Cash trapping at an Automated Teller Machine (ATM) is detected in real time. One or more images from one or more cameras are analyzed. The camera(s) is/are focused overhead of the ATM or on a cash slot of a dispense module for the ATM. The images are analyzed for determining one or more of whether the dispenser module is authentic, whether the cash slot opened or did not open when it should have opened for a cash withdraw, whether visual features of the dispense module have changed over a configurable period of time, and whether hands, gestures, and actions of a person present at the ATM indicate that cash trapping is taking place at the ATM. When cash trapping is detected at the ATM a variety of automated actions are processed, such as shutting down the dispense module, shutting down the ATM, notifying a financial institution, and/or notifying legal authorities.