A multi-million-dollar ATM withdrawal fraud linked to New York City’s Summer Youth Employment Program (SYEP) has raised urgent concerns about the security of public benefit systems.
According to a New York Times report, approximately $17 million was illicitly withdrawn across the city between July 11 and July 14 using payment cards issued to the program’s participants.
The cards were distributed to around 30,000 unbanked individuals aged 14 to 24 who were enrolled in the city-run summer jobs initiative. While the cards were intended to handle weekly earnings of a few hundred dollars, a malfunction or security failure allegedly allowed access to far larger sums, with some users able to withdraw $10,000 to $40,000 at a time.
Authorities blocked the exploit on the morning of July 14 after ATM operators flagged the irregular cash-out patterns. By that time, some cards were reportedly being resold for $1,000, with videos circulating on TikTok giving instructions. One video captured an individual stating, “We’re printing money right now.”
The fraud’s link to weaknesses in legacy ATM infrastructure
While the origin of the attack is still under investigation, attention is now shifting toward the broader weaknesses in the financial system that it exposed. Many ATM networks continue to rely on legacy systems that lack modern security protocols. According to ATM Marketplace, this outdated hardware and software makes these systems increasingly vulnerable to cyberattacks and failures.
Efforts to reform ATM operations have been ongoing. In March, a white paper from NCR Atleos and Datos Insights introduced the “ATM Continuum Index,” a new method aimed at helping banks optimize their ATM services to meet rising technological and security demands. The report highlighted the need for financial institutions to rethink their operational models to align with new threats and customer expectations.