top of page

Ask a Question

ATM Jackpotting and Physical Security: Why Banks Need a Layered Approach to ATM Protection

3 hours ago
8 min read
ATM Jackpotting and Physical Security: Why Banks Need a Layered Approach to ATM Protection video thumbnail

ATM security is receiving increased federal attention as financial institutions face threats ranging from physical robbery and tampering to malware enabled ATM jackpotting attacks.

Recent federal actions highlight the growing scope of these threats. The U.S. Senate passed the Safe Access to Cash Act of 2026, legislation intended to strengthen federal prosecution of crimes involving ATMs. The U.S. Department of the Treasury also announced sanctions against a financial network accused of using ATM jackpotting attacks to steal millions of dollars from U.S. financial institutions.


Together, these developments highlight a larger challenge for banks, credit unions and ATM operators: ATM security can no longer be viewed as solely a physical security issue or a cybersecurity issue.


Modern attacks can cross both.


What Is the Safe Access to Cash Act?


The Safe Access to Cash Act addresses crimes committed against ATMs, the people using them and the people responsible for servicing them.


Existing federal bank robbery law was created long before ATMs became widely distributed across convenience stores, retail environments and other locations away from traditional bank branches.


The legislation passed by the Senate would establish federal criminal offenses involving ATMs regardless of whether the machine is physically located at a financial institution. The bill covers crimes including robbery or attempted robbery of people using or servicing an ATM, as well as certain theft, damage and tampering involving the machines themselves.

The legislation reflects a broader reality facing financial institutions: the ATM has effectively extended banking infrastructure beyond the traditional branch.


Protecting that infrastructure requires security strategies capable of addressing what happens around the ATM, who has access to surrounding environments and what happens when someone attempts to physically manipulate the machine.


ATM Jackpotting


According to the U.S. Treasury, a typical jackpotting attack can begin with criminals surveying potential ATM targets. Attackers may then physically break into the ATM and install malware. Once activated, that malware can bypass security controls and allow criminals to issue commands telling the machine to dispense its cash.


This distinction is important.


ATM jackpotting may involve a cyberattack, but the attack can begin with physical access to the machine.


That makes the boundary between physical security and cybersecurity increasingly difficult to separate.


Federal authorities have reported millions of dollars in losses associated with ATM jackpotting attacks in the United States, demonstrating how physical access to self service banking equipment can potentially become an entry point for a much larger security incident.


ATM Threats Extend Beyond Jackpotting


Jackpotting represents only one part of the ATM security landscape.


Financial institutions also need to consider threats including skimming, shimming, ATM burglary, cash trapping, physical tampering and robberies involving customers and ATM support staff.


Each attack works differently.


ATM jackpotting can involve gaining physical access to a machine and installing malware or unauthorized equipment capable of controlling its cash dispensing function.


ATM skimming involves capturing payment card information, traditionally through unauthorized equipment installed around the card reader.


ATM shimming uses devices inserted into a card reader to intercept or manipulate communication involving chip enabled cards.


Physical ATM attacks can involve attempts to break into, damage or remove a machine to reach the cash stored inside.


ATM robberies can target customers withdrawing cash as well as technicians responsible for servicing or replenishing machines.


The diversity of these threats creates an important challenge for financial institutions.


Why Layered ATM Security Matters


A stronger ATM security strategy starts by recognizing that different technologies address different points of vulnerability.


For financial institutions, this means evaluating the complete physical environment surrounding it.


Control Access to ATM and ITM Environments


For ATMs and ITMs located within enclosed vestibules, financial credential only controlled access can provide an additional security layer between the public environment and the self-service banking area.


Access control systems can be configured to manage entry according to a financial institution’s operational and security requirements while providing event information that can support centralized monitoring and investigation.


Financial institutions should also consider how access control infrastructure communicates, how events are recorded and how the system integrates with the broader security environment.


Detect Unusual Presence


Understanding that someone entered an ATM vestibule does not necessarily tell a security team what happens after entry.


Presence detection can provide another layer of information by identifying occupancy within monitored spaces.


When incorporated into a broader security strategy, presence information can help financial institutions identify extended occupancy or activity within ATM environments and provide additional context to security personnel.


Protect Against Card Reader Tampering


ATM fraud also often times begins at the card reader.


Skimming detection technologies help financial institutions protect the point where customers interact with the ATM, while tamper detection can provide additional awareness when someone attempts to interfere with protected equipment.


As criminal techniques change, financial institutions should continually evaluate how their existing card reader protection addresses emerging skimming and shimming methods.


Improve ATM Surveillance Visibility


Video surveillance remains an important component of ATM security, but simply having a camera nearby does not guarantee useful video.


Camera position, viewing angle, lighting, obstruction and physical protection all affect the quality of surveillance coverage.


Discreet rugged camera housings provide optimized visibility in and around ATM, vestibule and branch entrance and exit environments. Capturing a visual of the top of a nefarious persons head won’t help law enforcement find the perpetrator, but a carefully positioned doorway camera will. Parabit’s Camera Housings provides the answer to this problem.


Monitor the Physical Environment


Security teams can also benefit from monitoring conditions surrounding an ATM or vestibule.

