Read the terminal.
Catch the skim.
Skimming is a device crime, and transaction models are blind to it. ATMList watches 2.1M ATMs for hardware and read-pattern signatures, then scores every withdrawal in the authorization path — under 40 ms, with the evidence attached.
- 2.1M terminals monitored
- 70+ markets live
- <40 ms P50 decision
Detection case
ATM-SG-0182
Raffles Place MRT · Singapore · opened 03:14:07 SGT
Terminal risk
0.94
- 03:14:07Terminal telemetry
Service door opened
Out-of-window access with no work order on file.
- 03:14:41Card reader
Read-pattern shift
Magnetic-stripe read failures up 6× on this terminal.
- 03:15:02Device graph
Skim kit signature matched
Hardware profile matches kit family B-112, seen in 14 markets.
- 03:15:09detect-2
Terminal risk 0.94
Above the block threshold of 0.80 set by the issuer policy.
- 03:15:11Decision
Withdrawals blocked, field team dispatched
38 ms response · evidence pack attached to the case.
- 94%
- Of known kits caught Before first cash-out
- <40ms
- P50 decision time Inside the auth path
- 2.1M
- Terminals monitored 70+ markets
- 8×
- Faster investigations Cases assembled by agents
Everything you need to reason about the device.
Legacy fraud models score the transaction. ATMList scores the machine that produced it — the reader surface, the door events, the dispense pattern, the kit families seen before.
Score the withdrawal, not the cardholder.
Every authorization reaches detect-2 before the cash leaves the slot: terminal risk, reason codes, and allow, step up, or block in under 40 ms.
- Allow, step up, or block in the auth path
- Reason code on every decision
- No terminal agent, no hardware change
Authorization stream
POST /v1/score/withdrawal
model detect-2
P50
38 ms
Requests / h
184,200
- ATM-SG-0182SGD 300Raffles Place · SingaporeKIT_SIGNATURErisk 0.94BLOCK
- ATM-HK-4410HKD 5,000Central · Hong KongDOOR_OUT_OF_WINDOWrisk 0.71STEP_UP
- ATM-PH-2204PHP 20,000Makati · ManilaCASH_TRAP_PATTERNrisk 0.88BLOCK
- ATM-GB-3381GBP 200Croydon · LondonGEO_VELOCITYrisk 0.44STEP_UP
- ATM-JP-0917JPY 50,000Dogenzaka · Tokyo—risk 0.18ALLOW
One kit, many machines.
Watched terminals report reader and door telemetry. The device graph matches one hardware fingerprint to the same kit family across markets.
- Kit families with first-seen market
- Cash-out attempts per family
- Fingerprints correlated across markets
Kit families
18 active · 29 terminals matched
GET /v1/signatures
- B-112first seen Manila · Nov 20250.94
- terminals
- 14
- cash-out attempts
- 37
- markets
- 14
- B-093first seen Lisbon · Aug 20250.88
- terminals
- 9
- cash-out attempts
- 21
- markets
- 4
- S-204first seen São Paulo · Feb 20260.81
- terminals
- 6
- cash-out attempts
- 12
- markets
- 3
Correlated fingerprints
- fp_7c31a9ATM-PH-2204ManilaB-112
- fp_7c31a9ATM-HK-4410Hong KongB-112
- fp_7c31a9ATM-SG-0182SingaporeB-112
- fp_2b80deATM-PT-0517LisbonB-093
Rank the fleet before the cash-out.
Every market returns monitored terminals, compromised count, exposure band, and the last sweep, so field teams visit the right machines first.
- Per-market exposure bands
- Compromised counts and last sweep
- Sweep order for field teams
Fleet exposure
70+ markets · 2.1M terminals monitored
last sweep 03:40 UTC
Singapore
- 38,420
- terminals
- 12
- compromised
- swept
- 03:40 SGT
Manila
- 26,880
- terminals
- 8
- compromised
- swept
- 02:54 PHT
Hong Kong
- 41,150
- terminals
- 7
- compromised
- swept
- 03:12 HKT
Tokyo
- 112,600
- terminals
- 2
- compromised
- swept
- 03:31 JST
London
- 63,240
- terminals
- 1
- compromised
- swept
- 02:20 GMT
Two kinds of decisions. One model stack.
Real-time scoring decides in the authorization path. Agents do the deliberate work: pulling terminal history, correlating devices across markets, and closing the case with the evidence attached.
Real-time withdrawal scoring
Every authorization scored in under 40 ms for read-pattern, velocity, and terminal-risk signatures — allow, step up, or block.
