Hawks arrest Western Cape duo who hit the R7m ‘jackpot’ after hacking ATMs with rogue software

After netting R7-million in cash from hacked ATMs in the Western Cape, two men who were posing as cash-in-transit guards were arrested near Peddie in the Eastern Cape earlier this week.

Hawks spokesperson Lieutenant Colonel Avele Fumba said after the men’s arrest in East London, they were linked to another ATM hacking in Mdantsane and will appear again in court for this charge on Thursday, 20 March 2025.

While the men appeared in court on Wednesday, 19 March, he said the investigation is at a sensitive stage and their names are being kept secret.

In 2018, the US Secret Service warned about “jackpotting software”, saying at the time that ATM jackpotting is a sophisticated crime in which thieves install malicious software and/or hardware at ATMs that force the machines to dispense huge volumes of cash on demand. Similar arrests were made in Europe last year.

“To execute a jackpotting attack, perpetrators must gain physical access to the cash machine and install malware, or specialised electronics, or a combination of both, to control the operations of the ATM,” the US statement read. 

Last year, four men were arrested in New York after they used jackpot software to hack ATMs, allowing the machine to dispense money “untethered to any bank account”.

Detailing the arrest, Fumba said the two suspects, aged 38 and 35, were allegedly behind a series of ATM fraud incidents in the Western Cape. He said they used software to hack the machine.

“They were intercepted near Peddie on 17 March 2025 following a multidisciplinary intelligence-driven operation led by the East London Serious Organised Crime Investigation team.

“It is reported that one of the suspects will allegedly disguise himself as a cash-in-transit security guard, armed with a rifle, to allegedly create the illusion that they are legitimately servicing the ATM,” he said.  

He said the two men had so far netted R7-million.

“The previous crime allegedly committed is linked to an estimated R7-million loss. This prompted the Western Cape SAPS Commercial Crimes Unit to activate the Eastern Cape Hawks on 15 March 2025, because they suspected that the criminals had moved into the province,” Fumba added.

He said further information led the Hawks team to track the suspects to a guesthouse in East London. When the police arrived, however, they discovered that the two suspects had already left and they were told that they were travelling in a white Toyota Fortuner towards Peddie.

Fumba said the police managed to intercept the team on the N2 and arrest the two men. 

“A search of the car uncovered a laptop containing fraudulent ATM-access software and other crucial evidence,” he said. The men will also be transferred to the Western Cape to face charges there.

The provincial head of the Hawks in Eastern Cape, Major General Mboiki Obed Ngwenya, assured the public that the Hawks remain committed to dismantling criminal syndicates and ensuring that those responsible for economic crimes are brought to justice. 

The latest criminal innovation to attack ATMs comes as the South African Banking Risk Information Centre (Sabric) announced a historic 30% reduction in ATM bombings in November, December and January. 

In a statement by Online Intelligence, a supplier of software to manage risk and a partner in Project Big Bang - as the initiative to bring down ATM bombings is called - said they were part of a team that included Sabric, the Petroleum Security Initiative and the SAPS.

The initiative ran from May 2024 until January 2025, and was formed in response to the alarming 72% increase in ATM bombings from 2019 to 2023, as reported by Sabric.

The operation resulted in the seizure of explosives, vehicles, firearms, clothing used at crime scenes and more than R400,000 in dye-stained cash. DM