In a Feb. 19 alert,incidents the FBI said it has seen a sharp uptick in “ATM jackpotting,” a method that uses malware to force a cash machine to dispense money without a legitimate transaction. Out of 1,900 ATM jackpotting incident reported since 2020, the FBI said 700 of them with more than $20 million in losses occurred in 2025 alone.
Most recently, a federal grand jury in Nebraskareturned indictments against six people for their role in jackpotting schemes. The six suspects joined 87 others already linked to the crimes and now face charges of conspiracy to commit bank fraud, conspiracy to commit bank burglary, computer and bank fraud, bank burglary and damage to computers.
How ATM jackpotting works
Criminals use malware to infect the ATMs and force them to dispense cash, bypassing bank authorization and without a card or account.
According to the FBI, the criminals remove the ATM’s hard drive, connect it to their computer, copy malware to the hard drive and return it to the ATM. Other times, the criminals remove the ATMs hardrive and replace it with another one that’s already infected with malware.
Once the malware is installed, the criminal is able to bypass electronic communications or security of the original ATM software and withdraw cash.
The FBI memo notes a list of extensions associated with ATM Jackpotting and advises banks and financial institutions to closely monitor their systems. It also said banks should be vigilant for the detection of external USB keyboards or hubs and flash drives.
Other signs of ATM jackpotting are door alerts or low cash indicators at unexpected times or an ATM that’s unexpectedly out of service, the FBI said.
Banks that suspect ATM jackpotting are urged to contact the FBI.
© 2026 Advance Local Media LLC. Distributed by Tribune Content Agency, LLC.
