jackpotting

Jackpotting is a term used to describe a class of attacks against automated teller machines (ATMs) in which criminals cause the machine to dispense cash outside of legitimate customer transactions. These attacks typically combine elements of malware infection, hardware or software tampering, and social engineering to control the ATM’s cash dispenser and transaction flow.

Common approaches involve gaining access to the ATM’s internal components or software, enabling an attacker to issue unauthorized withdrawal commands. Some techniques rely on malware designed to inhabit the ATM’s operating environment and manipulate its cash-handling functions, while others exploit weaknesses in interfaces or network connections. Notable malware families associated with jackpotting include Ploutus, Cutlet, Skimer, and Tyupkin, which have been observed in various regions and timelines since the early 2010s. Attacks may be carried out by physical access to the machine, remote control after compromising the ATM’s software, or a combination of both.

Impact can be substantial, including direct financial losses for banks and service disruptions for customers, as well as increased security costs and reputational damage. Preventive measures emphasize defense in depth: secure software configurations, regular software updates and patching, disabling unnecessary external interfaces, tamper-evident seals, robust physical security, network segmentation, and continuous monitoring for abnormal withdrawal patterns or device behavior. Incident response plans and collaboration with law enforcement are critical for detection, attribution, and recovery.

Legal status for perpetrators is criminal in most jurisdictions, reflecting the broader category of financial crime and cybercrime.