SECURITY ESSEN 2026 | LIVE SHOW
B
ANKS HAVE SPENT YEARS HARDENING ATMS AGAINST CARD SKIMMERS AND SHIMMERS, BUT ARGUABLY THE THREAT DRAWING
THE MOST ALARM FROM REGULATORS AND SECURITY AGENCIES RIGHT NOW IS JACKPOTTING‚ A MALWARE-DRIVEN ATTACK THAT FORCES MACHINES TO SPIT OUT CASH ON COMMAND, WITH NO CUSTOMER ACCOUNT EVER TOUCHED.
Unlike traditional fraud, which targets a customer’s card
or account, it’s the machine itself that is attacked. Criminals gain physical access, often by drilling into the top box or via a service panel. From there they can either install malware directly on to the machine’s operating system or connect a “black box,” that sends commands straight to the cash dispenser. In more advanced cases, attackers spoof the response
from the bank’s authorisation host, tricking the ATM into believing a legitimate transaction has approved an unlimited withdrawal. General industry estimates put global losses from all
ATM-related fraud at just over €2 billion per year which may give an illustration of how big a problem this is. The fi rst public warnings of jackpotting came
from European and Asian banks in around 2010 when cybercriminals discovered they could trick ATMs into dispensing money. The US remained largely untouched until 2018, when the FBI confi rmed the fi rst domestic cases.
Since then, the Bureau has fl agged a sharp rise in these
malware-enabled jackpotting incidents and the Secret Service has issued separate warnings about a related technique known as direct memory access (DMA) attacks, where criminals physically tap into the ATM’s internal hardware to bypass authentication entirely. The rise is attributed to the fact that several factors are
converging to make it more attractive to criminals. Apart from ageing hardware running outdated operating systems with unpatched vulnerabilities, physical access remains relatively easy and pay-outs are quick and high-value. A single attack can net tens of thousands
of euros in minutes. Security researchers are also tracking a rise in so-called
Cash Trapping devices that physically block dispensed bills so a criminal can retrieve them after the customer leaves and host spoofi ng and relay attacks, intercepting or faking communications between the ATM and the bank’s authorisation systems. But while jackpotting in the US and Asia tends to be
software-driven, European gangs have largely favoured a more literal approach: blowing the machines open. Germany has become the epicentre, with organised crime groups packing ATMs with solid explosives, often made from fi reworks and detonating them to grab the cash. The scale has been signifi cant. Eurojust and Europol dismantled an organised crime group in April tied to roughly ten bombings across Germany and Switzerland after
WWW.SECURITY-ESSEN.DE
| 47
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52
