Abstract: There is disclosed a method and system for surveillance of a suspect of automated banking machine (ABM) fraud. In an embodiment, there is a detector for detecting the presence of a foreign device targeting an ABM, the detector being configured to generate an alarm notification upon such detection. A plurality of surveillance cameras may be positioned to monitor an ABM and its surroundings. A video recording device is operatively connected to the detector and configured to archive the video signals recorded from the plurality of surveillance cameras upon receipt of the alarm notification. The detector may be configured to generate the alarm notification after a predetermined delay, and at least one of the archived recorded video signals should have a recorded length exceeding the predetermined delay for alarm notification in order to permit review of suspicious activity that generated the alarm notification.