The Unexpected Plain: In Cittanova, Hi-Tech ATMs for Multinational Electronic Teller (ATM) Companies

In Cittanova, a populous small town overlooking the Gioia Tauro Plain from its highest point, you arrive by traveling along the Autostrada del Mediterraneo up to Rosarno, passing trucks overflowing with oranges. It’s an abundance that no longer suffices or pays off, and that no longer creates wealth for this land or its inhabitants, whether they are residents or refugees. Alternatively, you can reach the center from the Ionian coast, passing a stretch of State Road 106, cutting through the Aspromonte mountains, beyond the Limina Pass toward the Tyrrhenian Sea until the Polistena exit: in the distance, the cranes of the port, Vulcano, and the Aeolian Islands.

To reach the industrial area (the town lies to the right of the Serra stream), you skirt century-old citrus and olive groves. On the ground lies a carpet of rotten oranges. There’s also a graveyard of businesses—ones that didn’t make it under the weight of the crisis, of crime, of a State at best inattentive, or due to the incompetence of certain “clever” entrepreneurs out for subsidies and nothing more.

The Companies That Persevere

When the ATM Takes Down the Bandits (and Not the Other Way Around)

The fifth hit on automated cash dispensers in the Sottoceneri region has failed, but the alarm remains high. How does the “marmot” technique work? And what lies behind the criminal gangs operating across half of Europe?

MOLINAZZO DI MONTEGGIO – This time, they didn’t succeed. After successful hits on ATMs in Coldrerio, Arzo, and Novaggio (to which we should likely add Taverne, though that may have been the work of a different gang given the noticeably different modus operandi), this time the criminals failed. Why? Because the Raiffeisen ATM in Molinazzo di Monteggio—although not brand new—was equipped with a technical feature that triggered the alarm, sending the thieves running. What was it? A structural reinforcement of the device. This meant the thieves could not successfully force open the small drawer from which the banknotes are dispensed. That drawer is often the Achilles’ heel of ATMs. Not all, but many. By opening it and using the “marmot” technique, you can insert an explosive charge inside the machine. At Molinazzo di Monteggio, signs of tampering were evident, but unlike the previous hits (all, except for Taverne, involving Raiffeisen ATMs), this time the thieves had to leave empty-handed.

The Stolen Car (Where and Why?)

The attempted theft occurred at 3 a.m. Investigators suspect the gang came from a base in northern Italy, where dozens of similar cases have been recorded in recent months. They reached Monteggio in a car with Ticino plates, probably stolen (though the police have not confirmed this) shortly beforehand and not far away. Once on site, they immediately sprayed black paint on the security cameras (both the bank’s external ones and those on the ATM) and then tried to blow up the cash dispenser. This despite the bank posting a warning sign: “For security reasons,” reads a note placed near the device, “this ATM is loaded to 10% of its capacity.” A plea meaning “Don’t bother, it’s not worth it,” which went unheard. When the alarm sounded, the thieves left quickly, abandoning the car a short distance from the Cassinone border crossing. On the other side, accomplices were probably waiting with another vehicle. But why steal a car—and risk being caught—just to travel a few kilometers? Investigators are asking themselves the same question. Probably to avoid suspicion, not drawing attention, and to confuse the authorities.

“On the other side of the border, accomplices were likely waiting for them with another vehicle.”

Which Route Did They Take?

In these cases, it’s crucial for investigators to determine the gang’s route before and after the attempted theft, hoping to find some trace of them along the way. In this instance, it’s not possible to confirm where they entered (Ponte Tresa? Fornasette? Ponte Cremenaga?), but it’s fairly certain that they exited via Cassinone, since that’s where they abandoned the car. Why Cassinone, which of the mentioned crossings is the farthest—about 4.1 kilometers away as opposed to the mere hundreds of meters at Cremenaga—from the site of the attempted attack? Hard to say. One hypothesis is that the gang entered Ticino through Cassinone intending to target the nearby Raiffeisen ATM in Sessa. However, that ATM was turned off—and obviously emptied—after the Novaggio heist. Could Molinazzo di Monteggio have been a fallback target? Possibly, though it’s not immediately clear why such a well-organized and efficient gang wouldn’t have done a thorough reconnaissance before taking action.

