With ATM hacking and credit card skimming becoming more easily prevented and detected, some criminals are resorting to the use of explosive breaches to target ATM machines.  Three attacks in the month of April in the Seattle, Washington area has provoked law enforcement to issue an intelligence bulletin on the topic.

Criminal actors breaching ATMs with explosives have become a common occurrence in Europe and South America in recent years.1 For example, the United Kingdom has documented over 100 attacks of this nature since 2013, resulting in significant financial losses and damages to banks and ATMs. One group in the United Kingdom targeted 28 ATMs at banks, supermarkets, and post offices and stole over $1 million, while causing over $650,000 in damage. Recent incidents in the Washington State, along with incidents in California, Missouri, Pennsylvania, and Utah, suggests these types of explosive breaching attacks have now propagated to the United States. As such, financial institutions, police, and other first responders will likely encounter these types of attacks on a more frequent basis.

• In October 2018, criminals used a pipe bomb to attack an ATM in St. Louis, Missouri. The attempt damaged the ATM, but was unsuccessful.
• In June 2018, criminals attempted to rob multiple ATMs in Philadelphia, Pennsylvania by inserting pyrotechnics into the ATMs. The attempts damaged the ATMs, but were unsuccessful.
• In January 2018, criminals attempted to rob three ATMs in Salt Lake City, Utah by using flammable liquid and propane. The attacks were unsuccessful, and three suspects were eventually arrested.
• In August 2017, criminals attacked two ATMs in San Diego, California by using gasoline and a pipe bomb. One attack resulted in the contents of the ATM being stolen. Two suspects were eventually arrested.
• In April 2017, criminals attacked ATMs in Burbank and Los Angeles, California using propane. The attacks were unsuccessful, and two suspects were eventually arrested.

According to the bulletin, there are several potential indicators of a pending explosive breach attack and that “Banks and businesses with ATMs should be aware of suspicious activity occurring near their machines as suspects may engage in pre-operational surveillance or dry runs. ATM locations close to a highway or main road are more likely to be targeted because they facilitate a quick escape from the crime scene. Suspicious indicators may include: