FBI Warns of Rising U.S. ATM Jackpotting, Citing More Than $20 Million in Losses
Summary
The FBI reports more than 1,900 U.S. ATM jackpotting incidents since 2020 and over $20 million in losses. The warning describes physical access and Ploutus malware targeting the XFS layer, and recommends stronger hardware and software controls.
Key points
- The FBI says more than 700 ATM jackpotting incidents occurred in 2025, within a total of over 1,900 reported since 2020, causing losses exceeding $20 million.
- The FBI identifies Ploutus as a major malware family in these attacks; it targets the XFS layer to send commands to cash dispensers, bypassing bank authorization.
- Reported methods of gaining physical access include using generic keys, replacing hard drives, and connecting external devices such as USB drives or keyboards.
- The FBI lists unauthorized remote-access tools, including AnyDesk and TeamViewer, and suspicious executables as indicators to watch for.
- A DOJ indictment alleges a coordinated scheme stole at least $5.4 million from 63 ATMs between February 2024 and December 2025, with another $1.4 million in attempted theft blocked.
- The FBI recommends hardware monitoring, device whitelisting, disk encryption, audit logging, and maintaining a verified ATM software baseline.
Article Details
- Event Type
- FBI warning about rising ATM jackpotting incidents involving Ploutus malware and physical access to cash machines.
- Impact
- The FBI reports more than 1,900 incidents since 2020, including over 700 in 2025, with losses exceeding $20 million. Separately, a DOJ indictment alleges attackers stole at least $5.4 million from 63 ATMs and that another $1.4 million in attempted theft was blocked.
Malware
Vendors
Countries
MexicoFirst detected in 2013 by Symantec, the malware was initially used in large-scale attacks across Mexico before its global expansion.United StatesThe FBI warns of a sharp rise in ATM jackpotting across the United States, reporting over 1,900 incidents since 2020 and more than 700 in 2025 that have caused over $20 million in losses.