What Is ATM Jackpotting Scam? How Hackers Use Malware to Make ATMs Spit Out Cash

New Delhi, March 2: The Federal Bureau of Investigation has issued a fresh warning about the growing threat of “ATM jackpotting,” a cybercrime that allows hackers to force cash machines to release money on command. In an alert released on February 19, the agency informed banks and financial institutions about the sharp rise in such attacks across the United States.

According to data cited by USA Today, at least 1,900 ATM jackpotting incidents have been reported over the past six years. Alarmingly, more than 700 cases were recorded in 2025 alone, leading to losses exceeding 20 million dollars. In a recent development, a federal grand jury in Nebraska charged six individuals accused of running a large scale jackpotting scheme that allegedly stole millions from ATMs nationwide. What Is AI-Based Biometric Scam? Hyderabad Police Issue Urgent Advisory as Cybercriminals Target Facial and Voice Data for Deepfake Identity Theft.

What Is ATM Jackpotting?

ATM jackpotting is a form of cyberattack in which criminals install malware inside an ATM machine to take control of its cash dispensing system. Instead of hacking individual bank accounts, the attackers target the machine itself. Once compromised, the ATM can be instructed to release cash without requiring a card, PIN, or bank authorization. What Is ‘Scam-Yourself’ Attacks? Scammers Find New Ways To Trick Users Through ‘Social Engineering’ Techniques; How To Spot Such Threats and Stay Safe.

How Does the Scam Work?

Hackers typically use malware such as Ploutus to infect ATM software. This malicious program overrides the system that normally communicates with the bank to approve transactions. By bypassing this authorization process, criminals can send their own commands directly to the machine.

In many cases, the attack requires physical access. Criminals open the ATM cabinet and remove its hard drive. They then connect it to a separate computer, install the malware, and place it back into the machine. Another method involves replacing the original hard drive with a pre infected one before restarting the ATM. Once rebooted, the compromised machine responds to secret commands and dispenses cash on demand.

Warning Signs of an Infected ATM

Banks are being advised to closely monitor their machines for unusual activity. Suspicious files such as Newage.exe or WinMonitor.exe appearing in the system may indicate malware infection. Other red flags include unfamiliar data files like C.dat or Logcontrol.txt, unexpected folders within system directories, or logs showing unauthorized USB connections.

Physical alerts can also signal trouble. Notifications showing ATM doors being opened outside scheduled maintenance hours or hard drives being removed without authorization are serious warning signs that should not be ignored.

How to Report ATM Jackpotting

The FBI urges banks and individuals to report suspicious ATM activity immediately to their local FBI field office or through the Internet Crime Complaint Center, commonly known as IC3. Detailed reports should include the ATM’s location, model, vendor information, bank details, and relevant system logs to assist investigators.

With cases rising sharply in 2025, ATM jackpotting has emerged as a major cybersecurity concern in the US. Financial institutions are being encouraged to strengthen physical security measures, update software systems regularly, and remain vigilant against signs of tampering.

(The above story first appeared on LatestLY on Mar 02, 2026 08:42 PM IST. For more news and updates on politics, world, sports, entertainment and lifestyle, log on to our website latestly.com).