Crypto ATMs, also called Bitcoin ATMs or cryptocurrency kiosks, have become one of the fastest ways for scammers to turn a frightened victim's cash into money that cannot be recalled. A crypto ATM scam is any fraud in which the criminal persuades the victim to feed cash into a kiosk and send the resulting cryptocurrency to a wallet the criminal controls, usually by scanning a QR code the criminal supplied. This guide explains how the machines work, how the scam script runs, what US regulators and the FBI have measured, which laws now cap kiosk transactions, and what bank staff, kiosk operators, retailers who host machines and fraud teams can do about it. It is written for practitioners, but the warning signs section is suitable for sharing with customers and families.
Key takeaways
- The kiosk is the payment rail, not the scam. Almost every reported loss starts with impersonation: fake government agents, fake bank fraud teams or fake tech support, then a scripted instruction to withdraw cash and go to a named kiosk.
- Losses are large and still rising. The FBI's IC3 recorded 13,460 kiosk complaints and about $389 million in losses for 2025, losses up 58% on 2024.
- Older adults carry most of the harm. The FTC found people aged 60 and over reported about 71% of Bitcoin ATM losses in the first half of 2024, with a median loss of $10,000.
- Laws now cap kiosk use in some places. California limits a kiosk to $1,000 per customer per day and caps charges; the UK FCA says no crypto ATM is legally operating there at all.
- Refunds are the exception. Crypto payments lack card-style dispute rights, so prevention at the bank counter and at the kiosk screen matters far more than recovery.
What it is
A crypto ATM is a cash-in (and sometimes cash-out) kiosk, usually installed in a convenience store, petrol station or supermarket, that sells cryptocurrency for banknotes. The customer enters or scans a destination wallet address, inserts cash, and the operator sends the purchased coins to that address. Unlike a bank ATM, the machine does not connect to the customer's own account: the money leaves as a blockchain transfer to whatever address is presented.
That design is what scammers exploit. If the criminal can get the victim to scan the criminal's QR code, the deposit lands directly in the criminal's wallet within minutes, and the victim walks away with only a paper receipt. The FTC counted roughly 4,250 Bitcoin ATM installations in January 2020 and about 32,000 by June 2024, based on operators' own figures, so a machine is rarely far away.
The scam is distinct from other crypto fraud covered elsewhere on this site. Wallet drainers and fake investment platforms target people who already hold crypto (see the Crypto Scam and Drainer Guide). Crypto ATM scams target people who often have never owned cryptocurrency and have no intention of investing: they are told the kiosk is a safe place to "protect" their savings or pay a fine.
How it works
The FTC and FBI describe a consistent script. The details change, but the sequence below appears in most reports.
- First contact: an unexpected phone call, text, email or a fake security pop-up on a computer, often impersonating Microsoft, Apple, Amazon or the victim's bank. The FTC found phone calls were the first contact in about 47% of Bitcoin ATM loss reports, online ads or pop-ups in 16%, and email in 9%.
- Manufactured crisis: the victim is told there are unauthorised charges, that their identity has been used in money laundering or drug smuggling, or that their bank account is compromised. A second caller posing as a government agent, sometimes claiming to be from the FTC itself, joins to add pressure.
- Isolation and secrecy: the victim is told not to tell bank staff or family, because they are "part of the investigation" or the bank employee may be involved.
- Cash withdrawal: the victim withdraws a large sum in cash, often in large notes, frequently while the scammer stays on the phone.
- Directed kiosk visit: the scammer names a specific kiosk, sends a QR code by text or email, and talks the victim through each screen, including what to say if the operator's warning screen or support line intervenes.
- Repeat: once a first deposit succeeds, the scammer invents a reason for another, sometimes over several days and several kiosks, until the victim runs out of money or someone intervenes.
About 86% of Bitcoin ATM loss reports in the FTC's 2024 analysis involved government impersonation, business impersonation or tech support scams. Romance and investment scams also use kiosks, but less often as the primary rail. See the Impersonation Scams Guide and the Recognising Tech Support Scams Guide for the conversation tactics behind the first two steps.
