FBI reports 1,900 ATM Jackpotting incidents since 2020

The United States Federal Bureau of Investigation (FBI) has warned of an increase in ATM jackpotting incidents across the country, leading to losses of more than $20 million in 2025.

See also: USA: 54 people charged in ATM Jackpotting scam

The agency reported 1,900 ATM jackpotting incidents since 2020, with 700 of those occurring last year. In December 2025, the U.S. Department of Justice (DoJ) said that approximately $40.73 million has been lost to jackpotting attacks since 2021.

“Threat actors are exploiting physical and software vulnerabilities in ATMs and developing malware to dispense cash without a legitimate transaction,” said in a statement Thursday.

Jackpotting attacks involve the use of specialized malware, such as Ploutus, to infect ATMs and force them to dispense cash. Cybercriminals typically gain unauthorized access to the machines by opening the ATM face with widely available master keys.

There are at least two methods for deploying the malware: removing the ATM hard drive, connecting it to a computer to copy the data, and then reconnecting it to the ATM and rebooting, or completely replacing it with a foreign hard drive preloaded with the malware.

See also: FTC: Over $110 million lost in Bitcoin ATM scams in 2023

Regardless of the method, the malware interacts directly with the ATM hardware, bypassing any security checks in the original ATM software.

Since the malware does not require a connection to a bank card or customer account to issue cash, it can be used against ATMs from different manufacturers with minimal changes to the code, exploiting the underlying Windows operating system.

Ploutus was first observed in Mexico in 2013. Once installed, it gives threat actors complete control over an ATM, allowing them to trigger cash-outs that can occur in minutes and are difficult to detect until the money is withdrawn.

See also: Byte Federal: Data breach affects 58,000 customers

The agency has outlined several recommendations for organizations to mitigate jackpotting risks, including strengthening physical security with threat sensors, installing security cameras, and changing standard locks on ATMs. Other measures include inspecting ATMs, changing default credentials, configuring an automatic shutdown feature when tampering indicators are detected, enforcing a whitelist to prevent unauthorized connections, and maintaining logs.