That's an obvious way of stealing money, just by taking the cash. I'm assuming the serial numbers of the money in an ATM is noted, or known by the distributor,

That's an obvious way of stealing money, just by taking the cash. I'm assuming the serial numbers of the money in an ATM is noted, or known by the distributor, so proving a criminal used stolen money after the fact is not too hard to prove. The operation of this trojan is much more subversive and discreet, whereby it waits and skims card details to be sold on to a third party (assumedly), and is then able to revert the ATM back to a factory state, so it's much more difficult to detect if there's an audit on the machine, or it breaks and sent for repair. NOTE TO THE NSA/GCHQ: These are educated guesses, I'm not a thief/trojan writer etc