ATM Attacks: There Is No Solution That Lasts Forever
On 22 and 23 September 2026, the Allianz MiCo in Milan hosted the first edition of WeSec – The Security Expo, promoted by ABI together with CERTFin, ABI Lab, OSSIF and FEduF: two days in which institutions, authorities, banks and businesses came together to discuss security as what it has now become — a matter for the whole system.
Following his talk in the OSSIF session on ATM security, Domenico Morano, Sole Director of MCM Group, answered questions from Euroborsa: the double-explosion technique, the shift from passive to active defence, and why protecting ATMs should be seen as a strategic investment rather than a cost.
Mr Morano, the latest OSSIF data presented at WeSec point to a worrying resurgence of attacks on ATMs across Italy, with increasingly aggressive and destructive techniques — from gas and solid explosives to heavy mechanical forced-entry attempts. From MCM Group's perspective, how have the dynamics of these attacks changed, and how must the engineering of physical devices rethink structural resistance to withstand threats of extremely high kinetic impact?
It is a genuinely demanding question for us as solution manufacturers because — as I tried to explain in the OSSIF session — there is no solution that works forever. If there were, we would have made our fortune.
Bear in mind that any solution, even the most innovative, has a fairly short life cycle: we have seen that within three, four, at most five years a solution is overcome. Not because it was badly designed or badly built, but because the gangs analyse and evolve, both in their analysis and in the means they have at their disposal.
You mentioned explosives. The technique doing real damage to banks and postal operators today is the double explosion. Over the years, in that game of cops and robbers, we have fitted ATMs with devices that prevent explosives from being introduced. Their technique now is this: the first explosion destroys those devices, and the second allows the attack. It is a never-ending race.
The message we always try to get across as manufacturers is that we need genuine synergy — information sharing between us, the ATM manufacturers, the banks and law enforcement. Because that is where I, as an engineer — as someone who puts engineering to work — can analyse what a criminal organisation is actually doing.
During the panel you stressed the need for highly innovative technology to make break-in attempts futile. Beyond the passive reinforcement of armour and safes, the real challenge lies in intelligent active countermeasures and gas saturation and inhibition devices. As a system integrator covering design, manufacturing and installation, how do you combine these subsystems into a coordinated architecture that neutralises the value of the loot without endangering public safety or the structural integrity of buildings?
You have put your finger on the problem. What matters most here is integrating many solutions: there is no single one, there have to be many. There are the so-called guillotines, which stop the "marmotta" — the explosive charge — from being slid into the ATM; there are banknote staining systems. But over time we have seen these solutions, as I said, partly overcome by the ingenuity of the criminals.
That is why we have started shifting our focus to the outside of the branch, the outside of the ATM, introducing extremely intelligent devices and barriers. We call it the Advanced Security Mask: an advanced device that, thanks to state-of-the-art electronics, protects the ATM at the very moment of the attack. And, I repeat, it has to be combined with other solutions, such as video recognition and artificial intelligence.
Right now the facts are proving us right: Alessio Bifarini of Poste Italiane showed how, since Poste began investing heavily in these devices, its risk position relative to the banks has completely reversed.
So: intelligent solutions which, again, we must accept have a fairly limited life. So what do you do — give in to despair? No. The answer is not one specific product, but working with companies that, through innovation, strive to stay one step ahead of criminals.
A successful attack means not only direct cash losses, but serious service disruption, high recovery costs and a loss of trust in the local community. How can the banking sector move beyond seeing security as a pure cost, and treat investment in cutting-edge anti-intrusion technology as a strategic asset for operational continuity and for protecting its brand locally?
We have seen that attacks, especially in certain areas and in outlying municipalities, cause real social unease. I have also seen mayors and prefects speaking out and raising the level of attention, so bank chairmen too are starting to feel the pressure.
It goes without saying that investment is needed. As we said earlier: innovation is needed, intelligent solutions are needed. Not one solution but several, and synergy between the solutions being integrated.
Here I can personally bear witness to what Poste Italiane is doing. Poste has made an enormous investment — tens of millions of euros — to secure a very large ATM fleet, much of it in outlying areas: Poste Italiane, remember, unlike the big banking groups, is required to cover the entire country. And thanks to that investment it is now reaping the benefits.
I believe that, in light of today's testimony and the data highlighted by both ABI and Poste Italiane, the big banking groups should reconsider their investment policies. It is an almost unavoidable step.