It could easily be a live ATM. Using the methods described by Barnaby Jack at this year's Black Hat and DefCon, they could have installed their software instead of Jack's Rootkit.

http://www.computerworld.com/s/article/print/9179844/Barnaby...