What is ATM security monitoring?

ATM security monitoring is the ongoing, real-time oversight of your ATM and ITM fleet to detect and respond to threats as they happen. CSG's Network Operations Center watches for digital attacks, physical tampering, and fraud, combining logical safeguards like patch management and encryption with physical detection like vibration sensors and smart cameras. Alarm events are backed by 24/7 video verification, so real threats trigger fast alerts and response.

What types of ATM and ITM security threats does CSG protect against?

CSG defends against digital threats like malware, zero-day vulnerabilities, and man-in-the-middle attacks, and physical threats like skimming, jackpotting, cash harvesting, hook-and-chain, hard drive theft, and explosive attacks. Our approach addresses 13 known ATM and ITM threat vectors with 13 layers of logical and physical security.

How do you protect ATMs from jackpotting?

Jackpotting attacks force an ATM to dispense cash by installing malware or unauthorized hardware. CSG defends against it on two layers. Logical protections, including USB locking, hard drive encryption, port security, MAC address binding, and endpoint protection, block unauthorized software and devices. Physical measures like tamper detection and smart cameras catch forced entry. Network Operations Center monitoring flags suspicious activity so it can be stopped before cash is lost.

How does CSG's unified ATM security solution work?

CSG brings monitoring, analytics, and threat detection for your ATM and ITM fleet into one managed solution. It combines patch management, encryption, secure host communication, fraud detection, and video surveillance, all managed through our Network Operations Center and visible in Cook Command Center.

What logical security features are included?

Logical security features include automated Windows patching, hard drive encryption, TLS 1.2 host communication, deprecated cipher and protocol removal, USB locking, MAC address binding, network port security, and endpoint protection, all designed to block unauthorized access to the ATM.

What physical security measures are included?

Physical security measures include anti-theft barricades, alarm top hats, heat and vibration sensors for the safe, smart cameras that detect skimming devices, encrypting PIN pads, cash trap cameras, electronic lock management, and the ATM dispenser camera. Together they detect tampering, unauthorized hardware, and forced entry, and trigger alerts.

How does CSG address new and evolving ATM fraud techniques?

CSG's Network Operations Center monitors for emerging fraud patterns, and our Fraud Detection Engine can take a machine offline when it detects cash-harvesting activity. Scheduled security updates and ongoing threat research keep your defenses current as attack methods change.

What role does Cook Command Center play?

Cook Command Center is CSG's secure, web-based portal for your fleet. You can check device status, request service, track tickets, view alerts, and pull reports from any device, all in one place.

Can CSG's security solution integrate with our existing ATM infrastructure?

Yes. CSG's security layers work with your current ATMs, network, and video surveillance system, so you can strengthen protection without replacing your fleet.

What support services does CSG offer?

CSG offers Network Operations Center monitoring, 24/7 video verification, proactive patching, remote support, and professional services for security audits and compliance.

How can I learn more or request a demo?

Download the ATM Terminal Security whitepaper, watch the videos on this page, or request a fraud-risk consultation through the contact form, and a CSG specialist will follow up to schedule a time.

Who benefits from CSG's ATM and ITM security solutions?

Banks, credit unions, and other organizations that operate ATM or ITM networks and need both digital and physical protection from one provider.

What is dual control access for ATMs, ITMs, and TCRs?

Dual control access requires two authorized electronic credentials to open a protected ATM, ITM, or TCR, so no single person can access cash or secure assets alone. Using dormakaba locks, it removes the risks of physical keys and creates a complete audit trail of every access event, helping reduce operational risk, improve accountability, and support regulatory compliance.

