What to Do When Your Machines Show Abnormal Results
The phone call usually goes something like this: my machine is acting weird. The payouts do not match the expected numbers. The counter says one thing but the cash box says another. Sometimes the screen flickers and then everything is normal again. Is this a problem? The answer I give every time is the same: yes, it is a problem. A gaming machine that shows abnormal results — even once, even briefly — is a machine that is either failing or under attack. Neither condition resolves on its own, and both get more expensive the longer you wait to address them. This article is your action plan for abnormal results: what to do first, what not to do, and how to get the machine back to normal operation.
The Problem: Defining Abnormal
Before you can fix abnormal results, you need to confirm they are truly abnormal. I define three categories of abnormal machine behavior. Category A: Data anomalies — the machine’s accounting data does not match physical reality. Examples include credit counter exceeds cash collected, payout log shows jackpots the staff did not witness, or daily revenue drops 30% with no change in player activity. Category B: Operational anomalies — the machine behaves in ways inconsistent with its design. Examples include spontaneous resets, payouts without corresponding play, screen flickers or freezes, or buttons that are intermittently unresponsive. Category C: Environmental anomalies — the machine’s behavior changes in response to external factors. Examples include errors that appear only when specific nearby equipment is powered on, behavior that differs between day and night shifts, or RF interference patterns that correlate with the venue’s Wi-Fi activity.
If your machine shows any behavior in these categories, take it seriously. The worst decision you can make is to write it off as a one-time glitch. One-time glitches do not produce revenue loss. The behavior you are observing is a symptom of something real. Your job is to identify what it is a symptom of.
Immediate Action: The First 60 Minutes
When a machine shows abnormal results, here is the sequence I recommend for immediate response.
Minute 1-5: Document everything. Before anyone touches the machine, before anyone reboots it, before anyone clears any errors, document the current state. Take photos of the screen showing any error messages. Screenshot the revenue data showing the anomaly. Record the exact time the abnormal behavior was observed. Note which staff members were present and what they saw. This documentation is critical for two reasons: it preserves forensic evidence if the anomaly turns out to be a security incident, and it creates a record that allows pattern analysis over time. Anomalies that look random as single events often form clear patterns when you stack them on a timeline.
Minute 5-15: Secure the machine. If the abnormal result is severe — unexplained payouts, credit injections, or anything suggesting active exploitation — take the machine offline immediately. Power it down and physically secure it. The lost revenue from a machine being offline for 24-48 hours is negligible compared to the losses from another day of active exploitation. If the abnormal result is moderate — a single unexplained reset or a minor data discrepancy — you can leave the machine operational but flag it for enhanced monitoring and schedule investigation within 24 hours.
Minute 15-30: Check the obvious. Before launching a full investigation, verify the simple things: is the machine’s power cord securely connected? Are any cables loose inside the machine? Did someone change a setting they should not have? Has the firmware been updated recently? Has there been any maintenance in the past week? I have solved abnormal result investigations in five minutes because a cleaner had accidentally bumped a connector while vacuuming. Do not skip the simple checks before going deep.
Minute 30-60: Begin the diagnostic protocol. Pull 30 days of revenue data for the affected machine and the two adjacent machines. Chart the data to visualize when the abnormality started. If the abnormality started on a specific date, cross-reference that date against: maintenance records, staff schedule changes, new equipment installations, and firmware updates. The correlation often reveals the cause immediately.
Diagnostic Categories: What the Abnormal Results Mean
Different types of abnormal results point to different causes. Here is how I categorize and investigate each type.
Credit-to-cash discrepancy: This almost always means signal injection or optical sensor spoofing. Someone is adding credits through a non-cash mechanism. Your investigation should focus on the machine’s communication bus and the bill validator sensor path. Read about signal injection protection in our security guide.
Unexplained payouts: This could be a firmware modification, an EMP attack, or a component failure that is randomly triggering the payout mechanism. Your investigation should check: firmware checksum against manufacturer records, event log for gaps or anomalies around the payout times, and the power supply for voltage stability. A failing power supply can cause intermittent payout triggers that look exactly like a low-intensity attack.
