Yes, ATMs do have cameras — usually more than one. A small pinhole lens is built into the machine itself, and most locations add external cameras that cover the surrounding area. No single federal law forces every ATM to carry a camera, but federal banking regulators expect them as part of a bank’s minimum security program, and several states require video surveillance at ATM locations independently.1eCFR. 12 CFR 208.61 – Bank Security Procedures What matters for you is knowing where those cameras are, how long the footage sticks around, and what to do if you ever need it.
Where the Cameras Are
The built-in camera is a pinhole lens embedded in the machine’s fascia, usually near the screen or the card reader. It captures a close-up of your face during the transaction, which lets investigators tie a specific person to a specific withdrawal or deposit.
External cameras are mounted on the ceiling or walls of an indoor ATM vestibule, or on the canopy above a drive-through machine. These wider-angle dome or bullet cameras cover the area around and behind the user. Between the two, you generally end up with overlapping views of the keypad, the cash dispenser, and the surrounding space.
How and When ATMs Record
Some ATM systems record continuously, producing a 24-hour stream whether anyone is at the machine or not. That captures everything, but the storage load is heavy.
Other systems use event-based triggers. A motion sensor starts recording when someone steps into view, and inserting a card can kick off a second, higher-resolution stream. Many machines also capture a timestamped high-resolution still at the moment cash is dispensed, so there is a clean snapshot confirming delivery.
Who Holds the Footage and for How Long
Who controls the recording depends on who owns the machine. ATMs run by banks or credit unions fall under the institution’s broader security program. Federal law requires each bank to adopt security procedures that discourage robberies and help identify perpetrators, and the implementing regulations list maintaining a camera as one of the standard measures.1eCFR. 12 CFR 208.61 – Bank Security Procedures Privately owned ATMs — the ones in convenience stores, bars, and gas stations — are managed by the merchant or an independent operator, and the rules that apply to them vary by state.
No federal statute sets a universal retention window. In practice, most banks keep recordings roughly 30 to 90 days before the files are overwritten. Some state laws and local ordinances impose their own minimums, so the exact timeline depends on where the ATM sits. The point for you: the footage does not last. If you might need it, the first few weeks are when it still exists.
How to Actually Get ATM Footage
Banks treat surveillance video as private corporate property and will almost never hand it directly to a customer. Releasing it to one person would expose every other customer caught in the same frames.
If you are the victim of a crime at an ATM, file a police report. Law enforcement can then formally request the footage from the bank as part of its investigation. In a civil matter — say, the machine dispensed less cash than it debited — an attorney can issue a subpoena compelling the ATM owner to produce the recording for use in court.
Speed is the whole game. Because footage is typically overwritten within 30 to 90 days, waiting a few weeks can mean the video is already gone. Report to police or contact a lawyer as soon as you can after the incident.
The Cameras You Don’t Want on an ATM
Not every camera on an ATM belongs to the bank. Criminals install their own tiny pinhole cameras on or around machines to record your PIN while you type it. Those hidden cameras are paired with a skimmer — a thin overlay or insert placed over the card reader that copies data from your card’s magnetic stripe. With the card data and the PIN, a thief can clone your card and drain the account.2FBI. Skimming
The FBI recommends inspecting every ATM before you use it. Look for anything loose, crooked, damaged, or scratched around the card reader and keypad. Tug gently at the edges of the keypad to check for an overlay. A criminal pinhole camera can hide almost anywhere on the machine’s surface, so cover the keypad with your free hand when you enter your PIN. Well-lit, indoor ATMs are less attractive targets, though not immune.2FBI. Skimming
Using a chip-enabled card instead of swiping the stripe also helps, because chip transactions generate a unique code that a skimmer cannot reuse. Check your statements often; how quickly you report drives how much you can be held responsible for.
If Something Goes Wrong: Your Liability and Your Rights
If someone makes an unauthorized withdrawal using a stolen or cloned debit card, the Electronic Fund Transfer Act caps your exposure, but only if you move quickly. There are three tiers of liability tied to when you notify the bank:3Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
- Within 2 business days of learning of the theft: liability is capped at $50 or the amount of the unauthorized transfer, whichever is less.
- After 2 business days but within 60 days of your statement: liability can rise to $500 for unauthorized transfers occurring after the two-day window closes.
- After 60 days from your statement: the bank is not required to reimburse losses it can show would have been prevented by an earlier report. Liability effectively becomes unlimited.
If your card itself was not lost or stolen — for example, a thief cloned it with a skimmer — you generally are not liable for the unauthorized charges as long as you report them within 60 days of the statement on which they first appear.3Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
When the ATM itself is the problem — dispensing too little cash, charging twice, or debiting an amount you did not authorize — federal law gives you a structured dispute path. You must notify your bank within 60 days after it sends the statement showing the error, and your notice should include your name and account number, a description of the error and the amount, and why you believe an error occurred.4Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution The bank then has 10 business days to investigate; it can extend that to 45 days only if it provisionally credits your account for the disputed amount, and you get to use those funds while the investigation continues.5Consumer Financial Protection Bureau. Regulation E – 1005.11 Procedures for Resolving Errors
If the bank finds no error, it must send a written explanation and tell you that you can request the documents it relied on. It has to provide those documents promptly if you ask.6eCFR. 12 CFR Part 205 – Electronic Fund Transfers, Regulation E Reviewing them helps you decide whether to escalate to the Consumer Financial Protection Bureau or take legal action. If those documents include ATM camera footage, this is where it usually surfaces — another reason to file within the retention window rather than after it.