ATM Security and Fraud Prevention for Banks & Credit Unions

Threat	The Cook Solution
DMA Attacks Direct Memory Access	BIOS Hardening Change your BIOS passwords from manufacturer default and disable any unused ports on the motherboard of the ATM PC including but not limited to PCIe and M.2 Ports. Response Layer: Triggers strobe, siren, or alarm if physical tampering is detected.
Zero-Day Windows Attacks	RV Patch Management Stay up to date with automated quarterly patches applied remotely by our secure Network Operations Center.
Malware Attacks	RV Security+ Stay protected against malware and unauthorized USBs with application control and anti-virus. Response Layer: Triggers strobe, siren, or alarm during unauthorized access attempts.
Hard Drive Theft & Attack	Hard Drive Encryption Keep your hard drive data encrypted with the highest encryption level available. Response Layer: Triggers strobe, siren, or alarm if cabinet access or physical intrusion is detected.
Man-in-the-Middle	TLS 1.2 Host Encryption Secure your ATM communication to the host and prevent attackers’ ability to spoof communications.
ATM Cash Harvesting “White Plastic” Fraud	SAN-FDE Our Suspicious Activity Notification (SAN) and Fraud Detection Engine (FDE) monitor suspicious transactions and proactively disable your ATM.
Skimming Deep Insert Skimming \| Fascia manipulation	SAN-Smart Camera Detect and alert if a person is loitering and/or installing unauthorized devices at your machine. Integrates with SAN camera.
Physical Attacks Hook & Chain \| Shutter Manipulation \| External	Piko Camera Analytics Detect and alert with intelligent video, line crossing & object detection. Integrates with SAN camera. Response Layer: Triggers strobe, siren, or alarm during verified threat events.
Explosive Attacks	Heat and Vibration Alarms Use your manufacturer-provided mitigation resources. Integrates with SAN camera.
Signal Jammers Cell \| Alarm	Backup Internet Use secondary internet for redundancy and failover. Real-time alerts if alarm goes offline. Integrates with SAN camera.
Glue & Tap Fraud	Education and Awareness Educate your staff and end users on upcoming socially engineered threats.
Chargeback Fraud	Piko Screen Capture \| RemoteView Screen Capture Advanced technology that captures multi-camera angles in real-time & recorded footage of your ATM displays.
Any Suspicious Activity	PikoVerify and Top hat Alarms Real-time video verification by integrating your alarm system with Piko Camera Analytics to guard against security threats 24×7.

Windows Patching

Keeps the ATM’s operating system up to date with the latest security patches, protecting it from known vulnerabilities.

Hard Drive Encryption

Ensures that data on the ATM’s hard drive is encrypted and protected from unauthorized access.

TLS 1.2 to ATM Host

Secures communication between the ATM and its host server using TLS 1.2, preventing interception of sensitive data.

Deprecated Ciphers

Disables outdated encryption ciphers that could be exploited by attackers, ensuring only secure algorithms are used.

Deprecated Encryption Protocols

Ensures that outdated and insecure encryption protocols are not used, reducing the risk of exploitation.

Network Port Security

Secures network ports on the ATM to prevent unauthorized access and data breaches.

Network MAC Address Binding

Restricts network access to authorized devices only, based on their MAC addresses, ensuring that only trusted devices can connect to the network.

USB Locking

Restricts access to USB ports on the ATM, preventing unauthorized devices from being connected.

Endpoint Security

A comprehensive security solution that includes antivirus, Endpoint Detection and Response (EDR), and behavior analytics to protect the ATM from various threats.

Anti-Theft Barricade

Provides physical barriers around the ATM to prevent theft or unauthorized access, serving as the first line of defense.

Alarm Top Hat

Adds an additional alarm system to the ATM, alerting authorities or security personnel in case of tampering or forced entry.

Heat & Vibration Sensors for Safe

Detects tampering or unauthorized access to the ATM safe through heat or vibration, triggering alarms if suspicious activity is detected.

Electronic Lock Management for ATMs, ITMs & TCRs

CSG replaces traditional key management with secure electronic credentials across your ATM, ITM, and TCR fleet, delivering control, accountability, and a complete audit trail of every access event. Available today on dormakaba Axessor Apexx, delivered as a fully managed service.

Explore Remote Lock Management →

SAN-SCM (Suspicious Activity Notification – Smart Camera Module)

Protects against skimming attacks by detecting unauthorized card-reading devices attached to the ATM.

EPP (Encrypting PIN Pad)

Secures the PIN entry process by encrypting the PIN as it’s entered, preventing interception by unauthorized devices or software.

Cash Camera for TRF

Monitors and records any attempts to tamper with or remove cash traps, providing evidence and deterrence against trap removal fraud.

SAN-FDE (Suspicious Activity Notification – Fraud Detection Engine)

A tool to assist in the detection and prevention of cash harvesting attacks, helping to protect the ATM’s cash assets from unauthorized access.

ATM Dispenser Camera

NEW

A 2MP IP camera mounted inside the ATM or ITM to record the cash dispenser. It shows whether cash was dispensed, retracted, or left behind, and it gives you a clear view of skimming panels and jackpotting activity near the dispenser. It works with your existing VMS.

See how the dispenser camera works →