Security

Should ATMs ditch keys to fight jackpotting?

ATM topboxes are more vulnerable than ever to jackpotting threats. One possible solution is integrating keyless locks.

Photo: Adobe Stock

May 15, 2026 by Bradley Cooper — Editor, Connect Media

Summarize withChatGPTGrokPerplexityClaude

Jackpotting is now the premier threat to ATMs. First developed in Latin America, it has now caused tens of millions of dollars in losses, often through organized gang activity.

In most of these attacks, criminal groups will break open the top box of the ATM and install malware through a physical device, making the ATM dispense cash. Although it doesn't steal from customers' accounts, it does empty out the ATM and leave financial institutions and IADs in the lurch.

One possible solution to this issue is adding different types of security measures, from stronger mechanical locks to barriers and alarms. But one key point of vulnerability is the lock itself, as criminals can pick locks or steal and copy keys. One possible solution to this concern is a more advanced keyless lock that uses more advanced security measures for access.

ATM Marketplace spoke with Bruce Kayal, SVP and general manager of Global Safe Locks for dormakaba to discuss jackpotting trends and why keyless techniques might prevent them.

Q. Why are we seeing such a big increase in jackpotting now?

Kayal: ATMs are an attractive target because they seemingly offer direct access to cash. Potential criminals may be influenced by previous attacks and feel challenged to replicate the same methods themselves.

This comes down to scale and access. TheFBI has warned that ATM jackpotting incidents have increased significantly in recent years, with $20 million in losses in 2025 alone. To provide a sense of real-world scale, just one of our integrators experiences 10 to 15 jackpotting attempts per week on their monitored devices. These attacks are now well understood and repeatable, and too many machines still allow relatively easy physical access. Known malware and shared techniques make it possible for organized groups to replicate attacks across many machines. This is something both the FBI and industry groups such as the ATM Industry Association (ATMIA) have been warning about for several years.

Q. What are some of the primary techniques criminals use to access the top box of the ATM?

Kayal: The most common techniques are simple. Criminals may use crowbars to pry open access points or rely on widely available, generic keys tied to standard cam locks.

These methods are effective because they target the ATM's most vulnerable point: the top hatch. In the past, the top hatch was not considered critical to securing cash in the lower vault, so it was protected with more basic physical access products such as cam locks. However, as attack methods have evolved, the top hatch is now a common entry point because many machines still rely on shared mechanical keys with limited tracking or audit controls, making it easier to gain access across multiple units. Once inside, it becomes significantly easier to connect devices or deploy malware directly.

Q. What are some of the traditional ways banks have used to stop jackpotting?

Kayal: We have seen financial institutions implement various layered security measures, including bollards and security gates, which help prevent easy access to the machine and act as a visible physical theft deterrent.

Financial institutions have also implemented newer mechanical cam locks that have higher security with restricted key options. The goal is to slow down or deter physical access long enough to trigger a response.

Other measures may include encrypting communication between the ATM and the host to prevent unauthorized commands, anti-malware tools, remote monitoring and alerting, timed access procedures for service technicians, and operational controls like dual control or audit trails, all of which are recommended in various forms by ATMIA and reinforced by FBI guidance.

Q. What's the advantage of a keyless lock?

Kayal: With current mechanical cam locks, there is little control over key management, restricted access, or audit control for entry to the top hatch. The biggest advantage of new technology is moving from shared access to controlled access. Keyless systems remove the need for a physical key that can be copied, lost, stolen, or used by multiple individuals. Instead, innovations such as the dormakaba Apexx Strato Rotary use Bluetooth Low Energy (BLE)-enabled protection for the top hatch. By replacing shared mechanical keys with controlled mobile credentials and automatic audit capture, the solution helps reduce financial exposure while improving visibility and strengthening security across ATM fleets.

The idea is that you cannot steal or copy a key that no longer exists.

The new keyless electronic ATM rotary lock allows financial institutions to remotely control and monitor access through the dormakaba Apexx Software platform. The platform manages the physical user access control by issuing one-time codes to only authenticated users and devices. This creates an electronic audit trail for all openings and closings by user, date, and time. If an issue arises that needs to be investigated, the clear audit trail quickly allows an investigator to review video and data.

From an operational standpoint, this type of solution also eliminates the need to manage physical keys and reduces technician coordination, which improves efficiency in the field.

Q. How does this lock ensure the right parties have access to the ATM?

Kayal: Access is tied to the individual, not a shared key. Only authenticated users and devices are issued one-time codes for a specific lock. Each access event is recorded, so there is a clear audit trail of who accessed the machine and when. That level of visibility and control is something traditional key systems simply cannot provide. Traditional keys were not designed for today's threat environment.

Q. Can you share any cost information on these locks?

Kayal: Pricing varies depending on the configuration and deployment. Solutions are tailored to a customer's environment and security needs. In general, our Apexx solutions follow a model that includes a one-time investment for hardware and software, along with recurring fees for licensing, connectivity, and ongoing access to firmware and software updates.

Keyless electronic locks are a higher upfront investment compared to traditional mechanical locks. However, most customers are focused on the total cost of ownership. When you factor in the elimination of physical key management, reduced need for on-site service coordination, and lower risk of loss from unauthorized access, many organizations see a clear operational and security return over time.

For those with more advanced needs, we also offer SDK and API capabilities to support integration with broader systems or mobile strategies. We will soon be launching hosting options for those clients interested.

Q. What work still needs to be done in the area of physical ATM security?

Kayal: Closing the divide between physical and digital security is work that still needs to be done. A lot of investment has gone into software and network protection, but many attacks still begin with physical access to the actual machine. Until that access point is fully controlled, other security layers can be bypassed. So another key area is modernizing access control across the installed base. Many ATMs still rely on shared keys and legacy processes, which are difficult to manage at scale and do not provide accountability.

No single solution that addresses every scenario. That is why the industry must rely on layers, ranging from physical protection to vault security, and overall access control. Our team has launched several new solutions over the past three years focused on driving continued operational efficiencies and risk management for financial institutions, retailers, ATM owners and operators, and cash-in-transit (CIT) service providers. Our focus right now is on strengthening that first point of access because that is where many attacks begin.

About Bradley Cooper

---

Bradley Cooper is an experienced editor for Connect Media. He has written across a wide range of beats, ranging from food to digital signage to banking, and is the current editor of ATM Marketplace and Food Truck Operator. His background is in information technology, advertising, and writing. When he’s not crafting a story, you can find him going for a run or spending time with his wife and three sons. 

Connect with Bradley: