ATM theft laws and penalties sit at the intersection of several federal statutes, and the consequences stack fast. A single incident can bring charges under the bank robbery statute, access device fraud, the Computer Fraud and Abuse Act, and aggravated identity theft, with prison exposure that ranges from one year for small larcenies to life for a killing during the offense. If you’re the victim of card data theft at an ATM, federal law caps your liability, but only if you move quickly.
The Methods That Drive the Charges
How an ATM is hit determines which statute a prosecutor reaches for. Skimming installs a device on or inside the card slot to read the magnetic stripe, usually paired with a pinhole camera or keypad overlay to capture the PIN. Shimming is the chip-card version: a paper-thin circuit board slipped inside the reader intercepts EMV data.
Jackpotting targets the machine’s computer. A thief opens the casing, connects a laptop or specialized device, and installs malware that forces the ATM to dispense its cash. Some variations swap the hard drive entirely.
Physical attacks are the crude end: a vehicle and chains to rip the machine off its base, or cutting torches and small explosives to crack the safe. The property damage often exceeds the cash inside.
Federal Statutes Used to Prosecute ATM Theft
Most ATM crimes land in federal court because the money belongs to FDIC-insured institutions and the transactions cross state lines electronically. One point of confusion worth clearing up: federal banking law does not treat ATMs as bank branches.1Office of the Comptroller of the Currency. Interpretive Letter 1165 – 12 USC 36, 12 CFR 5.30 Federal jurisdiction rests on the insured funds and the interstate network, not on branch status.
Bank Robbery and Larceny — 18 U.S.C. 2113
This is the backbone. The statute covers anyone who steals money or property belonging to or in the care of a bank, credit union, or savings and loan. Taking cash by force or intimidation is charged as robbery. Walking off with funds without confronting anyone is larceny. Entering a building housing a bank with intent to commit a felony or larceny inside is also covered.
Access Device Fraud — 18 U.S.C. 1029
Skimming and shimming cases run through this statute. “Access device” is defined broadly to include any card, code, account number, or PIN that can be used to obtain money or move funds. Making or using counterfeit devices, possessing device-making equipment, and trafficking in stolen card data all qualify when the conduct affects interstate commerce.2Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices
Computer Fraud — 18 U.S.C. 1030
Jackpotting triggers the Computer Fraud and Abuse Act because ATMs are “protected computers” under the statute, both as machines used by a financial institution and as machines used in interstate commerce.3Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers Intentionally causing damage to a protected computer is a separate offense from the underlying theft.
Aggravated Identity Theft — 18 U.S.C. 1028A
When someone uses another person’s identifying information during a related felony, prosecutors can add this charge. It carries a mandatory two-year prison term that runs consecutively to the sentence for the underlying crime. Courts cannot shorten the base sentence to offset it, and probation is not available.4Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
Prison Time and Fines
The bank robbery statute alone climbs in tiers:
- Larceny of $1,000 or less: up to one year in prison.
- Larceny over $1,000: up to 10 years.
- Robbery involving force, intimidation, or extortion: up to 20 years.
- Use of a dangerous weapon: up to 25 years.
- A killing during the offense: at least 10 years, up to life or death.
Felony fines under the general federal fines statute reach $250,000 per count for an individual.5Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
Access device fraud adds up to 10 years for creating or using counterfeit cards and up to 15 years for possessing device-making equipment or conducting certain unauthorized transactions. Second offenses double those maximums.2Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection With Access Devices Jackpotting under the Computer Fraud and Abuse Act adds another 5 to 20 years depending on intent, damage, and prior convictions.6Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Because prosecutors stack these statutes, an ATM theft involving cloned cards and malware can produce decades of combined exposure. The mandatory two-year consecutive term for aggravated identity theft sits on top of whatever the base charges deliver. Courts also routinely order full restitution for the stolen funds and for damage to the machine.
Consumer Liability If Your Card Data Was Stolen
If someone drains your account after skimming or shimming your card, federal law caps your losses, but the cap turns on how fast you report. The Electronic Fund Transfer Act sets three tiers.7Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Report within 2 business days of learning your card was lost or stolen: liability is capped at $50, or the total unauthorized transfers before you reported, whichever is less.
- Report after 2 business days but within 60 days of receiving your statement: liability rises to as much as $500.
- Report after 60 days from your statement date: unlimited liability for unauthorized transfers occurring after that 60-day window. The bank has no obligation to reimburse those.
Skimming and shimming victims get a stronger rule. When the card was never physically lost or stolen and only the data was copied, reporting the unauthorized transactions within 60 days of the statement showing them gives you zero liability.8Federal Deposit Insurance Corporation. Laws and Regulations – EFTA Electronic Fund Transfer Act The $50 and $500 tiers apply only when the physical card was lost or stolen. Miss the 60-day statement window, though, and the protection goes away regardless of how the theft happened.
What to Do Right After ATM Fraud
Call your bank the moment you spot an unauthorized withdrawal or suspect your card was compromised. Use the number on the back of the card, your online banking, the mobile app, or a branch.9Office of the Comptroller of the Currency. Credit Card and Debit Card Fraud Ask the bank to block the card and issue a replacement. That call stops the liability clock.
File a police report with your local department. It creates an official record for your dispute and helps investigators track patterns. For skimming, you can also file with the FBI’s Internet Crime Complaint Center at ic3.gov.10Federal Bureau of Investigation. Skimming
Pull together whatever you have for the dispute: the ATM location, the date and approximate time, and any transaction or terminal ID numbers from a receipt. These let the bank pull the right footage and trace the transaction. Most banks accept disputes through their website or app.
Bank Investigation Deadlines Under Regulation E
Once you report the error, federal rules run the clock on the bank. It must investigate and reach a determination within 10 business days. If it finds an error, it must correct the account within one business day of that finding.11eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
If the bank needs longer, it can take up to 45 days, but only if it provisionally credits your account within the first 10 business days. It can withhold up to $50 of that provisional credit when it has a reasonable basis to believe you may bear some liability. You get full use of the credited funds while the investigation continues.
A 90-day extension exists for international transfers, point-of-sale debit transactions, and transfers occurring within 30 days of the first deposit to a new account. That longer window does not apply to ATM transactions, even when the ATM sits inside a store.11eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
The bank can ask for written confirmation of your oral report within 10 business days and must tell you so when you first call. If you don’t send the written statement on time, the bank can skip the provisional credit. It still has to start investigating either way.12Consumer Financial Protection Bureau. 12 CFR 1005.11 – Procedures for Resolving Errors
Business Accounts Are Not Covered by These Rules
The liability caps and mandatory investigation timelines above apply to personal consumer accounts. Business accounts operate under Article 4A of the Uniform Commercial Code instead of the Electronic Fund Transfer Act. Under those rules, a bank can shift liability for unauthorized transfers to the business owner if the bank used a “commercially reasonable security procedure” that the business agreed to.
A small business that loses funds through a compromised ATM-linked debit card or unauthorized wire may have no right to reimbursement if the bank followed its agreed verification process. Review the security procedures in your account agreement, and look at daily transfer limits, dual-authorization requirements, and fraud monitoring add-ons. The gap between consumer and business protection catches many owners off guard.