Connecticut ATM Jackpotting Case: How Four Men Allegedly Stole $529,220 From ATMs
A string of ATMs across Connecticut was allegedly targeted in a fast-moving cash-out scheme that did not rely on stolen debit cards, customer PINs, or ordinary bank fraud. Federal prosecutors say four men used a method known as “jackpotting” to force machines to dispense the cash stored inside them, draining more than half a million dollars from eight ATMs over 10 days.
The case stands out not only because of the amount allegedly stolen, but because of the route. Several machines were located at Interstate 95 rest stops, where traffic is constant, faces change by the minute, and a person returning to the same ATM may not immediately stand out. We are looking at a case that blends old-fashioned physical access with modern malware-style financial crime.
Four Men Charged in Connecticut ATM Jackpotting Scheme
Federal prosecutors in Connecticut identified the defendants as Euclides Moreno Itanare, 28, of Raleigh, North Carolina; Willian Ricardo Flores, 49, of the Bronx, New York; Alberto Jose Freites Arvilla, 41, of Queens, New York; and Luis Jose Freites Arvilla, 38, of Lynn, Massachusetts. The four men, described by federal officials as Venezuelan citizens, were charged with offenses tied to the alleged ATM jackpotting scheme.
The charges include interstate transportation of stolen property, which carries a maximum prison term of 10 years, and conspiracy, which carries a maximum prison term of five years. The defendants were arrested on June 25, 2026, and are currently detained, federal officials said.
What Prosecutors Say Happened at the ATMs
The alleged spree ran from Aug. 8 to Aug. 18, 2025. Prosecutors say the men targeted at least nine ATMs in Connecticut, including machines in Milford and Ansonia, as well as ATMs at I-95 rest stops in Fairfield, Branford, Madison and Darien.
Eight machines allegedly produced cash. A ninth ATM in Ansonia did not, because it had a software patch that protected it against this type of theft. That detail may become one of the most important parts of the case for banks and ATM operators, because it shows that updated defenses can make the difference between a failed attempt and a six-figure loss.
Federal officials say the men allegedly stole $529,220 from the eight ATMs. Surveillance video showed a similar pattern at the machines: Luis Freites Arvilla allegedly served as a lookout, while Alberto Freites Arvilla opened the ATM’s hood and accessed its internal components. Afterward, Luis Freites Arvilla, Itanare, and Flores allegedly took turns withdrawing cash over several hours, sometimes changing clothes before approaching the same machine again.
Why This Was Not a Typical ATM Theft
This was not the familiar kind of ATM crime where someone installs a skimmer, steals a card number, or watches a customer enter a PIN. Jackpotting targets the machine itself.
In simple terms, jackpotting involves manipulating an ATM to dispense cash without a legitimate transaction. The FBI has warned that threat actors exploit both physical and software weaknesses in ATMs, using malware-based attacks to cause ATMs to dispense money without customer authorization.
That makes jackpotting more like a hybrid crime. It is partly a burglary, partly a cyberattack, and partly a coordinated cash-out operation. The machine is not just robbed from the outside. It is allegedly compromised from within.
The Bigger Warning Behind the Connecticut Case
The Connecticut case arrives during a national rise in ATM jackpotting incidents. In a February 2026 FBI FLASH advisory, the bureau said 1,900 ATM jackpotting incidents had been reported since 2020. More than 700 incidents occurred in 2025 alone, producing more than $20 million in losses.
That trend gives this case a broader significance. We are not looking at an isolated ATM theft story. We are looking at a financial-crime pattern that has moved from niche cybercrime circles to mainstream law-enforcement concern.
The FBI advisory describes malware such as the Ploutus family as one tool used in jackpotting. The malware can interact with the ATM’s internal cash-dispensing functions, allowing attackers to command the machine to release cash without a bank card, customer account or normal bank authorization.
Why I-95 Rest Stops Matter in the Alleged Scheme
Several of the targeted ATMs were located along Interstate 95, one of the busiest travel corridors in the Northeast. That matters because rest stops create a very different environment from a neighborhood bank branch.
At a branch, employees may recognize repeated visits, unusual behavior, or a person lingering near a machine. At a rest stop, travelers constantly arrive and depart. People change clothes, move between vehicles, wait around, use bathrooms, buy food, and return to machines without necessarily drawing attention. That kind of setting can make repeated ATM visits look less suspicious than they might in a quieter location.
The locations named by prosecutors suggest the alleged operation depended not just on technology, but on movement, timing and anonymity.
The Software Patch Detail May Be the Real Lesson
The Ansonia ATM is the quiet turning point in the story. Prosecutors say the machine was protected by a software patch that stopped the theft from going through.
That single failed attempt shows how important maintenance, updates, and monitoring can be. ATMs are often treated by the public as simple cash machines, but they are specialized computers connected to cash-dispensing hardware. When those systems are outdated, poorly monitored, or physically vulnerable, they can become attractive targets.
The FBI recommends defenses that combine physical security and system integrity, including better locks, sensors, security cameras, controlled access, device whitelisting, automatic shutdown settings, and stronger logging.
What Banks and ATM Operators Should Take From the Case
The Connecticut allegations show that ATM security cannot rely on one layer of protection. A camera may record a suspect, but it may not stop the cash from leaving. A locked cabinet may help, but only if the lock is not easily bypassed. Software can block an attack, but only if it is up to date and properly deployed.
The strongest defense is layered.WeWe need physical security that makes tampering harder, monitoring that quickly detects unusual access, software controls that stop unauthorized commands, and incident response systems that preserve evidence after an attempted compromise. The FBI also recommends integrity validation against trusted system baselines, which helps operators detect unauthorized files or changes that do not belong on the ATM.
What Customers Should Know
For ordinary ATM users, the immediate concern is different from card-skimming fraud. Jackpotting generally targets the machine’s cash supply, not a customer’s account credentials. That does not mean customers should ignore suspicious machines, but it does mean this kind of case is usually more directly damaging to banks, credit unions, ATM owners, and insurers.
Customers should still be cautious. An ATM with visible damage, loose panels, exposed wiring, strange external devices, or repeated out-of-service behavior should be avoided and reported. Suspicious activity around an ATM, especially someone lingering near internal panels or repeatedly returning to the same machine, should also be treated seriously.
The Legal Case Is Still Alleged
The charges are allegations, not proof of guilt. Federal prosecutors stressed that a criminal complaint is not evidence and that each defendant is presumed innocent unless proven guilty beyond a reasonable doubt.
That legal distinction matters. The public details describe what prosecutors say happened, but the case still has to move through federal court. Evidence, surveillance footage, digital records, witness testimony, and defense arguments will determine what can be proven.
A Half-Million-Dollar Case With a National Echo
The Connecticut ATM jackpotting case is gripping because the image is almost cinematic: ATMs allegedly forced to spill cash, suspects returning in shifts, clothing changes, rest-stop locations, and more than $529,000 gone in less than two weeks.
But the larger story is less flashy and more serious. ATMs are part of the country’s everyday financial infrastructure. People use them at banks, gas stations, rest stops, grocery stores, and convenience stores without thinking about the complex systems behind the screen. Jackpotting exposes a weakness in that trust.
The case shows how quickly financial crime can shift when criminals combine physical access with software manipulation. It also shows that prevention is possible. One patched ATM in Ansonia allegedly stopped what other machines did not.
For banks, credit unions, and ATM operators, that may be the clearest message from Connecticut: the next major loss may not begin with a stolen card. It may begin with an unlocked panel, an outdated system, a blind camera angle, or a missing software update.
