ATM Skimmers - This one has three bad news

1 - ATM Skimmers (nothing new)
2 - ATM vendor wanted to install it
3 - The vendor enjoyed legal protection from a top anti-corruption official in the Mexican attorney general’s office.

https://krebsonsecurity.com/2020/05/report-atm-skimmer-gang-had-protection-from-mexican-attorney-generals-office/

What is JackPotting? - You make the ATM give you a lot of cash (like a Slot Machine)

Thieves install malicious software and/or hardware at ATMs that forces the machines to spit out huge volumes of cash 


The Secret Service alert explains that the attackers typically use an endoscope — a slender, flexible instrument traditionally used in medicine to give physicians a look inside the human body — to locate the internal portion of the cash machine where they can attach a cord that allows them to sync their laptop with the ATM’s computer.


https://krebsonsecurity.com/2018/01/first-jackpotting-attacks-hit-u-s-atms/

ATM Theft Scenario: You insert your ATM card and your card is not returned (it happens) but, it will be given to the next guy who accesses the ATM (very bad). What if this is deliberately done by a Malware (named "Suceful") to steal your card (+ data) and give it to the bad guy.

Fact is Stranger than fiction.


From the article:

This particular sample can read all the credit/debit card track data and data from the card's chip (if the card has one), retain or eject the inserted card on demand, and can be controlled by the attackers via the ATMs PIN pad.

The malware is also capable of disabling the ATMs door, alarm and proximity sensors to prevent malicious activities from being detected.

While it's impossible for ATM users to spot a compromised machine, they are advised to be suspicious of machines that retain their cards. Giving a call to the bank if that happens is always a good idea, preferably while keeping an eye on the ATM in order to spot attempts by suspicious individuals to retrieve the card from the machine.

For more info:
http://www.net-security.org/malware_news.php?id=3098