An International Problem

As the infographic above would show (not included here), it’s clear that one or more gangs have been wreaking havoc on ATMs between northern Italy and Ticino in recent months. The loot is huge. For this reason, as confirmed a few days ago by Matteo Cocchi, commander of the Cantonal Police, Ticino investigators are “working hand in hand” with their Italian colleagues. But, or so it seems, this collaboration between police forces could extend to law enforcement across half of Europe, as similar attacks have been recorded in various countries. And in Switzerland, this isn’t only a Ticino phenomenon. In March, in a matter of days, ATMs were blown up in Geneva, the Jura, and Basel-Landschaft.

The Tactic: Chain Attacks Near Borders

Break-ins targeting ATMs have worryingly increased almost everywhere over the last decade. The reason lies in the massive growth in their use by customers, encouraged by banks that have focused heavily on automating services—especially cash distribution—exponentially increasing the number of ATMs in circulation.

These kinds of thefts are not exclusive to Ticino. They’re consistently happening in all border regions, from Geneva to the Jura, from the Basel area to the region north of Zurich. The reason? Simple: proximity to a border makes it easier for criminals to escape. In their criminal plans, they count on the time it takes for police forces of different countries to coordinate—sometimes just a few minutes that can prove decisive during a swift getaway.

“Why target Raiffeisen? Because it’s the bank with the most widespread ATM network.”

The fact that Raiffeisen branches are the primary targets also follows a clear criminal logic: aside from having the most extensive ATM network in Switzerland (around 1,700 cash dispensers), Raiffeisen—given its nature as a “local” banking institution—is often the only one present even in very small towns, where pedestrian traffic is lower at night and it’s easier to plan escape routes after the deed.

Another characteristic of the more recent ATM burglaries is that they often occur in quick succession, in locations not too far apart, as if the gangs specializing in these crimes want to “capitalize” as much as possible during their outings.

A close-to-home example is the theft of November 23 in Coldrerio which, according to investigators, was part of a “four-hit combo” carried out in just a few hours and with identical methods in Macallo con Casone (Milan area), Melzo (Brianza), and Palazzolo sull’Oglio (between Bergamo and Brescia). A similar situation occurred a week later, when ATMs in Brugherio, Dalmine, and Uboldo (three towns on Milan’s northern outskirts) were hit, also seemingly by the same gang. The same pattern emerged in mid-March this year with two attacked ATMs in Samarate and Gallarate, and in more distant regions like the province of Vicenza (three hits in a few hours in the first week of March), the Apennines near Bologna (again a triple action on the night of March 2), and even in the Geneva area, where the first days of March were marked by multiple ATM explosions in a short period. According to Romandie law enforcement, these attacks “share many common factors.”

How do these gangs operate? How do they manage to blow up an ATM, which to the untrained eye seems extremely secure and well-fortified? Online, you can find several videos—mostly in Italy—captured by security cameras near ATMs that were blown up. The footage typically shows three or four criminals inserting the “marmot”: a small box (sometimes just a pencil or cigar box) filled with gunpowder into the slot where banknotes are dispensed. The “marmot” is connected to a long iron rod with a fuse at one end, triggered by a fuse or, in more complex cases, by telescopic pliers and electrical cables. Sometimes, instead of gunpowder, acetylene is used, an extremely flammable gas.

The “marmot” is connected to a long iron bar with an initiator at one end, triggered by a fuse or, in more complex cases, by telescopic grips and electrical wires.

It Takes a Minute and a Half

What’s surprising is how quickly these hits are carried out: less than a minute and a half, clear evidence that these are highly specialized and well-organized groups. The criminals arrive on the scene—usually hooded and in stolen cars—and attack the ATM after “blinding” the security cameras (both the bank’s and the ATM’s) with spray paint.

Logistical Support

The criminals can almost certainly count on a network of accomplices who procure vehicles, select the targets, plan escape routes, and then launder the stolen money.

Are They Dangerous?

In Italy, some gangs operated armed to discourage intervention by bystanders.

Countermeasures

Back in 2014, the ATMIA (the association of ATM industry operators) prepared a study entitled “Guidelines for Preventing Gas or Explosive Attacks on ATMs.” It recommends equipping machines with a system capable of detecting foreign objects inserted inside. Another suggestion is installing a system that detects—and alerts when—the cash dispensing drawer is opened illegally. There are also systems capable of detecting and neutralizing gas. The report advises installing poles or barriers to limit access to the ATM, and the possibility of geolocating the cash cassettes. It’s also important to equip ATMs with ink to stain the money (making it unusable). For indoor ATMs, it’s possible to install a system that releases smoke if tampered with. In Ticino, another deterrent is also used: minimizing the amount of stored cash (and clearly indicating this with a sign).

By Mauro Rossi and John Robbiani