Breaking News
‘ATM jackpotting’ leads FBI to issue warning. Here’s what to know.
The FBI is warning about an increase in cybercrimes that allow thieves to dispense money from automatic teller machines remotely.
The act, called “ATM jackpotting” by the FBI, occurs when thieves use malware to make the machines dispense money whenever they want.
The FBI issued an alert on Thursday, Feb. 19, to let financial institutions know about the recent uptick in jackpotting, noting that there have been at least 1,900 “ATM jackpotting” incidents reported over the past six years.
“Out of 1,900 ATM jackpotting incidents reported since 2020, over 700 of them with more than $20 million in losses occurred in 2025 alone,” the FBI wrote in the alert.
Just last week, a federal grand jury in the District of Nebraska charged six people for their alleged roles in an “ATM jackpotting” scheme. According to the U.S. Department of Justice, the defendants deployed malware to “steal millions of dollars from ATMs in the United States.”
They were charged with conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, bank fraud, bank burglary, and damage to computers.
Here’s what the FBI had to say in its latest alert about “ATM jackpotting”, and what financial institutions should look out for.
Banking news: Tired of your bank? Here’s why Americans are ‘soft switching’
How does ‘ATM jackpotting’ work?
The FBI said in its alert that those involved use malware, such as the Ploutus family malware, to infect ATMs, which then dispense cash. According to the FBI, the malware infects software that tells the ATM what to do physically.
When an ATM is functioning normally, ATM applications send instructions through the software for bank authorization. If criminals can send their own commands to the software, they can bypass bank authorization and tell the ATM to dispense cash, the FBI said.
Essentially, the software allows criminals to dispense cash from ATMs with no bank card, customer account, or bank authorization, the FBI said.
“It gives (thieves) direct control over the machine,” the FBI wrote in its notice, adding that the malware attacked the ATM itself, and not customer accounts.
According to the FBI, the thieves have found multiple ways of installing malware on ATMs, including:
Removing the machine’s hard drive, connecting it to their computer, copying the malware to the hard drive, returning the hard drive to the ATM, and then rebooting the ATM.
Removing the ATM’s hard drive, replacing it with a foreign hard drive or other external device with preloaded malware, and rebooting the ATM.
Money comes out of an automated teller machine (ATM).
How do banks and credit unions know their ATMs have been infected?
The FBI said in its alert that based on previous ATM attacks the agency has investigated, there are warning signs banks and credit unions can look for in order to spot infected machines.
Digital and physical signs of tampering include:
Executable files not expected on the hard drive, such as Newage.exe, Color.exe, and WinMonitor.exe.
Associated files and scripts like C.dat, Restaurar.bat, and Logcontrol.txt.
New directories such as C:\Users\SSAuto1\AppData\Local\P\.
USB insertion events and security log records showing newly-connected external devices.
Alerts about ATM doors being open outside of planned maintenance, or alerts about the removal of hard drives from ATMs.
What to do if you need to report ‘ATM jackpotting’
The FBI said those who need to report suspicious or criminal activity can report the situations to their local FBI field offices at www.fbi.gov/contact-us/field-offices, or the FBI Internet Crime Complaint Center at www.ic3.gov.
Those reporting jackpotting must provide the bank name, branch, location, and contact information, as well as the ATM manufacturer make and model, vendor name and contact information, and available logging.
Saleen Martin is a reporter on USA TODAY’s NOW team. She is from Norfolk, Virginia – the 757. Email her at sdmartin@usatoday.com.
This article originally appeared on USA TODAY: ‘ATM jackpotting’ is increasing, the FBI warns. Here’s what to know.