ATM Usage & Geolocation Data

Detailed records of ATM usage, including geolocation data, date and time stamps, transaction types and amounts, and other related metadata.

[
Code
DS0040
]
[
Name
ATM Usage & Geolocation Data
]
[
Version
1.0
]
[
Category
Transaction & Payment Data
]
[
Created
2025-04-02
]
[
Modified
2025-04-02
]

Related Techniques

T0016.004
|
|
  • Captures the specific ATMs used, including exact locations, timestamps, and deposit amounts, helping to confirm sub-threshold patterns across different machines.
  • Enables analysis of transaction clustering in certain geographic regions or unusual ATM activity outside the customer’s typical area.
  • Assists in linking multiple depositors (smurfs) using various ATMs to structure funds undetected by traditional branch-based monitoring.
  • Logs ATM withdrawal timestamps, transaction amounts, and physical terminal locations.
  • Identifies anomalous withdrawal patterns or geographically dispersed usage of prepaid cards, which can signify illicit layering or shared credentials.
  • Tracks precise ATM deposit details (e.g., date, time, amount) and geolocation of deposit activities, enabling the identification of repetitive or structured cash deposits across different ATM locations.
  • Helps detect sub-threshold deposit patterns, such as frequent or staged deposits in quick succession, which are indicative of potential structuring.
  • Assists investigators in correlating deposit behavior with customer profile data to pinpoint anomalies in cash deposit volumes or frequencies.
T0144.010
|
|
  • Logs the time, location, and frequency of ATM-based check deposits, revealing geographically dispersed or rapid deposit patterns.
  • Helps identify multiple deposits made in quick succession across different branches or ATMs, consistent with check fraud layering tactics.
T0011.002
|
|
  • Provides detailed records of crypto ATM usage, including locations, timestamps, and transaction details.
  • Helps identify abnormal or cross-jurisdictional usage patterns, revealing potential layering or mule activity involving rapid deposits of illicit cash.

Records of crypto ATM usage capture geolocation data, timestamps, transaction types, and amounts. This information helps identify suspicious location-based patterns, such as coordinated small deposits by multiple individuals, irregular usage in distant regions within short timeframes, or intensive activity at unusual hours.

  • Logs deposit locations, timestamps, and details for ATM or branch transactions.
  • Reveals patterns of structured cash deposits in multiple locations consistent with funnel account operations.
  • Details the physical locations and timestamps of ATM withdrawals.
  • Helps uncover patterns of withdrawals across multiple machines or regions in short time intervals to evade reporting thresholds.
  • Captures ATM withdrawal locations, timestamps, amounts, and frequency.
  • Enables detection of frequent, small withdrawals across multiple ATMs or foreign locations, aligning with micro-structuring methods used to layer illicit funds.
T0144.009
|
|
  • Logs customer withdrawals and deposits at ATMs, including Bitcoin ATM transactions, along with associated geolocation points.
  • Detects sudden or large-value crypto purchases via Bitcoin ATMs, aligning with pig butchering scam instructions.
  • Flags anomalies where usage patterns conflict with a customer’s historical ATM activity or geographic profile.
  • Provides ATM usage details, including location, timestamps, transaction types, and amounts.
  • Enables detection of unusual withdrawal or deposit patterns possibly tied to on-the-ground prostitution activities and the funneling of cash proceeds.
T0016.005
|
|

Captures location, date, time, and amount details for ATM transactions. This supports smurfing detection by:

  • Showing multiple small cash deposits performed across different ATMs or geographic locations in quick succession.
  • Identifying unusual patterns in the distribution of low-value deposits suggestive of smurfing activity.