Warning signs at the bank counter and at the kiosk
The FBI's May 2026 public service announcement lists behaviours that staff and bystanders can spot. These are the practical triggers for intervention.
| Where | Warning sign | What staff can do |
|---|---|---|
| Bank branch | Large or first-time cash withdrawal, often in large bills, by a customer who seems nervous when asked about it | Ask open questions about the purpose; follow the bank's elder abuse or scam escalation path; delay where policy allows |
| Bank branch | Customer on the phone during the withdrawal, or saying they were told not to discuss it | Treat secrecy instructions as a strong scam indicator; offer a private conversation away from the phone |
| Retail host site | Customer carrying a large amount of cash to the kiosk, or holding a QR code they cannot explain | Display operator scam warnings; train staff to offer the operator's support number |
| Kiosk | Customer on a phone call while operating the machine, or another person lingering and "helping" | Operator warning screens and live calls; operators can decline or hold the transaction |
| Kiosk | Repeated deposits to the same new wallet across days or locations | Operator transaction monitoring and suspicious activity reporting |
Why it matters
The numbers come from three US sources that count differently, so they should be read side by side rather than added together.
| Source | Period | Figure |
|---|---|---|
| FTC Data Spotlight, "Bitcoin ATMs: A payment portal for scammers" | 2020 to 2023 | Bitcoin ATM fraud losses rose nearly tenfold |
| FTC Data Spotlight | First half of 2024 | Over $65 million reported lost; $46 million (about 71%) by people aged 60 and over; median loss $10,000 |
| FBI IC3 2024 Internet Crime Report | 2024 | 10,956 kiosk complaints (up 99%) and $246.7 million in losses (up 31%) |
| FBI IC3 PSA I-051526-PSA | 2025 | 13,460 kiosk complaints and $388,981,267 in losses; more than half of complaints from people over 50, with over $302 million lost |
| FBI IC3 PSA I-051526-PSA, top states | 2025 | Texas $56.8 million (1,179 complaints), Florida $32.8 million (1,213), California $24.0 million (978) |
Two things make these losses unusually severe. First, the median is high: the FTC's $10,000 median Bitcoin ATM loss compares with $5,400 for crypto payments generally and $447 for all fraud reported in the same period. Victims are being talked into emptying savings, not making a single impulsive payment. Second, recovery is rare. The FTC's consumer guidance notes that crypto payments typically come with none of the dispute protections of credit and debit cards and usually come back only if the recipient chooses to return them. Both regulators warn that the true totals are higher because most fraud goes unreported, and the IC3 notes some complaints include other payment types as well as kiosks.
For banks, the kiosk scam is an authorised push payment problem by another route: the customer's own cash withdrawal is the last moment the institution can act. FinCEN's Notice FIN-2025-NTC1 of 4 August 2025 asked financial institutions to watch for convertible virtual currency kiosk activity linked to tech and customer support scams, bank imposter scams and scams aimed at older adults, and reminded them of their Bank Secrecy Act reporting duties. The Elder Financial Abuse and Scam Prevention for Banks and Care Providers Guide covers the branch-side programme in more depth.
The legal picture
Rules differ sharply by jurisdiction. The table summarises the positions confirmed from official sources; many other US states have passed or are debating their own kiosk laws, so check the current text where you operate.
| Jurisdiction | Rule | Status as published |
|---|---|---|
| California (Digital Financial Assets Law, Cal. Fin. Code 3901 to 3907) | Operators may not accept or dispense more than $1,000 per customer per day (3902); detailed receipts (3905(b)); kiosk locations reported to the DFPI (3906) | In force from 1 January 2024; a Los Angeles Superior Court dismissed a challenge to the limit on 30 August 2024 |
| California | Charges per transaction capped at the greater of $5 or 15% of the value (3904); a separate pre-transaction disclosure including, where no refund method exists, a warning that all transactions are final (3905(a)) | From 1 January 2025 |
| California | Kiosk operators must be licensed, and host operators must ensure those using their kiosks are licensed (3907) | From 1 July 2026 |
| United States (federal) | Kiosk operators are money transmitters subject to the Bank Secrecy Act; FinCEN notice FIN-2025-NTC1 sets out kiosk scam red flags for financial institutions | Notice issued 4 August 2025 |
| United Kingdom | Crypto ATMs offering exchange services must be registered under the Money Laundering Regulations; the FCA states none of its registered cryptoasset firms is approved to offer crypto ATM services, so any operator is acting illegally | FCA warning first published 11 March 2022, page updated 6 February 2026 |
Daily limits do not stop a determined scammer, but they cap the loss per visit and create time for family, bank staff or police to intervene. Charge caps matter because kiosk fees and price spreads add directly to the victim's loss.
Common misconceptions
- "A Bitcoin ATM is like a bank ATM, so the money stays mine." The cash is converted and sent to whichever wallet address was scanned. If the QR code came from someone else, the coins belong to them.
- "A government agency told me to use it, so it must be official." No legitimate agency, bank or technology company asks anyone to move money into a crypto kiosk to protect it or pay a fine. The FTC and FBI both state this plainly.
- "The operator can reverse it." Once the transfer is confirmed on the blockchain, the operator usually cannot pull it back. California's disclosure rule exists precisely because many operators offer no reversal or refund method.
- "Only people who invest in crypto get caught." Most kiosk victims are not investors. They are targeted because they have savings and can be frightened into acting quickly.
