ATM Jackpotting: What It Is and How You’re Protected
The short version
- Jackpotting is when criminals take control of an ATM and make it pay out its cash without a card or account.
- They do it with malware, or with a “black box” device wired straight to the cash dispenser.
- Both attacks need someone to get inside the ATM. Signed software and an encrypted link to the dispenser are built to stop them.
- Your best defence on site: never let anyone open the ATM unless Dash has told you to expect them.
What jackpotting is
Jackpotting is a type of attack where criminals force an ATM to spit out cash, like a poker machine paying a jackpot. No card, no customer account and no bank approval are involved. The cash simply comes out of the ATM.
It’s a real and growing problem overseas. In February 2026 the FBI said it had received reports of 1,900 jackpotting incidents in the US since 2020. More than 700 of those happened in 2025, with losses of more than US$20 million. Europol has supported arrests across Europe, including a case in Poland.
US jackpotting incidents reported to the FBI since 2020
Incidents in 2025 alone
Losses in 2025
How the attacks work
Malware
Criminals load malicious software onto the ATM’s computer. The FBI says the malware family most often seen, called Ploutus, can make an ATM dispense cash without a card, an account or bank authorisation. To install it, attackers have removed or replaced the ATM’s hard drive and then restarted the machine.
Black box
A black box is a device that criminals wire directly to the cash dispenser. It sends the dispenser its own commands to pay out. Europol describes criminals connecting electronic devices to a cash machine and remotely forcing it to spew out all its cash.
Getting inside
Both methods need access to the inside of the ATM. The US Secret Service warned in 2018 that crews were posing as ATM technicians to get that access. The FBI’s 2026 advisory says attackers have opened ATMs with generic or easily obtained keys.
How your ATM is protected
Only signed software runs
Triton, which makes most of the ATMs Dash runs, requires any software load on a Triton ATM to be digitally signed by Triton using its private key. Malware isn’t signed by Triton, so the ATM won’t run it. Triton made all code on its ATMs require a signature after a researcher showed a jackpotting attack in 2010.
An encrypted link to the cash dispenser
Triton’s Advanced Security Module creates a unique encrypted connection between the ATM’s main computer and its cash dispenser. Setting up that link needs master user credentials and access to the ATM’s vault. A black box wired to the dispenser can’t simply take over, because the dispenser only responds to the ATM it is paired with.
Every Dash Argo ATM has the Advanced Security Module fitted and enabled.
Encrypted PINs and messages
The PIN pad in a modern ATM is an encrypting PIN pad, built to the PCI PIN Transaction Security (PTS) standard. It encrypts the PIN the moment it’s entered. Triton also lists message authentication (MACing), SSL/TLS and a firewall among its ATMs’ security features, to protect messages between the ATM and the bank network.
Up-to-date software
Security fixes only work once they are installed. Dash pushes updates to your ATM remotely. Read more in Keep your ATM’s software up to date.
What your venue can do
- Never let anyone open the ATM unless Dash has told you to expect them. Ask for ID, then call us on 1300 125 592 to check before they start.
- Keep ATM keys locked away and limit who has them.
- Look out for damage to the ATM’s top or front, loose panels, or cables that shouldn’t be there.
- Tell us straight away if someone tampers with the ATM. If a crime is happening now, call 000.
- Don’t buy an older ATM that lacks these countermeasures. A cheap second-hand machine without signed software, an encrypted dispenser link and current security updates is the easy target. Buy one with the most up-to-date security features.
How Dash protects your ATM
- Genuine Triton software, digitally signed so malware won’t load.
- Encryption on the PIN pad and on messages to the bank network.
- Remote updates, so security fixes reach your ATM without a site visit.
- Managed for you: installation, cash logistics, fault alerts, reconciliation and national field service, all visible in the Dash web portal.
See the options to buy an ATM, or how we manage ATM networks.
FAQ
Has jackpotting happened in Australia?
The best-documented recent cases are in the US and Europe. Criminal methods spread, so it pays to be careful about who gets access to your ATM.
Is an older or second-hand ATM a risk?
Yes, if it lacks the countermeasures. We recommend you don’t buy an older ATM without signed software, an encrypted link to the dispenser and the most up-to-date security features.
Can someone jackpot an ATM from the outside?
The attacks described by the FBI and Europol need access to the inside of the ATM, either to load malware or to wire in a device.
Someone says they’re here to service the ATM. What do I do?
If Dash hasn’t told you to expect them, don’t let them open the ATM. Ask for ID and call Dash on 1300 125 592 to check.
Dash ATM has built and managed ATM networks across Australia since 2012, led by founder Paul Wrigley, in the ATM industry since 2002. Keep cash local.
Sources: FBI FLASH-20260219-001: ATM jackpotting · Europol: Arrests in Poland over ATM jackpotting attacks · Europol: 27 arrested over ATM black box attacks · Krebs on Security: First jackpotting attacks hit US ATMs (2018) · ATMIA: Triton security and Windows · ATMIA: Triton Systems showroom · Dark Reading: ATMs at risk (2010) · PCI SSC: PTS Point of Interaction