In brief: ATM crime no longer fits into “physical” or “logical.” Explosive attacks and jackpotting both target the same asset through different routes — and increasingly, the same attack combines both. Protecting an ATM in 2026 means layering physical hardening, logical security, detection and banknote neutralisation, because no single defence covers every angle.
An ATM has always faced a unique challenge: stay accessible to the public around the clock, while protecting cash, sensitive technology and a direct line into the banking infrastructure behind it. That combination has always drawn criminal attention. What’s changed is the range of methods being used against it.
Some attacks are still unmistakably physical — forcing the safe, removing the ATM, cutting or explosive attacks to reach the cash. Others target the technology instead: manipulating hardware, software or communications to make the machine dispense cash without a legitimate transaction. Increasingly, these two worlds overlap. There’s no longer a meaningful choice between physical and logical security — operators need both.
Two attack types, converging
A physical attack is direct: penetrate or remove the safe, get to the banknotes fast. Explosive attacks are the extreme version — capable of damaging not just the ATM but the building and surroundings.
Logical attacks take a different route. Jackpotting is the best-known example: criminals use malware, unauthorised hardware or compromised communications to instruct the dispenser to release cash without a legitimate transaction ever occurring.
The distinction sounds clean — one attacks the safe, the other attacks the system — but it’s blurring. Diebold Nixdorf describes malware-based attacks that require unauthorised physical access to the upper cabinet before the logical compromise can happen. Protecting only one side of the ATM is no longer enough.
What the jackpotting numbers actually show
The US is the clearest example of how fast attack patterns shift. NCR Atleos reported a confirmed malware jackpotting attack against a drive-up ATM in 2025, and warned other incidents suggested it wasn’t isolated — leading the company to emphasise logical security across ATM estates.
The issue kept escalating into 2026. Following CONNECT 2026, NCR Atleos referenced an FBI alert issued in February, after a rise in US jackpotting incidents: more than 1,900 incidents since 2020, with over 700 resulting in losses exceeding $20 million during 2025 alone.
But the picture isn’t static. ATMIA’s crime database showed jackpotting and cash-out attacks making up a significant share of reported US ATM crime through parts of 2025 and early 2026 — yet by August 2026, the pattern had shifted considerably, with skimming and card-data compromise dominating reported incidents and dispenser jackpotting down to a much smaller share.
The takeaway isn’t that one threat replaced another. It’s that attack patterns move quickly — which means security strategy has to be built for an evolving landscape, not designed around last year’s dominant attack.
Physical attacks haven’t gone anywhere
Logical attacks may be getting the headlines, but physical attacks remain very much part of the equation — and their consequences go beyond the cash inside the machine. An explosive attack can damage the site, surrounding property, and put people nearby at real risk.
This reframes the objective: preventing access to the cash still matters, but so does limiting what an attacker gets if they succeed. Intelligent Banknote Neutralisation Systems (IBNS) address exactly that — acting directly on the banknotes stored inside the ATM. When triggered, the system permanently neutralises the protected cash, typically by staining it with indelible security ink.
That’s a fundamentally different principle from a stronger safe. Even if the attacker physically reaches the banknotes, the expected reward can still be removed. It doesn’t replace physical protection — it addresses the part of the equation physical hardening can’t: the value itself.
Treating the ATM as a system, not a safe with a screen
An ATM is a combination of physical structure, access points, electronics, software, communications and cash-handling modules — an attacker can target any one of them, or several at once. Diebold Nixdorf frames today’s environment as simultaneous pressure across physical, data and cyber domains, with traditional attacks now sitting alongside malware jackpotting, host spoofing, relay attacks and network intrusion — concluding that only a multi-layered approach holds up against that.
The same logic applies to the cash itself:
- Physical hardening makes unauthorised access harder
- Logical security helps prevent software and communications manipulation
- Detection identifies abnormal events as they happen
- Monitoring extends visibility beyond a single terminal
- Banknote neutralisation protects the value stored inside, regardless of how the attacker got there
No single layer covers the whole risk. Together, they do.
Detection is catching up to resistance
Physical security is built to resist an attack — but resistance alone doesn’t tell an operator what’s actually happening. Detecting abnormal access to a specific part of an ATM gives the system a chance to respond: an alert, a security action, or triggering another protection layer.
Remote monitoring extends that awareness further — which matters most for operators managing large estates. One security event at one terminal might be isolated. The same pattern showing up across several locations might not be. Identifying and sharing attack patterns across an estate is becoming as important as any individual countermeasure.
In September 2026, ATMIA reported its global crime database had grown to more than 64,000 reported ATM crime incidents from over 4,100 reports. The database isn’t a complete picture of global ATM crime — reporting levels vary, and plenty goes unreported — but its scale shows the value of pooling intelligence across the industry. Security increasingly depends not just on how one ATM reacts, but on how fast the wider ecosystem learns.
Criminals adapt — so protection has to be method-agnostic
When one attack route gets harder or less profitable, attention shifts elsewhere. A stronger safe can push criminals toward the electronics. Better logical security can push them toward another vulnerability. It’s continuous.
That’s the real case for protecting the asset independently of the method used to reach it. Whether the attacker breaches the safe physically or manipulates the system logically, protecting the value itself works regardless of the route. The goal isn’t predicting the next attack — it’s making the reward uncertain no matter which one comes.
A layered approach, by design
This is the principle behind Oberthur Feerica’s approach to ATM security: different attacks need different responses, so protection shouldn’t rest on a single technology. SMARTSTAIN protects banknotes through intelligent neutralisation. SMARTJACK addresses jackpotting-specific threats. Connected supervision adds visibility across the deployed estate.
Different roles, same underlying principle: protect the ATM at multiple levels, and protect the value at the centre of all of them. A security architecture built around one known attack method risks becoming outdated the moment criminals change tactics — a layered one is built on the assumption that they will.
There’s no final answer, only an evolving one
Attack methods will keep moving between physical intrusion, logical manipulation and combinations of both — the dominant threat in one market won’t necessarily be the dominant threat in another, and today’s most visible attack may not stay that way. Security design has to account for that uncertainty from the start, not react to it after the fact.
The real question for ATM operators isn’t how to stop one specific attack. It’s how to stay protected when the attack changes.
Protecting ATMs beyond the expected