ATM Jackpotting: The New High Tech Bank Robbery Allowing Criminal Gangs to Steal Millions Without Breaking Into a Vault

ATM Jackpotting: The New Bank Robbery Allowing Criminal Gangs to Steal Hundreds of Thousands of Dollars Without Breaking Into a Vault

Organized criminal crews are turning ordinary ATMs into automated cash dispensers, using malicious software, compromised service panels and coordinated attacks to steal enormous sums of money in minutes. Federal investigators warn that the increasingly sophisticated crime, known as ATM jackpotting, is exposing vulnerabilities in America’s banking infrastructure and creating a new generation of high tech bank robbers.

WASHINGTON — A wave of technologically sophisticated bank thefts is spreading across the United States, with organized criminal crews exploiting automated teller machines to steal tens or even hundreds of thousands of dollars without using explosives, threatening bank employees or breaking into traditional vaults.

The technique, known as ATM jackpotting, allows criminals to manipulate the computers controlling cash dispensers, causing machines to release their stored currency without legitimate withdrawals or customer authorization. Unlike conventional ATM fraud, which frequently involves stolen debit cards or compromised banking credentials, jackpotting targets the machine itself, effectively transforming a secure banking device into a cash dispensing machine controlled by criminals.

The FBI and local law enforcement agencies have warned financial institutions about the growing threat, which has produced multimillion dollar losses and prompted investigations involving coordinated criminal groups operating across state lines. Investigators say the attacks often combine physical access to ATM equipment with malicious software, exposing a dangerous intersection between traditional property crime and modern cybersecurity threats.

Recent investigations in Wisconsin illustrate how brazen these operations have become. In one case, suspects allegedly stole approximately $110,000 from ATMs at a UW Credit Union location in Glendale. In another, criminals targeted U.S. Bank ATMs in Greenfield, where repeated attacks reportedly resulted in approximately $230,000 in losses. The crimes demonstrate a troubling reality for financial institutions: An ATM does not have to be physically destroyed or removed for criminals to empty it. In some cases, gaining unauthorized access to the computer controlling the machine can be enough to compromise its cash dispensing functions.

How ATM Jackpotting Turns Banking Technology Against Itself

Traditional bank robberies involve confronting employees, forcing entry into secure facilities or physically removing money from a vault. ATM jackpotting takes a different approach, exploiting weaknesses in the electronic systems that control automated cash dispensers.

Modern ATMs contain computers that communicate with banking networks, verify transactions and control internal mechanical components. Under normal circumstances, the machine releases cash only after receiving appropriate authorization for a withdrawal. Jackpotting attacks attempt to bypass those safeguards by interfering directly with the machine’s internal control systems.

Investigators have identified incidents in which criminals gained unauthorized access to ATM service compartments, tampered with internal hardware and introduced malicious software or external electronic equipment. Once the machine’s controls are compromised, attackers attempt to issue unauthorized commands that cause the cash dispenser to release currency independently of legitimate banking transactions.

The method is particularly concerning because the theft does not necessarily require access to customer account information. Instead, criminals target the physical currency stored inside the ATM, making the financial institution or ATM operator the immediate victim. The amount stolen depends on the machine’s cash inventory and the attacker’s ability to control its dispensing mechanism. A successful attack against a heavily stocked ATM can potentially produce losses reaching six figures, while coordinated crews may target several machines during a single operation.

Security specialists distinguish jackpotting from ATM skimming, which involves capturing card information and PINs to conduct unauthorized transactions. Jackpotting is also different from attacks that physically destroy an ATM using explosives or heavy equipment. Its defining characteristic is the manipulation of the machine’s internal technology to force unauthorized cash withdrawals. The result is a crime that combines elements of burglary, computer intrusion and financial theft, often carried out with remarkable speed once the targeted equipment has been compromised.

Wisconsin ATM Heists Expose the Scale and Audacity of the Crime

Two investigations in southeastern Wisconsin have provided a revealing look at the organization, patience and confidence of the crews carrying out these attacks.

In Glendale, surveillance footage obtained by WISN 12 News showed suspects targeting ATMs associated with UW Credit Union on March 4 and 5, 2026. According to search warrants reviewed by the television station, the thieves repeatedly visited the machines, manipulating their internal systems before returning to collect cash.

The suspects allegedly made six visits during a three hour period, ultimately escaping with approximately $110,000. Surveillance footage showed one individual taking a selfie while displaying stolen cash, an unusually brazen moment captured during an otherwise carefully coordinated operation.

In Greenfield, another crew targeted U.S. Bank ATMs on March 11 and 12, making off with approximately $230,000. Investigators documented 13 visits over a six hour period, during which the suspects repeatedly collected money from compromised machines. Surveillance footage also showed individuals communicating by video call during the operation, suggesting coordination with people who were not physically present at the ATM.

Investigators reported that suspects attempted to obstruct security cameras, including by smearing mud over camera lenses. The conduct suggests that the crews understood the importance of surveillance systems and took steps to conceal their identities while repeatedly returning to collect money.

