Listen to this Post
Introduction:
On August 3, 2026, a U.S. District Court in Oklahoma sentenced Sebastian Bulacu (37) and Florin Radu (42) to 51 months each, and Valentin Cristian Alexandru (36) to 41 months in federal prison for a conspiracy to commit bank fraud. Their crime? A January 2025 skimming operation that targeted more than 100 victims across the Oklahoma City metro area, causing $193,598 in losses. No malware, no network intrusion, no AI-powered exploit chain — just deep-insert skimmers bolted onto card readers and $30 pinhole cameras aimed at keypads. While the industry chases sophisticated logical attacks like jackpotting and Ploutus malware — which FBI data shows caused over 700 incidents and $20 million in losses in 2025 alone — the unglamorous physical attack remains the one consistently emptying accounts. This article dissects the mechanics of this enduring threat and provides actionable technical countermeasures for ATM fleet operators.
Learning Objectives:
- Understand the technical architecture of deep-insert skimmers and pinhole camera deployments
- Master physical inspection protocols and tamper-evident seal verification
- Implement EMV-only transaction policies to eliminate magnetic stripe fallback vulnerabilities
- Deploy anti-skimming hardware and logical security hardening on Windows-based ATM controllers
- Develop incident response procedures for skimming detection and forensic investigation
You Should Know:
- Deep-Insert Skimmers and Pinhole Cameras — The Invisible Attack Surface
Deep-insert skimmers are engineered to sit fully inside the card reader slot, not over it. Unlike overlay skimmers that create visible bulkiness or mismatched colors, deep-insert devices are virtually invisible during casual inspection. They capture Track 1 and Track 2 magnetic stripe data — including the primary account number (PAN), expiry date, and service code — storing it in onboard flash memory or transmitting it via Bluetooth in real time. Bluetooth-enabled skimmers can operate from a parked car within 30 meters.
Simultaneously, pinhole cameras — with lenses as small as the tip of a ballpoint pen — are concealed in brochure holders, false fascias, or above the keypad. These cameras record PIN entry in sync with the skimmed card data. The collected data is then encoded onto blank PVC cards using commercially available magnetic stripe writers, producing functional counterfeit cards.
Step-by-Step Guide: Physical Inspection Protocol for ATM Fleet Operators
Step 1: Establish a Baseline. Take high-resolution photographs of each ATM’s card reader bezel, keypad, and surrounding fascia when the machine is known to be clean. Use these as reference images during inspections.
Step 2: Visual Inspection — What to Look For:
– Unusual bulkiness, different color/material, or adhesive residue around the card reader slot
– Raised or unusually thick keypad appearance indicating an overlay
– Residue or damage where a facade piece containing a pinhole camera may have been attached
– Missing or altered tamper-evident seals on the ATM cabinet
– Extra wiring, holes, added labels, or decals that may hide tampering
Step 3: Physical Tug Test. Grip the card reader bezel and pull firmly. Overlay skimmers are typically attached with adhesive and will detach or shift.
Step 4: Document and Report. If a skimmer or pinhole camera is detected, take the ATM offline immediately. DO NOT touch or remove any pieces — preserve the evidence. Contact law enforcement and a certified technician.
Step 5: Secure Compromised Cards. Identify the exposure window (when the skimmer was installed and removed — crews typically place them for only a few hours during the day). Secure all cards used during that period, reissue cards, and at minimum force PIN changes.
Step 6: Share Intelligence. Report the incident through information-sharing platforms like CrimeDex, the ABA Physical Security Open Committee, or regional ATM Crime Task Forces.
2. EMV Fallback — The $193,598 Vulnerability
EMV chip adoption dramatically reduced counterfeit fraud at chip-enabled terminals. However, many ATMs still accept magnetic-stripe fallback transactions. Every machine configured to allow fallback remains a live target. Fraudsters can deliberately damage the chip reader — using high-voltage contacts or physical obstruction — to force the terminal to process the transaction using the magnetic stripe instead.
