ATM Security: Skimming, Shimming, and Jackpotting Explained

The ATM is the most attacked payment device ever built, for a simple reason: it is the only one stocked with cash. Everything criminals attempt against store terminals, they attempt against ATMs with more ambition, because success pays out on the spot or yields card data plus the PIN that unlocks it. Our guide to defending POS terminals covered the checkout counter; this one covers the cash machine, where the attack catalog splits cleanly into two families: stealing the data of cards used at the machine, and stealing the money inside it. ATM security is the discipline of defeating both.

Quick answer: ATM attacks fall into two classes. Data attacks capture card details and PINs through skimmers, deep-insert devices, shimmers, and cameras or keypad overlays. Cash attacks take the money directly through jackpotting malware, black-box electronics, cash trapping, or physical assault. Defenses layer anti-skimming hardware, encrypted and authenticated dispenser communication, tamper detection, inspection routines, and issuer-side monitoring.

How do criminals steal card data at ATMs?

Skimmers and deep-insert devices

The classic overlay skimmer sits on top of the card slot and reads the magnetic stripe as the card passes. As machines and users got better at spotting overlays, the hardware moved inside: deep-insert skimmers are wafer-thin readers placed within the card throat itself, invisible from outside and retrievable with a special tool. Either way, the stripe is the target, because stripe data can be written onto counterfeit cards. This is precisely the fraud EMV chips were built to kill, and in chip-mandated markets the stolen stripe is mostly useful at the shrinking set of machines and terminals that still accept fallback swipes.

Shimmers

A shimmer is the chip-era answer: a paper-thin circuit lodged between the card chip and the reader contacts, logging the chip dialogue. Shimmers cannot clone a chip (the card’s secret keys never leave it), but captured data can sometimes be repurposed for stripe fallback or card-not-present fraud. They are a reminder that chip technology narrowed, rather than erased, the data-theft channel.

PIN capture

Card data alone cannot drain an account at another ATM; the PIN completes the kit. Pinhole cameras hidden in false fascia panels, light bars, or leaflet holders film the keypad; counterfeit keypad overlays record presses directly. The countermeasure chain runs from the machine (keypad shields, camera-resistant layouts) to the user (cover your hand, a habit that defeats the single most common capture method) to the cryptography underneath, which we walk through in how PIN security works end to end: the PIN is encrypted inside the pad, so the only place to steal it is at your fingertips.

How do criminals take the cash itself?

Jackpotting and black-box attacks

Jackpotting makes the dispenser pay out on command. In malware variants, attackers gain access to the ATM’s internal computer (often through the top-box service area, a USB port, or a hard-drive swap) and install software that drives the cash dispenser directly. In black-box variants, they bypass the computer entirely, unplugging the dispenser and connecting their own electronics that speak the dispenser’s protocol. Both exploit the same architectural weakness: a standard PC bolted to a safe, trusting whatever talks to it on the internal bus. Modern defenses encrypt and mutually authenticate the computer-to-dispenser link, lock down BIOS and boot paths, whitelist executable code, and alarm the service areas, because the attack begins with physical access that should never be quiet.

Cash trapping and transaction reversal

Cruder but persistent: a false shutter or adhesive device traps dispensed notes, the customer leaves assuming a fault, and the criminal collects. Transaction-reversal fraud manipulates the machine or the interaction so the account is re-credited while cash is physically taken. Both are defeated by sensor integrity, reconciliation that flags suspicious fault patterns, and fast servicing of “faulty” machines, which are often not faulty at all.

Physical and network attacks

Explosive and ram-raid attacks remain a European and ATM-industry headache, answered by ink staining and gas-neutralizing systems that destroy the notes’ value. At the other end of sophistication, network intrusions at banks or processors have triggered coordinated cash-out operations across many machines at once, which is why ATM estates belong inside the same segmentation, monitoring, and logging discipline as any other payment system.

What does layered ATM defense look like?

The operations layer deserves emphasis because it is cheap and decisive. Skimming devices need days of harvesting to pay off; a disciplined inspection routine, the same habit we prescribe for store terminals and unattended kiosks, collapses that window. Deployers of off-premise machines (shops, lobbies, forecourts) should assume their machines are tested by criminals precisely because nobody official looks at them daily.

What should cardholders actually do?

• Prefer ATMs in bank branches or supervised locations; isolated machines carry the most installs.
• Cover the keypad with your other hand every time. It defeats cameras completely and costs nothing.
• Give the card slot and keypad a two-second look and wiggle; overlays are glued, not engineered.
• Use contactless or app-based cash withdrawal where offered; tokenized taps give a skimmer nothing reusable, the same logic as wallet payments in stores.
• Turn on transaction alerts; fast reporting is the consumer’s real safety net, and stolen data often surfaces in the markets we describe in our dark web monitoring guide before the owner notices.

Frequently asked questions

Can chip cards be skimmed at ATMs?

The chip itself cannot be cloned. Skimmers still target the magnetic stripe on the same card, and shimmers eavesdrop on chip sessions for data usable in narrower frauds. Chip adoption devalued ATM skimming without eliminating it.

What is the difference between skimming and shimming?

Skimming reads the magnetic stripe with a reader outside or inside the slot; shimming intercepts the chip’s electrical contacts with a thin insert. Skimming yields clonable stripe data; shimming yields chip-session data of more limited use.

Is jackpotting something consumers should worry about?

No. Jackpotting steals the machine owner’s cash and does not touch customer accounts. Consumers’ concern is the data family: skimmers, cameras, and overlays.

Why do criminals still bother in a chip world?

Fallback acceptance, non-chip markets, card-not-present reuse of harvested numbers, and the PIN itself (valuable for stolen physical cards) keep the economics alive, though thinner each year.

Who bears the loss from ATM fraud?

Counterfeit withdrawals generally fall on the issuer or the ATM deployer under network liability rules, with EMV-era rules pushing loss toward any non-chip-capable party. Cardholders who report promptly are protected in most jurisdictions; delay weakens that protection.

The ATM compresses every payment-security theme into one box: encryption that works, hardware that fights back, operations that notice, and criminals who respond to each improvement by moving one layer over. Watch the machine that holds the cash and you watch the whole field in miniature.