The two Wisconsin operations resulted in approximately $340,000 in combined losses. Glendale police have been investigating whether the incidents are connected, while Greenfield authorities told WISN that their investigation had been closed because detectives had exhausted available leads. Search warrant records also suggested a possible connection between one Glendale suspect and the Chicago area, although no criminal charges had been announced against that individual in the reporting reviewed.

UW Credit Union confirmed that criminal activity occurred at one of its Glendale ATMs and emphasized that member accounts and funds were not affected. U.S. Bank likewise stated that the stolen currency did not come directly from customer accounts. Those assurances highlight an important distinction: Jackpotting generally targets money held inside the machines rather than withdrawing funds from individual depositors’ balances.

FBI Reports More Than 700 Attacks and $20 Million in Losses in 2025

The Wisconsin incidents are part of a much larger national problem. In a February 19, 2026, cybersecurity alert, the FBI reported approximately 1,900 ATM jackpotting incidents across the United States since 2020, including more than 700 attacks during 2025 alone. Financial institutions reported losses exceeding $20 million from the 2025 incidents. The figures demonstrate that jackpotting is no longer an isolated form of experimental computer crime. It has become a recurring threat affecting financial institutions nationwide, with attacks occurring frequently enough to warrant formal federal cybersecurity guidance.

Alan Karr, special agent in charge of the FBI’s Milwaukee field office, described the method as a modern form of bank robbery that avoids the direct physical confrontation traditionally associated with stealing money from a financial institution. Investigators say criminal crews frequently study prospective targets before attempting a theft, evaluating security arrangements, physical access points and the likelihood of attracting attention. Different participants may handle surveillance, equipment tampering and cash collection, allowing the operation to be divided among individuals with specialized responsibilities.

The FBI’s advisory also identified a family of malicious software known as Ploutus, which has been associated with ATM jackpotting for years. The malware exploits weaknesses in the software systems responsible for controlling ATM functions, allowing criminals to manipulate cash-dispensing operations without completing a legitimate banking transaction. The federal warning emphasizes that financial institutions must treat the problem as both a physical security threat and a cybersecurity risk. Stronger locks alone cannot address software vulnerabilities, while updated computer systems may remain exposed if criminals can gain unauthorized physical access to critical components.

International Criminal Networks Are Turning ATM Theft Into a Multimillion Dollar Enterprise

Federal prosecutors have also connected ATM jackpotting to larger organized criminal operations involving participants across multiple states and international networks.

In February 2026, the Justice Department announced additional charges in an international ATM jackpotting investigation centered in Nebraska, bringing the number of defendants charged in the case to 93. Prosecutors alleged that members of the conspiracy used malicious software to compromise ATMs and steal millions of dollars from financial institutions.

According to federal charging documents, the operation involved coordinated teams responsible for identifying targets, compromising machines and collecting stolen currency. Prosecutors alleged that participating financial institutions suffered losses exceeding $6 million, with additional attempted thefts totaling at least $1.74 million.

The Justice Department has also identified alleged connections between some defendants and Tren de Aragua, the Venezuelan criminal organization designated by the United States as a foreign terrorist organization. Those allegations have made the investigation part of a broader federal effort targeting transnational organized crime and financial cyberattacks.

In June, two Venezuelan nationals were sentenced to 78 months in federal prison for their roles in an international jackpotting conspiracy linked to the organization. Prosecutors said the defendants helped facilitate the deployment of malicious software used to steal money from American financial institutions.

The criminal cases illustrate how jackpotting can operate as an organized business rather than an opportunistic theft. Federal investigators have described operations in which individuals carrying out the physical attacks receive a portion of the proceeds, while other participants manage the technology, coordinate activities or receive stolen funds.

However, not every ATM jackpotting incident has been connected to Tren de Aragua or any other specific organization. Investigators must establish the participants and organizational connections in each case, and individuals facing unresolved charges remain presumed innocent unless convicted.

An FBI Arrest Highlights the Potential Reach of the Criminal Networks

The federal crackdown produced another significant development in October 2026, when authorities announced the arrest of Anibal Aguirre, a suspected cybercriminal accused of helping direct a nationwide ATM jackpotting operation.

According to reporting by WOWT in Omaha, investigators alleged that Aguirre developed malicious software and provided technical direction to participants responsible for compromising ATMs. Federal authorities connected the broader investigation to approximately $61 million in losses at financial institutions across the country.

The FBI described the arrest as a major step in its investigation of organized ATM theft, although officials emphasized that the case involved numerous participants and that efforts to dismantle the broader operation were continuing.

Authorities also alleged that a portion of the proceeds from certain attacks was directed to leadership associated with Tren de Aragua. Those allegations underscore why investigators view some jackpotting operations as more than ordinary financial crimes: The stolen money may help finance additional criminal activity.

The reported $61 million figure relates to the broader investigation and should not be confused with the FBI’s separately reported $20 million in nationwide jackpotting losses during 2025. The figures describe different scopes of activity and cannot simply be added together to calculate total national losses.

