Vending

Protecting the unattended: Let's count the ways

As vending machines lean into the digital world, transmitting temperatures, inventory levels, machine health and other data to vending management systems, operators face a new security challenge: how to protect devices in both the physical and virtual worlds.

Image: Adobe stock

August 27, 2026 by Dale Laszig — Founder, DSL Direct LLC

Summarize with

Smash-and-grab theft, card skimmers and other brute-force attacks remain real and present dangers. But connected machines have expanded the attack surface, requiring operators to think about networks, operating systems, wireless communications, APIs and a growing number of third parties with access to device networks, payment flows and financial data.

In recent interviews, security experts provided perspectives on three distinct layers of defense for unattended systems and environments.

Detect and block

A new generation of card skimmers are challenging ATM and vending operators. Unlike legacy external models, these ultra-thin cards can be deeply hidden inside consoles where they transmit data via low-energy Bluetooth to nearby criminals, who can steal without returning to the device.

On July 23, 2026, Verifone introduced Wireless Tamper Detection, a patented software-based solution designed to recognize and react to physical tampering. Will Morgan, chief information security officer at Verifone, commented on the technology in an email interview with Vending Times.

"Wireless Tamper Detection uses onboard ultra-wideband (UWB) radios, which create a reference signature of the payment device and/or the environment surrounding the payment device," Morgan said. "If the system detects a physical change, the device may lock down or erase sensitive data to help prevent unauthorized access to payment information."

The lockdown procedure can erase transaction data and notify users that a device will not accept payments until it is reset by an authorized technician. The system can also notify third-party processors, enabling them to void or refund transactions that occurred during a tampering event.

Morgan additionally noted that UWB uses low-energy, wideband, and short-pulse radio signals that can be used for measurement and detection applications. UWB operates on different frequencies (e.g., 6.5 GHz or 8 GHz) for signal transmission than Wi-Fi (2.4 GHz and 5 GHz) or Bluetooth (2.4 GHz), which can help to minimize signal interference.

Once installed, the payment device will periodically generate sample signals and measure their reflections to create a sample signature, which it compares against a reference signature. Differences between reference signature, sample signature and reflected signal can indicate possible tampering.

Isolate and contain

When connected devices create pathways into virtual environments, segmenting and isolating a network can prevent attackers from seeing or moving through those environments. This methodology has been used by the government and military for years and is now available to the private sector, according to Tony Chiappetta, president, CHIPS Cyber Defense Solutions LLC.

In a Zoom meeting, Chiappetta observed that remote access has made smart devices easier for operators to manage and for criminals to exploit. Once inside, attackers can gain control of operating systems and steal sensitive data. Antivirus software and endpoint detection response (EDR) systems alert operators to these intrusions but only after they occur.

"Being able to secure data in a preventative manner is crucial, especially in the age of AI," Chiapetta said. "If you think back to the Target breach in 2013, it came through an HVAC vendor's connection to the company's network. Any access point to your IT environment can potentially compromise data."

Isolating and containing networks can prevent sophisticated attacks, including AI-powered exploits designed to evade detection. These solutions protect devices, kiosks, security cameras and building control systems, Chiappetta explained, citing the following examples:

CyberCloak Cloud assigns unique cryptographic identities to connected devices using a combination of public and private keys to make networks invisible to attackers. Private keys are never shared and public keys are only shared with trusted nodes inside the system.

AppGuard software uses the same isolation/containment technology as CyberCloak to protect Windows operating systems. Designed to block malware from executing, the solution works alongside AV and EDR systems to bolster endpoint security.

"The military and federal government use this same technology to secure communication to nuclear launch and manufacturing facilities. It's highly effective and from a commercial standpoint, it can prevent bad actors from compromising equipment."

Recognize and react

Beyond physical and virtual realms, humans and digital agents play critical roles in modern unattended security. Behavioral monitoring can establish what looks normal when owners, operators, vendors and customers interact with a machine, VMS or network and identify when something deviates from it. Vanita Pandey, chief marketing officer at Microblink, discussed this approach in an email interview.

"While technologies like tamper detection and network isolation play an important role in protecting connected devices, Microblink approaches the problem from a different layer of the security stack: establishing trust in the identity behind high-risk interactions," Pandey said. "As unattended and connected devices become more capable, they also become new endpoints for fraud."

Pandey went on to say that whether someone is accessing a vending management console, provisioning a device, authorizing maintenance, or initiating payments, it's critical to know not just that the device is functioning securely, but that the person interacting with it is legitimate. As generative AI makes deepfakes, synthetic identities, and sophisticated identity spoofing more accessible, that challenge is only becoming more complex.

"Our approach centers on continuous identity intelligence," she said. "Rather than treating identity verification as a one-time event, we combine document authenticity, biometric verification, liveness detection, deepfake and injection attack detection, behavioral signals, and contextual risk indicators to continuously evaluate trust throughout a user's journey."

Behavioral monitoring enables organizations to apply stronger verification only when surrounding risk signals warrant it, Pandey noted, which helps protect critical systems without introducing unnecessary friction.

"While we don't provide network isolation or hardware tamper detection, we see those capabilities as complementary to identity-centric security," Pandey said. "Securing the device is important, but organizations also need confidence that the person or AI agent interacting with that device is who they claim to be."

Taken together, these three approaches reflect how dramatically unattended security has changed. Protecting the machine still matters, but today's operators must also protect the connections, networks and identities surrounding it.

About Dale Laszig

Dale Laszig, a longtime payments and commerce journalist, is founder of DSL Direct, a payments-focused consultancy. She has served in financial leadership positions at Verifone, Hypercom, First Data Corporation, and others, and holds an M.S. in Management from Argosy University and a B.S. in Communications from SUNY Excelsior University.

Connect with Dale: