What Is ATM Jackpotting? Answers from the Douglas County Sheriff’s Office

Recently, the Douglas County Sheriff’s Office (DCSO) provided further insight into the emerging crime of ATM “jackpotting” following a series of arrests in Nebraska and across the nation. Douglas County Sheriff Aaron Hanson and DCSO Junior Financial Crimes Investigator and FBI White Collar Crime Task Force Member Nick Richards spoke about how the crime works, who is responsible, and what can be done to prevent it.

According to Sheriff Hanson, jackpotting is a form of financial crime that has increasingly been carried out by Venezuelan nationals who have entered the United States illegally. Many of these suspects are believed to be connected to an international organized crime group known as Tren de Aragua (TDA).

Court affidavits describe ATM jackpotting as a scheme in which a coordinated crew installs malicious software, often referred to as “malware”, onto an ATM’s hard drive to force it to dispense cash on command. Each member of the crew has a distinct role, including a scout to locate vulnerable ATMs, a driver, a technician to install the malware, and a “cash-out” individual who collects the stolen money.

The affidavit further notes that suspects often use pre-programmed computers or Raspberry Pi devices to load the malware. It is common for individuals accessing the machines to disguise themselves as ATM technicians, giving them the appearance of legitimacy while they tamper with the equipment.

Investigator Richards explained that the process typically involves swapping the ATM’s hard drive with a corrupted one. “When the compromised hard drive is installed, the ATM enters maintenance mode, allowing the suspects to connect to it and withdraw cash at will,” Richards said.

In one recent case, the targeted ATM lacked hard drive encryption and did not send an alert to the bank when it lost internet connectivity during the reboot, making it easier for the suspects to carry out the theft undetected.

Richards noted that banks can take several important steps to protect themselves against these types of attacks. “They should encrypt their hard drives, re-key the physical locks on their ATMs, and install alarms or device-tampering mechanisms,” he said.

Sheriff Hanson emphasized that these schemes are causing significant financial losses nationwide. “Banks are losing millions of dollars to these operations, and unfortunately, that cost often gets passed on to consumers,” he said. “Not all of the losses are covered by insurance, and it can lead to higher costs for financial institutions.”

Despite the growing sophistication of these crimes, Sheriff Hanson made it clear that DCSO isn’t backing down. “These criminals may think they can hit the jackpot, but they’ll find out fast that we’re coming for them,” he said. “We will track them down, arrest them, and make sure they face justice to the fullest extent of the law.”