Maintenance abuse is a physical-and-logical attack technique in which an attacker misuses legitimate service access to reach protected systems, such as an ATM’s internal components or control interfaces. Instead of breaking in from the network alone, the attacker leverages service keys, technician credentials, removable media, or routine repair handling to bypass normal security barriers.
This matters because many devices trust maintenance workflows. If those workflows are weak, an intruder can open the enclosure, connect to internal ports, replace storage, or load malware that controls cash dispense functions. Defenders reduce this risk with strict key management, dual control for service visits, tamper-evident seals, verified reimaging after maintenance, and logging that separates authorized servicing from suspicious access. In practice, maintenance abuse sits at the intersection of physical security and cyber defense, making the service process itself a security boundary.