Step-by-Step Guide: Disabling Magnetic Stripe Fallback
Step 1: Audit Current ATM Configurations. Inventory all ATMs in your fleet and determine which are EMV-capable and which still process magnetic stripe transactions.
Step 2: Disable Fallback Where Permitted. Configure terminals to minimize or eliminate magnetic stripe fallback wherever card network rules permit. For EMV-capable ATMs, only permit chip-enabled cards at chip-enabled terminals.
Step 3: Implement Transaction Monitoring. Deploy monitoring that compares chip communication timing with magnetic stripe data — systems can automatically abort or retain fraudulent cards when anomalies are detected.
Step 4: Fleet Modernization. Replace non-upgradable ATMs that cannot support PCI PTS 5.x+ Encrypting PIN Pads (EPPs). Ensure all ATMs support TR-31 key block standards for secure key exchange.
Step 5: Windows Registry Hardening for ATM Controllers. For Windows-based ATM management systems, restrict USB device connections and disable unused ports:
Disable USB storage devices via Group Policy Computer Configuration > Administrative Templates > System > Removable Storage Access Enable: "All Removable Storage classes: Deny all access" Registry equivalent for systems without Group Policy Editor: reg add HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start /t REG_DWORD /d 4 /f Disable automatic playback of removable drives: reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
3. Tamper-Evident Seals and Anti-Skimming Hardware
Tamper-evident seals make interference visible at a glance. They are a low-cost, high-impact deterrent that forces attackers to either leave evidence of tampering or spend additional time defeating the seal — time that increases detection risk.
Step-by-Step Guide: Implementing Tamper-Evident Controls
Step 1: Select Appropriate Seals. Use tamper-evident seals with unique serial numbers and visual indicators (void patterns, color changes) that reveal when removal has been attempted.
Step 2: Establish Seal Inventory. Document every seal’s serial number, location, installation date, and inspector. Maintain an up-to-date inventory of every POI device — make, model, location, and serial number.
Step 3: Install Anti-Skimming Bezels and Active Shields. Deploy physical barriers that make skimmer attachment difficult or impossible. Modern anti-skimming modules integrate with EMV card readers to detect and prevent unauthorized data capture.
Step 4: Automated Monitoring. Integrate alarm triggers that activate when tamper-evident seals are broken or when anti-skimming sensors detect interference.
Step 5: Regularized Inspection Schedule. Implement documented inspection checklists with defined frequencies — daily for high-risk locations, weekly for all others. Inspections should cover:
– Card entry slot integrity
– Tamper-evident seal status
– Fascia, light bars, and card throats
– Keypad condition and thickness
- Logical Attack Hardening — Defending Against Jackpotting and DMA Attacks
While the Oklahoma case involved physical skimming, ATM operators cannot ignore the logical threat. The FBI tracked more than 1,900 ATM jackpotting incidents since 2020, with over 700 in 2025 alone. Attackers exploit physical access to ATMs, download malware like Ploutus, and issue direct commands to the ATM’s eXtensions for Financial Services (XFS) layer — bypassing bank authorization entirely. Criminals typically open the ATM face with widely available generic keys, remove the hard drive, connect it to their own computer, and copy malware onto it.
Step-by-Step Guide: ATM Logical Security Hardening
Step 1: Encrypt All Hard Drives. Full-disk encryption (FDE) prevents offline malware injection if the drive is removed and connected to another system.
Step 2: Implement Secure Boot and TPM. Install secure boot and Trusted Platform Module (TPM) to prevent unauthorized operating system modifications.
Step 3: Harden the BIOS/UEFI.
