ATM Man-in-the-Middle Attacks Explained: A Conversation With CSG's Experts

Man-in-the-middle attacks have become one of the most common — and hardest to spot — threats facing ATMs today. In this Bank Customer Experience Podcast episode, host Brad Cooper talks with Cook Solutions Group's Alyssa Luecke and Michael Strange about how these attacks work, how they've evolved, and what financial institutions can do to defend against them. Watch the full conversation above.

What this episode covers

Over about 20 minutes, the discussion walks through how a "black box" device intercepts communication between an ATM and its host, why these attacks now rely on wireless control and server spoofing, and the layered defenses — from alarmed top hats to certificate pinning at the host level — that stop them. It's a practical, field-informed look from a team that works these cases directly with financial institutions and law enforcement.

In this episode

• 0:56 — What is a man-in-the-middle ATM attack?

• 4:31 — What a typical attack looks like, step by step

• 10:27 — Working with the Secret Service and FBI on investigations

• 12:56 — Are white-label and independently owned ATMs targeted too?

• 13:24 — The layers of security every institution should have

• 18:56 — The host-level defense: TLS 1.2 Enhanced with certificate pinning