Changes involving lighting, equipment status, physical tampering or other environmental conditions can provide useful information when combined with access control, surveillance and facility monitoring sensor events.


The goal is greater situational awareness across the complete self-service banking environment.


Connecting Physical ATM Security and Cybersecurity


Recent jackpotting activity provides an important lesson for financial institutions.

A cyberattack does not always begin in cyberspace.


If an attacker needs to survey an ATM, gain physical access to its internal components and install unauthorized equipment or malware before controlling the machine, physical security becomes part of the cybersecurity strategy.


This is why security events should not always remain isolated within individual systems.

An unusual access event, extended presence, physical tampering, unexpected activity or low lighting around an ATM could become more meaningful when correlated with information from other security systems.


Connecting those signals can give security teams more context when investigating abnormal activity.


Building a More Complete ATM Security Strategy


Recent federal attention surrounding ATM crime and jackpotting demonstrates the range of threats facing today’s ATM infrastructure.


But legislation, sanctions and law enforcement action address only part of the problem.

Financial institutions still need to determine how they will protect their ATM and ITM environments every day.


That starts with evaluating the complete environment rather than relying on one security measure.


Where is the ATM located?


Who can access the ATM vestibules and surrounding area?


Can unusual presence be detected?


Are attempts to manipulate the card reader identified?


Does a camera(s) positioned with a horizontal field of view provide a useful record of an unwanted visitor?


Can physical tampering generate an actionable event?


Can security teams correlate events across access control, surveillance, sensors and other systems?


Can I receive real time notifications when lighting conditions are unsafe in and around my ATM/ITM environments?


These questions can help financial institutions identify vulnerabilities that may be missed when ATM security is evaluated one product at a time.


A Layered Approach to ATM and ITM Security


Parabit has been working with banks and financial institutions for over 30 years strengthening physical security and providing remote situational awareness across ATM, ITM and self-service banking environments.


Parabit solutions can support a layered security strategy through access control, ATM and ITM vestibule management, skimming detection technology, human presence and low light detection, discreet surveillance infrastructure, remote environmental monitoring and PSIM integration.


As ATM threats continue to combine physical access, fraud techniques and cyberattack methods, financial institutions need infrastructure capable of providing greater visibility into what is happening around their self-service banking environments.


View Parabit's Access Control Solutions here.


Reach out to the Parabit team here.



Works Cited




Frequently Asked Questions About ATM Jackpotting and Layered ATM Security

1. What is ATM jackpotting and how does it work?

ATM jackpotting is a type of attack in which criminals manipulate an ATM to dispense cash without an authorized transaction. Attackers may gain physical access to the machine and install malware or unauthorized hardware that interferes with its cash dispensing functions. These attacks demonstrate how physical security vulnerabilities can create opportunities for cybercrime.

Banks and credit unions can reduce ATM jackpotting risks through a layered security strategy that combines physical access protection, tamper detection, surveillance, ATM software security, and continuous monitoring. Protecting internal components, restricting unauthorized maintenance access, monitoring suspicious activity, and identifying potential security breaches can help financial institutions strengthen ATM protection.

Some ATM cyberattacks begin when criminals physically access a machine to install malware or connect unauthorized devices. Physical security measures such as tamper detection, surveillance, access restrictions, and environmental monitoring can help identify suspicious activity before or during an attack. Integrating physical security events with cybersecurity monitoring can provide additional context for investigating potential threats.

Layered ATM security combines multiple protective technologies to address different vulnerabilities across an ATM or ITM environment. These may include vestibule access control, skimming detection, tamper monitoring, human presence detection, surveillance, environmental sensors, and cybersecurity protections. Each layer addresses a different risk, helping financial institutions improve situational awareness and reduce dependence on any single security measure.

ATM jackpotting involves manipulating an ATM's hardware or software to dispense cash without authorization. ATM skimming uses unauthorized equipment to capture payment card information, while ATM shimming involves devices inserted into chip card readers to intercept communication with payment cards. These attacks exploit different vulnerabilities and require different protective measures, including device security, card reader protection, physical surveillance, and fraud monitoring.

ATM vestibule access control helps financial institutions manage entry into enclosed self service banking environments. Systems can restrict entry according to configured financial credential requirements, record access events, and support centralized monitoring. When combined with human presence detection, surveillance, and other security technologies, vestibule access control can provide additional information about activity within ATM and ITM environments.

Banks can use surveillance cameras, tamper detection, human presence sensors, and environmental monitoring to identify unusual activity around ATMs and ITMs. Extended vestibule occupancy, unauthorized equipment access, changes in lighting, and unexpected security events may warrant investigation. Correlating information across access control, surveillance, and monitoring systems can help security teams evaluate potential threats and respond more effectively.

Parabit Systems provides physical security infrastructure for banks, credit unions, and ATM operators, including ATM and ITM vestibule access control, skimming detection, human presence monitoring, low light detection, surveillance camera housings, and remote environmental monitoring. Parabit's solutions support layered security strategies that improve visibility into activity surrounding self service banking environments and can integrate with broader security monitoring systems. Learn more about Parabit's Access Control Solutions or contact Parabit to discuss ATM and ITM security requirements.


bottom of page