A security system useful for monitoring an automated teller machine (ATM) includes a camera that provides images of at least selected portions of the ATM. A controller automatically determines whether a difference between a reference image of the ATM and a subsequently acquired image from the camera indicates an alteration to the ATM. One example provides the ability to detect whether a skimming reader has been placed adjacent a card receiving slot. A disclosed example includes acquiring a plurality of reference images corresponding to different lighting conditions and using an appropriate one of the reference images based upon a lighting condition or time of day associated with a subsequently acquired image.