E-Paper
Sign In
Middle East conflict puts the region at risk of ATM ‘jackpotting’, industry experts warn
ATM jackpotting is hacking a cash machine, physically and digitally, into dispensing large amounts of cash – like a slot machine spitting money after hitting the jackpot
- PUBLISHED: Wed 18 Mar 2026, 6:00 AM
[Editor's Note: Follow Khaleej Times live blog amid US-Israel-Iran war for the latest regional developments.]
The ongoing conflict in the Middle East is not only upsetting the global oil supply but also threatening the region’s automated teller machine (ATM) network, industry experts warned, noting: “From emergency banking measures to organised cyber-physical crimes targeting cash machines, banks could lose millions of dollars to ATM jackpotting.”
Recommended For You
“ATM jackpotting is hacking a cash machine, physically and digitally, into dispensing large amounts of cash – like a slot machine ‘spitting out’ money after hitting the jackpot,” cybersecurity expert Rayad Kamal Ayub explained to Khaleej Times.
“This is a systemic convergence of conflict pressure and legacy infrastructure exposure. When governments prioritise defence of national digital assets and critical infrastructure, organised crime networks exploit gaps in financial-crime enforcement and cash-distribution resilience,” Ayub added.
Stay up to date with the latest news. Follow KT on WhatsApp channels.
Industry analysts estimate the total GCC footprint exceeds 30,000 cash machines when networks across Qatar, Kuwait, Bahrain and Oman are included. Saudi Arabia maintains more than 15,000 machines, making it the region’s largest ATM market; while the UAE operates more than 4,600 ATMs.
Across the region, ATMs remain essential for salary withdrawals, remittances and retail liquidity. Despite strong growth in digital payments, cash usage continues to underpin everyday economic activity across transport, construction and small retail sectors.
Ayub said “the attacks typically involve deploying malware such as Ploutus after gaining physical access to ATM hardware. This allows criminals to trigger rapid cash dispensing within minutes without bank authorisation.”
“Authorities globally have tracked a sharp rise in jackpotting incidents. Cybercrime alerts indicate approximately 1,900 incidents since 2020, including more than 700 attacks and losses exceeding 20 million dollars in 2025 alone,” added Ayub, who is also managing director of Dubai-based Rayad Group.
Meanwhile, security executives note the high density of ATMs, combined with high replenishment cycles, increases jackpotting profitability. “Machines in suburban growth corridors and transport hubs can hold significantly larger reserves than comparable European units, changing the risk reward calculation for organised crime,” they noted.
Kevin Kalinich, global cyber practice leader at Aon, was quoted in an interview saying: “Organised networks now operate with decentralised execution models that enable rapid geographic expansion. These groups function like multinational logistics firms. Local crews perform physical intrusion while financial flows are consolidated internationally.”
Overcoming geopolitical instability
European law enforcement officials have repeatedly warned geopolitical instability can increase criminal mobility and complicate coordinated enforcement. Security analysts also believe broader Middle East tensions are indirectly influencing financial crime patterns by diverting law enforcement focus and slowing intelligence sharing.
Jen Easterly, director of the US Cybersecurity and Infrastructure Security Agency, earlier said financial institutions must anticipate opportunistic exploitation during crisis periods. “When geopolitical priorities shift, cascading risks can emerge in unexpected parts of financial infrastructure,” she noted at a resilience forum," he explained.
Ayub added "the grey market circulation of counterfeit ATM components and maintenance tools has also increased in some regional trade corridors, noting the conflict environment has already triggered adjustments in regional retail banking operations."
"Attackers frequently exploit generic service keys, outdated operating systems or unsecured USB ports before installing malware that bypasses bank authorisation controls," he added.
Ayub pointed out that although jackpotting losses are borne directly by banks, the broader economic consequences can affect households and businesses.
"The region's banking sector must navigate geopolitical volatility and evolving organised crime tactics," Ayub underscored, noting "jackpotting risks underscore a deeper structural shift."
“As global threat patterns evolve, financial resilience becomes a competitive advantage,” Ayub said. “Institutions that adapt fastest will limit losses and strengthen long term trust.”
