With ATM hacking and credit card skimming becoming more easily prevented and detected, some criminals are resorting to the use of explosive breaches to target ATM machines. Three attacks in the month of April in the Seattle, Washington area has provoked law enforcement to issue an intelligence bulletin on the topic.
According to a recent law enforcement intelligence bulletin, “in explosive breaching attacks, a flammable gas such as propane or oxyacetylene is pumped through flexible tubes into the ATM casing and then ignited, causing an overpressure event that ruptures the ATM and allows its contents to be accessed. To do this, criminal actors may first drill holes or damage the cash dispenser slot with a crow bar or other device, insert tubing into the opening, pump gas into the ATM via the tubing, and ignite the gas mixture with a spark or flame from a distance.
Criminal actors breaching ATMs with explosives have become a common occurrence in Europe and South America in recent years.1 For example, the United Kingdom has documented over 100 attacks of this nature since 2013, resulting in significant financial losses and damages to banks and ATMs. One group in the United Kingdom targeted 28 ATMs at banks, supermarkets, and post offices and stole over $1 million, while causing over $650,000 in damage. Recent incidents in the Washington State, along with incidents in California, Missouri, Pennsylvania, and Utah, suggests these types of explosive breaching attacks have now propagated to the United States. As such, financial institutions, police, and other first responders will likely encounter these types of attacks on a more frequent basis.
- In October 2018, criminals used a pipe bomb to attack an ATM in St. Louis, Missouri. The attempt damaged the ATM, but was unsuccessful.
- In June 2018, criminals attempted to rob multiple ATMs in Philadelphia, Pennsylvania by inserting pyrotechnics into the ATMs. The attempts damaged the ATMs, but were unsuccessful.
- In January 2018, criminals attempted to rob three ATMs in Salt Lake City, Utah by using flammable liquid and propane. The attacks were unsuccessful, and three suspects were eventually arrested.
- In August 2017, criminals attacked two ATMs in San Diego, California by using gasoline and a pipe bomb. One attack resulted in the contents of the ATM being stolen. Two suspects were eventually arrested.
- In April 2017, criminals attacked ATMs in Burbank and Los Angeles, California using propane. The attacks were unsuccessful, and two suspects were eventually arrested.
According to the bulletin, there are several potential indicators of a pending explosive breach attack and that “Banks and businesses with ATMs should be aware of suspicious activity occurring near their machines as suspects may engage in pre-operational surveillance or dry runs. ATM locations close to a highway or main road are more likely to be targeted because they facilitate a quick escape from the crime scene. Suspicious indicators may include:
- Unusual interest in CCTV and other security measures.
- Observation or manipulation of ATM components.
- Pry marks near cash dispenser and/or the front panel.
- Tubing, wires, or gas canisters attached to machine, or in the vicinity of the machine.
- Theft of explosive gas from businesses such as welding companies or motor vehicle repair shops.
- Reports of stolen license plates. Perpetrators of explosive breaching attacks have been known to place stolen license plates on the vehicles they use during their attacks.
