ATM Skimming / Jackpotting

Skimming emerged with ATMs in the 1990s; jackpotting was demonstrated by Barnaby Jack in Las Vegas in 2010, first seen in the wild on Mexican ATMs in 2013, and first confirmed in the US in January 2018.

Card skimming, copying a card's magnetic stripe with a hidden reader and capturing the PIN with a pinhole camera or overlay keypad, appeared soon after ATMs spread in the 1980s-1990s and became an organised trade run largely by Romanian and Bulgarian crews in the 2000s. Jackpotting, forcing the machine itself to spit out cash, was demonstrated by researcher Barnaby Jack at Black Hat in 2010; the Ploutus malware was found on Mexican ATMs in 2013, and the US Secret Service confirmed the first US jackpotting attacks in January 2018. In 2024-2025 Venezuelan crews linked to Tren de Aragua spread Ploutus attacks across US community banks.

Skimmers fit an overlay on the card slot or a 'deep insert' reader inside it, plus a camera or fake keypad, then collect the data and encode cloned cards to withdraw cash abroad. Jackpotting crews open the ATM's top cabinet with generic keys, connect a laptop or USB device to the PC inside, load malware such as Ploutus that talks directly to the cash dispenser, and a 'mule' then keys a code to empty the cassettes without any account being debited. Both rely on older machines, weak physical locks and standalone ATMs in shops and lobbies.

Skimmer kits sell online for a few hundred dollars and a crew can clone hundreds of cards a week; jackpotting needs a malware toolkit and a generic ATM key but can empty $100,000 from a lobby machine in minutes. The FBI says incidents more than tripled into 2025, and while US courts have handed down dozens of sentences, most arrests are of low-level installers and mules rather than organisers.

The FBI put jackpotting losses at more than $20 million across 700+ US incidents in 2025 and 1,900 since 2020; no body publishes a global skimming total. The largest recent prosecution is the Tren de Aragua-linked network with 96 further defendants indicted. Banks, not customers, usually bear jackpotting losses, but skimming victims can spend months disputing withdrawals.