HOW JACKPOTTING WORKS In its simplest form, jackpotting involves two components: access and control. Criminals gain physical access to an ATM — often during off-hours — by disguising themselves as technicians. Once the cabinet is opened, attackers install specialized hardware or upload malware through a USB or network port. With control of the system, they can command the ATM to dispense large volumes of cash on demand, sometimes emptying a machine in minutes. The Mountain West is especially vulnerable for two reasons. First, many rural banks still operate older ATM models, which are more susceptible to known jackpotting exploits. Second, the vast geographic spread of service areas can delay detection and response, allowing criminals more time to operate undetected. TRENDS EMERGING IN THE REGION 1. Shift From Large Cities to Middle Markets in Rural Areas While early jackpotting reports in the U.S. centered on large urban areas, more recent activity is concentrated in mid-sized cities and smaller rural markets. Law enforcement officials suggest that organized crime groups are deliberately targeting banks with fewer resources for ATM monitoring and security. 2. Cross-Border Coordination Authorities warn that many jackpotting incidents in the Mountain West are linked to organized groups operating across state — and sometimes national — borders. I-25 and I-80 provide quick exit routes, and some investigations have tied attacks in Wyoming and Colorado to crews operating out of southern California or even Mexico. In April, two Venezuelan nationals were indicted by the DOJ for conspiracy to defraud over 30 ATMs across several western states — including Colorado, Utah, and California. One attack alone netted nearly $94,800 from a Merced County credit union. 3. Increase in “Black Box” Attacks A notable regional trend on the rise is “black box” jackpotting. Instead of uploading malware directly into an ATM’s operating ATM Jackpotting Trends in the Mountain West A Growing Threat to Community Banks — What You Can Do To Mitigate the Risk By Wade Zirkle, President & CEO BluePoint ATM Solutions, ICBC Preferred Provider and ICBC Associate Member ATM jackpotting — a form of cyber-enabled theft in which criminals manipulate ATMs to dispense cash illicitly — has historically been more prevalent internationally. Over the last decade, however, the tactic has steadily gained a foothold in the United States, with community banks across the Mountain West now finding themselves in the crosshairs. Jackpotting has emerged as a sophisticated threat in our region, blending physical crime with the deployment of advanced malware. This surge is part of a broader escalation: The U.S. Secret Service noted that losses from jackpotting attacks reached approximately $6 million in 2023 across some 200 incidents, and by early 2024, similar losses had already occurred from over 300 attacks. The OCC echoed these warnings in spring 2025, urging banks to shore up both cyber and physical defenses amid increasing ATM “cash-out” risks. 14 | INDEPENDENT REPORT
RkJQdWJsaXNoZXIy MTg3NDExNQ==