ATM Fraud Prevention: How to Detect and Stop ATM Fraud

Last updated: October 15, 2026

ATM fraud prevention combines physical security, software controls and video surveillance to stop skimming, cash trapping, jackpotting malware and physical attacks on ATMs. The FBI recommends changing standard ATM locks, adding tamper sensors and alarms, auditing for unauthorized USB devices, and making sure security cameras cover the machine and preserve footage. Live video monitoring adds people who can spot tampering and respond while it’s happening.

Key Takeaways

• The FBI counted about 1,900 ATM jackpotting incidents since 2020, over 700 of them in 2025, with more than $20 million in losses.
• Most jackpotting starts with physical access: criminals open the ATM face with widely available generic keys.
• Early warning signs include door-open alerts outside maintenance, unexpected low cash and unknown devices plugged in.
• A complete ATM security system layers locks, sensors, alarms, software controls and cameras.
• Footage only helps if cameras cover the right angles and the recordings are kept.

ATM Fraud Prevention: How to Detect and Stop ATM Fraud

ATM fraud is changing fast. In February 2026, the FBI warned that malware-driven “jackpotting” is rising across the U.S.: out of 1,900 incidents reported since 2020, more than 700 happened in 2025, with over $20 million in losses, according to its FLASH alert. Skimming, cash trapping and physical attacks haven’t gone away either.

Good ATM fraud prevention isn’t one tool. It’s layers: physical security, software controls, and video that both deters criminals and records what happened. This guide covers the main types of ATM fraud, how to detect them, and what an ATM security system should include. If you’re reviewing security for your own machines, contact for inquiry and we’ll talk it through.

Common Types of ATM Fraud

• Skimming: a fake card reader or overlay fitted over the real slot captures card data, often paired with a hidden camera or fake keypad to record PINs.
• Shimming: a thin device slipped inside the card slot to capture chip card data.
• Cash trapping: a device blocks dispensed cash so the customer leaves, then the criminal returns to collect it.
• Jackpotting: malware forces the machine to dispense cash with no card or account involved.
• Physical attacks: prying, burglary or removing the machine. The FBI’s Bank Crime Statistics recorded ATMs as the area involved in 124 robberies, burglaries and larcenies at federally insured institutions in 2023.

How Jackpotting Malware Works, and Why Security Footage Matters

According to the FBI alert, attackers most often gain access by opening the ATM face with widely available generic keys. They then remove the hard drive and load malware such as Ploutus, swap in a drive with malware preloaded, or connect an external device, and reboot the machine. Ploutus works through the ATM’s XFS software layer, the part that tells the machine what to physically do, so it can dispense cash without a card, customer account or bank authorization. Because it targets the Windows operating system many ATMs run, it works across different manufacturers.

The physical step is the weak point for criminals. Someone has to stand at the machine with the front panel open, often for several minutes. That’s why the FBI lists security cameras among its mitigations, and recommends making sure cameras “cover necessary areas and preserve security footage recordings in the event of an incident.”

ATM Fraud Detection: Signs to Watch For

The FBI lists physical indicators that an ATM may be compromised:

• Door-open alerts outside the planned maintenance schedule
• Low or no cash readings outside normal use
• Unauthorized devices plugged into the ATM
• A removed hard drive
• An ATM unexpectedly out of service

On camera, the warning signs are behavioral: someone lingering at the machine without a transaction, returning repeatedly, working on the card slot or fascia, opening the top panel, or blocking the camera with a hand, hood or object. Software controls matter too. The FBI recommends auditing for removable storage, controlled file access and new processes, and checking each ATM against a verified “gold image” of approved software.

ATM Video Surveillance: Where Cameras Should Point

ATM video surveillance works best with several views, not just the camera built into the machine:

1. The user’s face, from the ATM’s built-in camera.
2. The fascia and card slot, to catch anyone fitting a skimmer or cash trap.
3. The service panel and top of the machine, where jackpotting starts.
4. The approach and vestibule, including anyone waiting nearby.
5. The parking lot or drive-up lane, for vehicles and plates.

Footage is only useful if it’s clear at night and kept long enough. Our guide to bank surveillance cameras covers camera types and placement across the branch.

What an ATM Security System Should Include

Based on the FBI’s recommended mitigations, a complete ATM machine security system layers:

• Tamper sensors on the machine and vestibule (vibration, temperature change and similar) that alert security staff.
• Non-standard locks, replacing the factory locks that criminals can buy online.
• Alarm keypads that trigger if the maintenance hatch opens without a code.
• Physical barriers around the machine and its service areas.
• Automatic shutdown when a set combination of compromise indicators appears.
• Cameras that cover the machine and keep footage.

ITM Fraud Prevention

Interactive teller machines (ITMs) add a live video connection to a remote teller, but the hardware underneath faces the same attacks as a standard ATM. ITM fraud prevention uses the same layers, plus clear procedures for verifying a customer’s identity during the video session and keeping session records.

What to Do If You Suspect ATM Fraud

1. Take the machine out of service and keep people away from it until it’s checked.
2. Don’t remove anything yourself. A skimmer, cash trap or foreign device is evidence.
3. Preserve the footage from every camera covering the machine, before it’s overwritten.
4. Report it. The FBI asks for jackpotting and suspicious ATM activity to be reported to a local FBI field office or the Internet Crime Complaint Center (IC3), along with the bank, branch, ATM make and model, and vendor.
5. Train staff to recognize the signs above. The FBI notes that training employees on jackpotting leads to better reporting and quicker responses.

Where Live Monitoring Fits

Most of these layers alert you after something happens. Live monitoring adds someone watching while it happens. With live video monitoring, trained operators watch ATM and vestibule cameras in real time. When someone lingers at a machine after hours or opens a panel, an operator can warn them through on-site speakers and call police with a description. Every event is logged with a time stamp and video clip, the kind of record the FBI recommends preserving. Our bank surveillance system page and bank security guide cover the rest of the branch.

Protect Your ATMs With Monitex Security

Monitex Security’s trained operators watch your ATM, vestibule and branch cameras live, every hour of the day:

• Eyes on the machine. Operators watch for tampering, lingering and panel access at ATMs and vestibules.
• A voice on site. Speakers let operators warn people at the machine before they finish.
• A record of every event. Each incident is logged with a time stamp and video clip.
• Your cameras first. We connect the cameras you already have and point out gaps in coverage.

Whether you run a single off-site ATM or machines across many branches, contact for inquiry and we’ll walk through your locations with you.