reported by the FBI was heavily concentrated in 2025, and the problem continued into 2026. The most effective response is layered protection—physical access control, supported software, secure administration, network restrictions, anomaly detection, and a tested recovery process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