- Decision
- allow · step_up · block
- Latency P50
- 38 ms
- Reason codes
- READ_ANOMALY · KIT_SIGNATURE · DOOR_OUT_OF_WINDOW · CASH_TRAP_PATTERN
- Model
- detect-2
Built for the terminal, not the spreadsheet.
Detection primitives that map to how skimming actually works: hardware on the reader, patterns in the reads, and money leaving through a compromised dispenser.
Skimmer & shim detection
Per-terminal device telemetry and reader-surface vision flag overlay, insert, and deep-insert hardware within minutes of installation.
Real-time withdrawal scoring
Every authorization scored in under 40 ms for read-pattern, velocity, and terminal-risk signatures — allow, step up, or block.
Cross-terminal correlation
The same card, kit signature, or cash-out pattern across 40 terminals becomes one case instead of 40 disconnected alerts.
Cash-trap & jackpotting signals
Dispense failures, retract anomalies, and out-of-window service events are read as device compromise, not as noise.
Evidence packs
Artifacts, timelines, terminal history, and neighbor terminals exported as a case file your analysts and law enforcement can use.
Explainable decisions
Every block carries a reason code, a confidence score, and the signal that triggered it — defensible to the network and to the customer.
Unstructured signals, structured cases.
A blocked withdrawal is not an outcome, it is a clue. Agents collect the artifacts, correlate the terminal's history, and hand your analysts a case they can defend to the network.
ATM-EV-4471
- Terminal
- ATM-SG-0182
- Location
- Raffles Place MRT · Singapore
- Opened
- 03:14:07 SGT
- Terminal risk
- 0.94
- Decision
- Block + dispatch
- Latency
- 38 ms
- Model
- detect-2
- 03:14:07Terminal telemetry
Service door opened
Out-of-window access with no work order on file.
- 03:14:41Card reader
Read-pattern shift
Magnetic-stripe read failures up 6× on this terminal.
- 03:15:02Device graph
Skim kit signature matched
Hardware profile matches kit family B-112, seen in 14 markets.
- 03:15:09detect-2
Terminal risk 0.94
Above the block threshold of 0.80 set by the issuer policy.
- 03:15:11Decision
Withdrawals blocked, field team dispatched
38 ms response · evidence pack attached to the case.
Blocked before first cash-out
6 artifacts · 4 signal sources
More kits caught, fewer good customers blocked.
Measured against production rule engines and transaction-only models on known skimming incidents across 70+ markets.
Rule engine
Fixed thresholds on amount, market, and velocity.
Transaction-only model
Sequence model over the withdrawal, no device signal.
ATMList detect-2
Device telemetry, read patterns, and kit signatures in the auth path.
Basis · known skimming incidents · 70+ markets
Connect the feeds
Point us at your authorization stream and terminal inventory. No terminal agent, no hardware, no rip-and-replace.
Score in the path
Each withdrawal returns allow, step-up, or block with a reason code and the terminal risk that produced it.
Close the case
When a terminal is compromised, agents assemble the evidence and open a case with the team that can act on it.
Every team that owns cash risk.
Issuer authorization, network integrity, fleet operations, and the analysts who have to explain a block at 2 a.m.
Banks & fleet operators
Rank every terminal by compromise probability and cash-out exposure, then dispatch field teams in the right order.
Fleet exposure
2.1M terminals · 70 markets
Singapore
- 38,420
- terminals
- 12
- compromised
- swept
- 03:40 SGT
Manila
- 26,880
- terminals
- 8
- compromised
- swept
- 02:54 PHT
Hong Kong
- 41,150
- terminals
- 7
- compromised
- swept
- 03:12 HKT
Tokyo
- 112,600
- terminals
- 2
- compromised
- swept
- 03:31 JST
London
- 63,240
- terminals
- 1
- compromised
- swept
- 02:20 GMT
Fleet hardening
Rank every terminal by compromise probability and cash-out exposure, so field teams visit the right machines in the right order.
Network compliance
Report skimming incidents and terminal-risk decisions in the format your network and regulator already expect.
Loss attribution
Attribute skimming losses to terminals, markets, and device families instead of to a BIN and a shrug.
Shared device intelligence
Kit signatures contributed by the whole network, so hardware seen in Manila flags in Lisbon.
Step-up actions
Hold, limit, or step up withdrawals per terminal without shipping a code change to the switch.
What changes in the first quarter
We were live on terminal scoring in six weeks. The first compromised fleet it found paid for the year.
We challenge the terminal now, not the customer. Skimming disputes fell by a third in the first quarter.
Device signatures across forty markets mean a kit that shows up in one city gets flagged in the next one.
Every block arrives with a reason code and an evidence pack. Our analysts stopped guessing.
See your fleet the way a skimmer does.
Walk through live detections in your markets and leave with a sandbox key.