ATM Transaction Reversal Frauds: Cashing Out Without Malware
Hector Cuevas Cruz explains Transaction Reversal Frauds (TRF), an attack that abuses banking operational rules to cash out ATMs without malware or drilling.
Summary
The Mechanics of Transaction Reversal Fraud (TRF)
Transaction Reversal Fraud (TRF) is a sophisticated physical-logical attack where criminals exploit business logic error-handling rules in ATMs to steal cash with zero net balance deduction.
Abusing Dispenser Error Handling and Sensor Timing
Hector Cuevas Cruz explains how manipulating the shutter during note presentation triggers an intentional timeout, tricking the ATM into reporting an uncollected cash fault.
Automated Account Reversals and Cash Theft
Because the host bank automatically reverses the debit transaction when an uncollected fault is logged, the attacker retains the physical cash while restoring their account balance.
Hardening ATM Shutter Timing and Host Reconciliation
The author provides banking institutions with dispenser sensor telemetry rules, dual-audit logging, and backend reconciliation controls to mitigate TRF attacks.
Related talks
CODE BLUE·45 min
Olga Kochetova · Alexey Osipov
Industry experts analyze emerging threats surrounding [CB16] ATMS how to break them to stop the fraud by Olga Kochetova & Alexey Osipov.
Payment Village·41 min
Meadow Ellis
Meadow Ellis demystifies ATM security architecture, explaining internal components, cash dispenser controllers, and why legitimate ATM research is so difficult.
Main Stage·39 min
Matt Burch
Analysis and proof-of-concept exploitation of six zero-day vulnerabilities in Diebold Nixdorf Vynamic Security Suite ATM disk encryption.