Why ATMs Remain Vulnerable Despite Modern Banking Security

The rise of jackpotting exposes a weakness in the relationship between physical security and computer security. Banks have spent decades improving encryption, customer authentication, fraud detection and electronic transaction monitoring, but an ATM also contains a physical computer that must communicate with mechanical equipment to dispense currency.

That distinction creates a different kind of vulnerability. A criminal who compromises the machine’s internal operating environment may be able to manipulate the cash dispenser without defeating the bank’s normal customer authentication procedures. The result is a theft that can occur outside the transaction patterns financial institutions ordinarily monitor for debit card fraud.

The problem is particularly challenging for banks operating large networks of standalone or drive up ATMs. Machines located away from staffed branches may be accessible for extended periods, while older equipment can be more difficult to update or replace. Security improvements must also account for the legitimate access required by technicians, maintenance contractors and armored-car personnel.

The FBI and the Federal Deposit Insurance Corporation’s Office of Inspector General have urged financial institutions to strengthen their defenses through software updates, improved physical protections, intrusion detection and closer monitoring of suspicious equipment activity.

Financial institutions are also encouraged to investigate unexpected maintenance access, unexplained system restarts, unauthorized hardware changes and unusual cash shortages. Security cameras can provide valuable evidence, but the Wisconsin investigations demonstrate that criminals may attempt to disable or obstruct surveillance equipment before carrying out an attack.

The challenge is not simply to make ATMs more difficult to open. It is to ensure that unauthorized physical access cannot easily translate into control over the machine’s internal computer systems.

Are Bank Customers at Risk of Losing Their Money?

For consumers, one of the most important distinctions is that ATM jackpotting generally does not involve withdrawing money directly from individual checking or savings accounts.

In the Wisconsin incidents, both UW Credit Union and U.S. Bank told WISN 12 News that customer funds were not affected by the reported thefts. The criminals allegedly stole physical currency stored inside the machines rather than transferring money from individual depositors’ accounts.

That does not mean jackpotting is harmless to consumers or the banking industry. Financial institutions must absorb or recover the losses, investigate compromised equipment, repair damaged machines and invest in additional security measures. Repeated attacks can also disrupt ATM availability, particularly in communities where customers depend on a limited number of cash-access locations.

Consumers should remain alert to signs of tampering, including damaged ATM panels, unusual attachments or equipment that appears to have been forced open. Suspicious activity should be reported to the financial institution rather than investigated personally. For banks, however, the principal responsibility lies in preventing unauthorized access and ensuring that a compromised machine cannot be manipulated into dispensing its cash inventory.

The New Bank Robbery Is Already Here

The rise of ATM jackpotting represents a significant evolution in financial crime. Instead of confronting tellers or attempting to break into reinforced vaults, criminals are increasingly exploiting the computerized equipment that banks rely upon to provide customers with convenient access to cash.

The Wisconsin cases demonstrate how damaging the attacks can be at the local level, with approximately $340,000 allegedly stolen during two coordinated operations. The FBI’s national statistics reveal a far larger problem, with hundreds of reported incidents and more than $20 million in losses during 2025 alone. Federal prosecutions have also exposed the involvement of sophisticated criminal networks capable of coordinating technical expertise, surveillance, physical access and cash collection across multiple jurisdictions. The cases illustrate why investigators increasingly treat jackpotting as a combination of organized financial crime and cybersecurity intrusion.

The technology behind ATM jackpotting is not entirely new. Security researchers have demonstrated vulnerabilities in automated cash dispensers for more than a decade. What has changed is the scale at which criminal organizations are exploiting those weaknesses for financial gain.

For financial institutions, the warning is unmistakable. An ATM can be protected by cameras, locks and sophisticated banking networks, yet remain vulnerable if its internal computer systems can be compromised.

For investigators, the challenge is equally clear: The next generation of bank robbers may never step inside a bank, confront an employee or attempt to open a vault. They may simply approach an ATM, compromise its technology and leave with the cash.

Sources & Further Reading

• WISN 12 News: The New Bank Robbery: ATM Jackpotting on the Rise — November 12, 2026.
• WYFF 4: Wisconsin Surveillance Footage and ATM Jackpotting Investigation.
• Federal Bureau of Investigation: February 19, 2026, Cybersecurity Alert on Malware-Enabled ATM Jackpotting.
• FDIC Office of Inspector General: ATM Jackpotting Threats and Prevention.
• U.S. Department of Justice: International ATM Jackpotting Conspiracy and 93 Charged Defendants.
• U.S. Department of Justice: Sentencing in International ATM Jackpotting Conspiracy.
• WOWT First Alert 6: FBI Arrest in Investigation Linked to $61 Million in Losses.
• Recorded Future News: FBI Reports More Than 700 Jackpotting Attacks in 2025.
• TechCrunch: Reporting on ATM Jackpotting and Cybercrime Threats.
• South Florida Media: https://sfl.media/