- Set BIOS passwords
- Disable unused ports in BIOS
- Enable IOMMU and Microsoft Kernel DMA Protection (requires Windows 10 LTSC 2019 or later)
Step 4: Windows OS Hardening. Apply NIST-based Group Policies:
Enable Windows Defender and Device Guard Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus Restrict USB access via Group Policy Computer Configuration > Administrative Templates > System > Removable Storage Access Enable Windows Firewall with advanced security netsh advfirewall set allprofiles state on Disable unnecessary services sc config RemoteRegistry start= disabled sc config RemoteDesktopServices start= disabled
Step 5: Deploy ATM-Specific Endpoint Detection and Response (EDR). Implement behavioral detection for XFS manipulation and jackpotting patterns. Monitor for:
– Unexpected shutdowns and reboots
– Suspicious USB device connections
– Unexpected outbound connections from ATM network segments
– File access and process creation anomalies
Step 6: Network Segmentation. Air-gap management networks — eliminate internet connectivity from ATM controllers and central systems where possible.
Step 7: Linux-Based ATM Controller Monitoring. For backend systems monitoring ATM controllers from Linux platforms:
Monitor for suspicious USB device connections (physical compromise indicator)
dmesg | grep -i "usb"
Check for unexpected outbound connections from ATM network segment
sudo netstat -tunap | grep ESTABLISHED | grep -v "192.168|10.|172.16"
Audit recent file modifications in critical directories
find /etc /var/log /usr/local/bin -type f -mtime -1 -exec ls -la {} \;
Monitor for unauthorized SSH access attempts
sudo grep "Failed password" /var/log/auth.log | tail -20
What Undercode Say:
- The boring stuff protects you more than the exciting stuff. Routine physical inspection, tamper-evident seals, and EMV-only transactions would have slowed this crew faster than any behavioral-detection algorithm running in a data center a thousand miles away. Fraud budgets chase the sophisticated threat while the unglamorous one still empties accounts.
-
Scale is the business model. These crews are transnational, mobile, and organized — not one person attacking one machine. A group moving through a metro, installing at multiple sites, relocating before enforcement catches up. The operation in Oklahoma involved three men, 50+ pinhole cameras, 25+ deep-insert skimmers, and dozens of cloned cards. This is industrial-scale fraud, not petty crime.
Analysis: The Oklahoma case is not an isolated anomaly — it is a recurring pattern. The FBI and Secret Service continue to prosecute skimming rings with alarming regularity. Yet the industry’s response remains disproportionately focused on AI-driven fraud detection and network-level analytics. These tools are valuable, but they do nothing to prevent a $30 camera from capturing a PIN. The disconnect between threat reality and defensive investment is stark. ATM fleets require a balanced, layered security strategy that treats physical inspection with the same priority as logical monitoring. PCI DSS 4.0 mandates periodic tamper inspections, but compliance checkboxes do not equal operational security. The organizations that internalize this lesson — that physical security is not obsolete, merely unglamorous — will be the ones that survive the next wave of skimming attacks.
Prediction:
- +1 The Oklahoma sentencing sends a clear signal to transnational skimming rings: U.S. federal prosecutors are treating these crimes with severity, pursuing maximum sentences and deportation. This deterrence effect may temporarily reduce skimming activity in the near term.
-
-1 As law enforcement tightens the screws on physical skimming, organized crime groups will accelerate their pivot to logical attacks like jackpotting and DMA-based exploits. The FBI already reported 700+ jackpotting incidents in 2025 — this number will likely double in 2026-2027 as skimming becomes riskier.
-
-1 The EMV fallback vulnerability will persist until magnetic stripes are fully phased out. Mastercard has announced its intention to end magnetic stripe on its cards by 2030, but until then, every ATM that accepts fallback transactions remains a ticking time bomb.
-
+1 Advancements in anti-skimming hardware — including active shields, encrypted card readers, and tamper-detection modules — will become standard on next-generation ATMs. Fleet modernization, while costly, will gradually reduce the physical attack surface.
-
-1 The operational model demonstrated in Oklahoma — mobile crews using short-term rentals as bases, installing devices for hours rather than days — will be adopted by more groups. This “smash-and-grab” approach minimizes dwell time and complicates detection, making traditional inspection schedules less effective.
▶️ Related Video (82% Match):
https://www.youtube.com/watch?v=3aJLEgkvezs
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Joserinconrodriguez Atm – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
