How to stop ATM jackpotting?

In 2026, one of the most prominent forms of logical attack is jackpotting. First demonstrated at a Black Hat Security Conference in 2010 by researcher Barnaby Jack, jackpotting subsequently emerged as a criminal threat in Latin America before becoming increasingly prominent in the U.S. An FBI FLASH alert in February 2026 identified more than 1,800 incidents in the U.S. since 2020, including more than 700 in 2025.

Jackpotting uses a variety of methods, both on and off premises. For example, criminals may break open the top box and install malware, while others connect black box devices to the dispenser. One off-premises technique is a man in the middle attack, which interrupts communications between the ATM and the payments processor to get it to dispense cash inappropriately.

Paul Nicholls, Director of Business Development at Oberthur Feerica, said in an email interview that these attacks are happening around the world, including Europe, although recent attention has focused particularly on the U.S.

"While recent reporting has highlighted a resurgence of jackpotting attacks in the U.S., there is insufficient public evidence to conclude that Europe is less vulnerable or better protected," Nicholls said.

"What can be said is that organized criminal groups tend to target markets where they believe they can achieve the greatest financial return, and recent law enforcement reporting suggests the U.S. has become a particular focus for these attacks." Learning from past countermeasures Many ATM security measures focus on preventing or slowing down criminals, using measures such as barriers, stronger safes and other physical and software controls.

These remain important elements of a layered security strategy, but determined attackers will still defeat physical protection if they have sufficient time. These remain important parts of a layered security strategy, but experience with physical attacks has shown that security does not have to rely solely on preventing access. Another approach is to protect the cash itself, so that even if criminals overcome the first lines of defence, they cannot benefit from the attack.

One example is the Intelligent Banknote Neutralisation System, IBNS. When the system detects a physical attack, such as an attempt to force open or remove the ATM, it stains the cash with indelible ink, making it unusable to criminals. IBNS has proved to be an effective deterrent in markets around the world, and its use is increasingly supported or required by national regulations.

The same principle can be applied to jackpotting. If criminals succeed in overcoming the security measures intended to prevent an attack, there needs to be a final layer capable of stopping them from successfully dispensing the cash. This is the approach behind SmartJack, a device developed by Oberthur Feerica to stop a jackpotting attack from becoming a successful cash out.

What is SmartJack? SmartJack is designed to work across ATM models and manufacturers, recognising when a jackpotting attack is in progress and intervening to prevent cash from being dispensed. Despite its role, SmartJack is a small device, which Nicholls describes as "similar in size to a pack of playing cards." How easy is it to install?

SmartJack can work together with the SmartStain IBNS solution from Oberthur Feerica, but it is also available as a standalone device. It is designed to work with ATMs from different manufacturers.

"It is designed to be plug and play so that it does not need a qualified ATM field engineer to install it," Nicholls said.

Is it enough on its own? SmartJack is designed to respond to jackpotting irrespective of the method used to initiate the attack, including Direct Memory Access attacks. DMA attacks can potentially bypass traditional software security controls, providing another example of how attack methods continue to evolve.

Nicholls said banks have invested heavily in anti jackpotting software and other security controls, and these measures have undoubtedly made attacks more difficult. However, experience shows that criminals continually adapt their methods. "History tells us that criminals adapt.

They probe for weaknesses, develop new techniques and eventually find ways around individual layers of defence. That is why prevention alone is not enough," Nicholls said. "SmartJack provides an independent final layer at the cash dispensing stage.

It is designed to be the failsafe, stopping a successful compromise from becoming a successful cash out." However, ATM deployers should not neglect other layers of defence, including measures such as whitelisting and port lockdowns. The objective is not to replace existing security controls, but to provide another independent layer if those controls are defeated. Interested in learning more about SmartJack or IBNS cash protection?

Click here to get in touch with Oberthur Feerica.