Aspects of the disclosure relate to detecting attempts to violate the security of an ATM. A computing system may determine whether an ATM is being used to perform a transaction. Based on the ATM not being used to perform a transaction, images of portions of the ATM may be generated. Estimated dimensions of the ATM may be determined. Digital twin data may be retrieved. The digital twin data may comprise a digital twin representation of the ATM and measured dimensions of the ATM. There may be a determination of whether the estimated dimensions of the ATM match the measured dimensions of the ATM. Based on the estimated dimensions of the ATM not matching the measured dimensions of the ATM, the ATM may be deactivated. Furthermore, a message indicating that the ATM was deactivated may be sent to a validation computing system.