- "The warning screen is a formality." Scammers coach victims to click through warnings and to lie to operator support. If an operator warns that a transaction looks like fraud, the FBI advises stopping or cancelling it.
- "Reporting is pointless." Reports to IC3 with the transaction ID, wallet address and kiosk location help investigators trace and sometimes freeze funds held at exchanges, and they feed the data that drove the state laws above.
What to do if it has already happened
- Stop all contact with the caller and do not send further payments, whatever the new story.
- Keep every receipt and screenshot. The receipt holds the transaction details investigators need.
- Contact the kiosk operator immediately using the support number printed on the machine or receipt, not a number the scammer gave.
- Report to local police and to the FBI at ic3.gov, including the transaction ID, wallet address, kiosk location and the scammer's phone numbers or emails; in the US also report to the FTC at ReportFraud.ftc.gov.
- Tell your bank, change any passwords or remote access the scammer may have used, and remove remote desktop software installed during a tech support call.
- Be alert to recovery scams: people offering, for a fee, to get the money back are very often the same criminals.
Controls for operators, hosts and banks
| Party | Control | What to measure |
|---|---|---|
| Kiosk operator | Per-customer daily limits, identity verification, scam warning screens before the wallet address step, live call-back for first-time and older customers, blocking of wallet addresses linked to prior complaints | Share of first-time customers over a value threshold who are called back; complaints per 1,000 transactions; time to block reported addresses |
| Kiosk operator | Transaction monitoring for many deposits to one new address across kiosks and suspicious activity reporting | Alerts closed within SLA; SARs filed; repeat-victim rate |
| Retail host | Visible fraud signage, staff briefing on the warning signs, operator support number at the till | Staff trained; interventions logged |
| Bank | Branch scripts for large cash withdrawals, trusted contact person on accounts, scam escalation path, FinCEN red flag review | Interventions per month; prevented loss; withdrawals later linked to kiosk complaints |
Related concepts
- Authorised push payment fraud: the victim makes the payment themselves under false pretences. Kiosk scams are a cash-based variant. See the Payment Fraud Guide.
- Government and bank impersonation: the dominant lure in kiosk cases. See the Impersonation Scams Guide.
- Wallet drainers and fake platforms: crypto scams aimed at existing holders. See the Crypto Scam and Drainer Guide and the Cryptocurrency Scam Awareness Guide.
- Romance and investment scams: longer-running frauds that sometimes end at a kiosk. See the Romance and Investment Scam Awareness Guide.
- AML transaction monitoring: the operator-side discipline that catches repeat deposits to scam wallets. See the AML programme and transaction monitoring guide.
- Loss figures over time: see the Crypto Crime Statistics Guide for kiosk losses alongside hacks and scam revenue.
Practitioner checklist
- Treat secrecy as a red flag: A customer told not to discuss a withdrawal with bank staff or family is a strong scam indicator, so offer a private conversation away from the phone.
- Question large cash withdrawals: Ask open questions about the purpose of large or first-time cash withdrawals, especially in large notes, and follow the elder abuse or scam escalation path.
- Delay where policy allows: The customer's own cash withdrawal is the last moment the bank can act, so hold or delay the payment where policy permits.
- Display kiosk warnings: Retail host sites should display operator scam warnings and train staff to offer the operator's support number to customers carrying large amounts of cash or an unexplained QR code.
- Watch for coaching at the kiosk: A customer on a phone call while using the machine, or someone lingering to "help", is a sign the operator should decline or hold the transaction.
- Monitor repeat deposits: Operators should flag repeated deposits to the same new wallet across days or locations and file suspicious activity reports.
- Check the local rules: Confirm the current kiosk law where you operate, such as California's $1,000 daily limit, because rules differ sharply by jurisdiction.
- Prioritise prevention over recovery: Crypto payments lack card-style dispute rights, so stopping the payment before it is made matters far more than trying to recover it.
Standards and references
- FBI IC3: Cryptocurrency Kiosk Complaint Data by State (I-051526-PSA)
- FBI IC3: 2024 Internet Crime Report
- FTC: Bitcoin ATMs, a payment portal for scammers (Data Spotlight)
- FinCEN: Notice on the use of convertible virtual currency kiosks for scam payments (FIN-2025-NTC1)
- California DFPI: Digital Financial Assets Law information for kiosk operators
- FCA: Warning on illegal crypto ATMs operating in the UK
- FTC Consumer Advice: What to know about cryptocurrency and scams
Related NHI Mgmt Group resources: Crypto Scam and Drainer Guide · Elder Financial Abuse and Scam Prevention for Banks and Care Providers Guide · Impersonation Scams Guide · Crypto Crime Statistics Guide