A method for detecting unauthorized devices on an ATM , the method comprising: receiving radio frequency, RF, signal data corresponding to one or more detected RF signals emitted by the ATM and detected by an antenna located within communication range of the ATM; determining (S420) one or more unidentified RF signals of the detected ATM RF signals that differ from one or more baseline RF signals; determining (S440) whether the one or more unidentified RF signals are present for a predetermined period of time; determining that a potential skimmer is present at the ATM based on a determination that the one or more unidentified RF signals are present for the predetermined period of time; and if said determination of the one or more unidentified RF signals are present for the predetermined period of time is indicative of the presence of a potential skimmer is present at the ATM : using a 3D scanner to detect (S840) the 3D shape of the ATM ; determining (S850) one or more differences between the detected 3D shape of the ATM and baseline 3D shape data for the ATM; comparing (S860) the location of the determined one or more differences between the detected 3D shape of the ATM and the baseline 3D shape data for the ATM to known locations for unauthorized devices; and determining that an unauthorized device is present at the ATM based on a determination that the one or more differences are located at a known location for unauthorized devices and exceed a respective threshold level. receiving radio frequency, RF, signal data corresponding to one or more detected RF signals emitted by the ATM and detected by an antenna located within communication range of the ATM; determining (S420) one or more unidentified RF signals of the detected ATM RF signals that differ from one or more baseline RF signals; determining (S440) whether the one or more unidentified RF signals are present for a predetermined period of time; determining that a potential skimmer is present at the ATM based on a determination that the one or more unidentified RF signals are present for the predetermined period of time; and if said determination of the one or more unidentified RF signals are present for the predetermined period of time is indicative of the presence of a potential skimmer is present at the ATM : using a 3D scanner to detect (S840) the 3D shape of the ATM ; determining (S850) one or more differences between the detected 3D shape of the ATM and baseline 3D shape data for the ATM; comparing (S860) the location of the determined one or more differences between the detected 3D shape of the ATM and the baseline 3D shape data for the ATM to known locations for unauthorized devices; and determining that an unauthorized device is present at the ATM based on a determination that the one or more differences are located at a known location for unauthorized devices and exceed a respective threshold level. using a 3D scanner to detect (S840) the 3D shape of the ATM ; determining (S850) one or more differences between the detected 3D shape of the ATM and baseline 3D shape data for the ATM; comparing (S860) the location of the determined one or more differences between the detected 3D shape of the ATM and the baseline 3D shape data for the ATM to known locations for unauthorized devices; and determining that an unauthorized device is present at the ATM based on a determination that the one or more differences are located at a known location for unauthorized devices and exceed a respective threshold level. <EOS>