Cash machines could be mass-hacked in global cyber attack, FBI warns

Banks have been warned of an imminent threat that their cash machines could be mass-hacked by cyber criminals.

In a confidential alert on Friday, America's Federal Bureau of Investigation told international banks that criminals are plotting a concerted global malware attack on cash machines in the next few days. 

The FBI issued a warning about a highly choreographed fraud scheme known as an ATM "jackpotting", in which crooks hack a bank or payment card processor and use cloned cards at cash machines around the world to take out millions in just a few minutes. 

UK-based banks with large international operations, such as HSBC and Barclays, are among those thought to have been made aware of the threat. 

“The FBI has obtained unspecified reporting indicating cyber criminals are planning to conduct a global Automated Teller Machine (ATM) cash-out scheme in the coming days, likely associated with an unknown card issuer breach,” the FBI warning said, according to Krebs on Security, which originally reported the alert.

Banks were warned about a global malware attack on cash machines that could make machines dispense millions in a matter of minutes. Credit:  PA

The method usually involves physical access to a cash machine using specialised electronics and malware to take over the system and force it to dispense cash until it is empty.

Andrew Bushby, UK director at Fidelis Cybersecurity, said: “UK banks are a likely target – and this latest ‘ATM cash-out blitz’ will no doubt send shockwaves to financial institutions."

He added: "Whilst the financial services industry is heavily regulated, it doesn’t make banks immune from being attacked by cybercriminals... UK banks need to urgently take a look at their security posture."

Smaller, independent banks are considered the most vulnerable to such attacks, according to NCC Group, a cyber-security consultancy firm.

Ollie Whitehouse, global chief technology officer at NCC, said that criminals tend to target smaller banks that issue debit cards but which may have less stringent security systems. 

"It's a symptom of organised crime becoming more capable, as they [criminals] become emboldened they are able to do these orchestrated activities," he said. 


In one incident in Thailand in 2016, thieves made off in minutes with 12 million baht or about £280,000 from cash machines by targeting ATMs run by Government Savings Bank, a state-owned Thai bank based in Bangkok.

In another case in the US, criminals siphoned about $570,000 in cash from  ATMs operated by the National Bank of Blacksburg  in two separate attacks in 2016 and 2017.

Ross Brewer, a cyber security expert with LogRhythm, said: "This case may have been identified in the US, however it is a global attack and, if successful, has the potential to have widespread implications. UK banks should be concerned and need to be putting measures in place that ensure they can identify anomalous activity that could indicate the start of this attack." 

Cyber criminals typically steal credit card data to create fraudulent copies of legitimate cards on reusable magnetic strip cards, the FBI warned. At a pre-determined time, the fellow conspirators withdraw account funds from ATMs using these cards and alter bank balances to force a cash machine to dispense all of its money.

According to Krebs on Security, the FBI urged banks to review the way they handle security internally, such as implementing strong passwords and two-factor authentication using a physical and digital token.

Criminals have worked on varying methods of stealing credit card information when customers use credit card machines, mostly creating "skimmers" that copy card details from individual customers. These machines tend to fit into the ATM's card slot to read the magnetic code embedded in the black strip of a bank card, while allowing the machine to function as normal to avoid raising suspicion. 

The National Cyber Security Centre (NCSA) recommends that all banks use up to date and supported operating systems and software, deploy critical security patches as soon as possible and use an anti-virus solution that scans new files and can regularly check for vulnerability in the network. It also recommends banks to implement an application whitelisting technologies, which earmarks programmes that are safe to use, to prevent malware. 

A NCSC spokesman said that it is working closely with the financial service sector to make sure that their platforms are as secure and resilient as possible.

"By sharing our experiences of exposure to cyber incidents, the NCSC raises awareness across the board and improves the nation's cyber defences," the spokesman said.

The Financial Conduct Authority and the National Security Agency have declined to comment. The  FBI was approached for comment.