Spontaneous resets or screen flickers: These are typically caused by RF interference or power supply instability. Scan the RF environment around the machine when the behavior is occurring. Check the power supply voltage under load. Check whether any new wireless equipment was recently installed in the venue. I have traced flickering screens to a new Wi-Fi access point mounted on the ceiling directly above the affected machine.
Button or input anomalies: If buttons respond intermittently or register inputs the player did not make, check the control panel wiring for corrosion or loose connections. Also check for evidence of external devices near the control panel interface — some cheating devices splice into the button wiring to inject inputs directly.
What NOT to Do
There are actions operators take with abnormal machines that make the problem worse. Do not reboot the machine without documenting its state first. A reboot clears volatile memory that may contain attack evidence. Do not reflash the firmware without saving the current firmware image first. The installed firmware may be modified, and overwriting it destroys the evidence of what was done. Do not ignore a single anomaly and wait for it to happen again so you have a pattern. The first anomaly tells you something is wrong. Waiting for it to happen a second time just means you pay for two anomalies instead of one. Do not assume the problem will fix itself. Abnormal machine behavior that appears to resolve on its own almost always returns. The attacker just took a break, or the failing component cooled down temporarily. It will be back.
Getting the Machine Back to Normal
Once you have diagnosed the cause of the abnormal results, here is the restoration sequence. If the cause was an active attack, remove any attack devices found, preserve them as evidence, and install external anti-cheat hardware before returning the machine to service. Restore the machine’s firmware to the latest manufacturer release — this ensures any modified firmware is replaced with a clean version. Verify and restore all configuration settings to documented standards. Replace any degraded components identified during inspection. Run a 100-game operational verification test to confirm normal behavior. Deploy the machine with enhanced monitoring: check its revenue daily for the first week and weekly for the first month. If any abnormal behavior recurs, pull the machine again and escalate the investigation — a recurrence means the root cause was not fully addressed.
Frequently Asked Questions
How abnormal does a result need to be before I should investigate?
Any result that deviates from expected machine behavior by more than 5% and persists for more than one day warrants investigation. A single isolated anomaly — one flicker, one unexplained credit — should be logged and monitored. If it does not recur within 72 hours, it was likely a transient event. But if you see the same anomaly twice within a week, or any anomaly that affects revenue, start the investigation protocol immediately. The cost of investigating a false alarm is 2-3 hours of your time. The cost of ignoring a real problem is thousands of dollars in lost revenue.
Should I notify the machine manufacturer when I see abnormal results?
Yes, if the abnormality suggests a firmware vulnerability or a hardware design flaw that the manufacturer should know about. Manufacturers rely on operator reports to identify attack methods and develop patches. Send them: the machine model and firmware version, a description of the abnormal behavior, screenshots of revenue data showing the anomaly, photos of any physical inspection findings, and the date the behavior was first noticed. Most manufacturers have dedicated security contacts who will work with you on the investigation.
How do I know when a machine is fixed and safe to put back on the floor?
The machine is ready to return to the floor when: you have identified and addressed a specific root cause, the firmware is verified against manufacturer records, all configuration settings match documented standards, the machine passes a 100-game operational verification with results within expected range, and you have installed continuous monitoring or protection. If you cannot identify a specific root cause but the abnormal behavior has stopped and all diagnostics are clean, deploy with enhanced monitoring but recognize that unresolved anomalies have a high probability of recurrence.
Act Immediately, Act Methodically
Abnormal machine results are a gift — they are the early warning sign that tells you something is wrong before the damage becomes catastrophic. The operators who treat abnormalities as false alarms are the ones who eventually discover six months of revenue loss that could have been stopped on day one. The operators who treat every anomaly as actionable are the ones whose machines stay on the floor, earning money, month after month. The difference in approach costs nothing. The difference in outcome is measured in thousands of dollars. When your machine shows abnormal results, it is telling you something. Your job is to listen, investigate, and act before the whisper becomes a scream.