The U.S. Federal Bureau of Investigation (FBI) has issued a stark warning about a dramatic rise in so‑called ATM jackpotting attacks, a cyber‑enabled theft technique that has cost financial institutions over $20 million in losses in 2025 alone and resulted in more than 1,900 incidents reported since 2020.
In its FLASH advisory released in February 2026, the FBI explained that criminals are increasingly targeting automated teller machines (ATMs) with sophisticated methods that force the machines to dispense cash on command without any legitimate transaction or access to a bank account. Unlike traditional ATM fraud that steals individual customer data, jackpotting attacks hit the machines themselves and drain the physical cash stored inside.
How Jackpotting Works
The attack begins with a physical breach of the ATM. Criminals often use generic keys readily available online to open the maintenance panel of a machine. Once inside, they either:
- Remove the ATM’s hard drive and install malware directly, or
- Replace the original drive with one already preloaded with malicious software.
The malware, most commonly from the Ploutus family, targets the ATM’s software layer called eXtensions for Financial Services (XFS). XFS is a standard used by many ATM manufacturers that tells the hardware how to operate during a standard transaction.
By exploiting XFS, attackers bypass bank authorisation entirely and issue their own instructions to the machine. This lets them trigger the cash‑dispensing unit directly, essentially turning the ATM into a cash “slot machine” that spits out bills on demand.
Because these attacks do not involve customers’ card information or banking credentials, personal accounts remain intact. However, the financial burden falls on banks, which can ultimately pass costs on to consumers through fees or tighter withdrawal limits.
What the FBI Is Urging Financial Institutions
The FBI’s advisory includes technical indicators of compromise (IOCs) and steps ATM operators should take to make jackpotting attacks harder to execute. These suggestions include:
- Enhancing physical security by replacing default locks and installing tamper sensors.
- Installing surveillance cameras with clear visibility of ATM access points.
- Using firmware integrity tools, disk encryption, and device whitelisting to block unauthorized code.
- Monitoring unusual activity such as unauthorized USB connections or unexpected door openings.
Banks are also encouraged to segment ATM networks, update outdated operating systems, and conduct regular security audits to prevent intrusions. Many ATMs still run older versions of Windows systems that are easier to exploit, making updates a high priority.
How Consumers Can Stay Safe
While jackpotting attacks primarily target banks and ATM operators, consumers can still take steps to lower their risk and avoid unsafe machines:
1. Choose ATMs Carefully
Use ATMs located inside bank branches or well‑lit public spaces. Machines in isolated areas are more likely to be tampered with, as criminals can work undisturbed.
2. Inspect the Machine Before Use
Look for loose panels, foreign devices, or unusual wires around the card slot or keypad. If something looks out of place, don’t use the ATM and report it to the bank immediately.
3. Watch for Red Flags
Warning signs of tampering may include unexpected “out of service” messages, low‑cash notifications that don’t make sense, or alerts that the machine was opened outside of maintenance hours.
4. Set Alerts and Monitor Accounts
Even though jackpotting doesn’t directly access account data, it’s smart to enable real‑time transaction alerts and review account activity regularly in case of other types of ATM fraud.
5. Limit Daily Cash Withdrawals
Setting lower daily withdrawal limits on your card can reduce potential losses if other ATM scams occur.
Why This Matters
ATM jackpotting is a growing threat precisely because it blends physical security weaknesses with digital malware attacks. The FBI’s alert highlights how criminal groups can rapidly adapt old attack methods using new tools, making vigilance essential on all fronts — from the vault to the street. While most people tend to avoid cash in their daily use, ATMs are more often left unattended. The threat of jackpotting adds to the list of growing fraud risks along with crypto ATM scams.
With more than $20 million lost last year and hundreds of cases continuing to be reported, both banks and consumers must work together to strengthen defences and reduce opportunities for such theft.
