Bitcoin ATMs, also called crypto kiosks, let people feed in cash and send cryptocurrency to a digital wallet. US regulators say these machines have become a favored payment channel for fraudsters, and this article explains how the scheme works, what the official figures show and what is still unclear.
What a Bitcoin ATM actually is
A Bitcoin ATM is a kiosk, often found in convenience stores, gas stations and shopping centers. Unlike a bank cash machine, it does not hold a customer’s account. A person inserts cash, the machine converts it into a cryptocurrency such as bitcoin at the operator’s quoted price, and the coins are sent to a wallet address that the user supplies, usually by scanning a QR code. A wallet is simply software or a device that holds the keys needed to move cryptocurrency, and a wallet address works a little like an account number.
Used legitimately, this is a way to buy crypto without a bank link. Used in a scam, the same features become the point. Cash goes in, a transfer goes out within minutes, and the recipient is a wallet that the victim does not control and often cannot identify.
How the scam usually unfolds
The Federal Trade Commission (FTC), in a 2024 data spotlight, described a recurring pattern. It begins with an unexpected call, text or computer pop-up, often a fake security warning that appears to come from a well-known technology company. The story escalates. The victim is told that their money is at risk, or that their identity has been tied to money laundering. A second person, posing as a government agent or a bank investigator, may join the conversation, sometimes claiming to work for the FTC itself.
The proposed solution is the trap. The victim is told to withdraw cash from the bank and deposit it into a Bitcoin ATM to “protect” it. They are sent to a specific machine and given a QR code to scan. The cash is converted to crypto and lands in the scammer’s wallet.
The FTC said reports of Bitcoin ATM losses were overwhelmingly about three kinds of fraud: government impersonation, business impersonation and tech support scams. In the first half of 2024, about 86% of people reporting a Bitcoin ATM loss cited at least one of those three, according to the agency’s spotlight.
What do the loss figures show?
Two federal sources give the clearest picture, and they measure different things, so they should not be added together.
FTC data (Consumer Sentinel reports). According to the FTC’s September 2024 release, reported losses to scams involving Bitcoin ATMs rose nearly tenfold between 2020 and 2023, reaching over $110 million in 2023. Reports topped $65 million in just the first six months of 2024. The median reported loss in that half-year was $10,000.
For comparison, the FTC’s spotlight put the median reported loss across all crypto-payment fraud reports at $5,400 and the median for fraud overall at $447. A typical Bitcoin ATM victim therefore reported losing many times more than a typical fraud victim.
CFTC citing the FBI. The Commodity Futures Trading Commission (CFTC) says on a consumer advisory page that scams involving crypto ATMs caused more than $388 million in reported losses in 2025, according to the FBI’s Internet Crime Complaint Center. The page describes this as a 58% increase over the prior year and notes that actual losses may be higher because of underreporting.
| Source | Period | Reported figure |
|---|---|---|
| FTC | 2023 | Over $110 million |
| FTC | First half of 2024 | Over $65 million |
| FBI, as cited by the CFTC | 2025 | Over $388 million |
A worked example of what the growth implies
A 58% increase means the 2025 figure is 1.58 times the 2024 figure. Dividing $388 million by 1.58 gives roughly $246 million for 2024. This is illustrative arithmetic only, an implied figure rather than a published one, and it comes from the FBI’s complaint data, which is collected differently from the FTC’s.
Why the numbers differ and what they leave out
It is tempting to line up the FTC and FBI figures as one continuous trend. That would be a mistake. The two agencies collect reports through different channels, count different people and may classify cases differently. Both warn, in effect, that they capture only a fraction of what happens. The FTC wrote that since the vast majority of frauds are not reported, its figures likely reflect only a fraction of the actual harm.
There are also definitional limits. Complaint data records what victims say happened. It does not always separate money that went through a kiosk from money sent by other means in the same scam. Researchers and regulators generally treat these numbers as a floor, useful for direction and scale rather than as a precise count.
Who is most affected?
The FTC found that older adults carry a disproportionate burden. In the first half of 2024, people aged 60 and over were more than three times as likely as younger adults to report a loss at a Bitcoin ATM. They reported losing $46 million of the roughly $65 million total, about 71% of reported losses. A quick check: 46 divided by 65 is about 0.71.
The FTC also reported how the contact began. Phone calls started about 47% of these reports, followed by online ads or pop-ups at 16% and emails at 9%. The pattern fits the scheme’s reliance on a live, persuasive voice that keeps the victim on the line through the withdrawal and the trip to the machine.
Related tactics appear elsewhere in fraud. A separate TechZoneDaily explainer on why AI-assisted scam messages are harder to spot covers how the first contact is becoming more convincing, which matters because the kiosk is only the final step.
Why can’t the money be recovered?
Most consumer payment systems have some form of dispute or reversal process. Card payments can be challenged, and banks can sometimes recall a transfer, as covered in the explainer on how instant bank transfers work. Cryptocurrency transfers generally work differently. The CFTC’s advisory page warns that a transfer sent this way cannot be reversed, regardless of the amount.
The reasons are structural. A blockchain, the shared ledger that records crypto transactions, has no central operator who can undo a payment. The kiosk operator is a business that sold the coins and sent them where instructed, and it typically has no way to pull them back once they are in another person’s wallet. Recovery after the fact is therefore the exception, not the rule, and neither agency’s material cited here reports how often funds are returned.
This is also why regulators emphasize prevention. By the time a victim realizes what has happened, the cash has been converted and moved.
Warning signs regulators describe
The CFTC advisory page lists red flags that apply well beyond kiosks. Be suspicious when someone:
- claims to be from a bank, an investment firm, a government agency or tech support, especially after a pop-up warning or unsolicited contact;
- creates urgency or fear and presses for immediate action to “protect” money;
- tells a person to move money through crypto ATMs, unfamiliar apps, QR codes, wire transfers, gift cards or couriers;
- stays on the phone, tells the person to split payments or coaches them on what to say to others;
- asks for secrecy, or asks the person to install software or grant remote access to a device.
The FTC’s advice is consistent. Do not click links or respond directly to unexpected calls, messages or pop-ups, and look up the company’s number or website independently. Do not withdraw cash in response to an unexpected call. Legitimate businesses and government agencies, the FTC says, will not ask anyone to use a Bitcoin ATM, buy gift cards or move money to protect it.
Both agencies also advise talking with someone trusted before completing an unusual transaction. The CFTC notes that bad actors frequently lie about their profession and identity, so a person who sounds official is not proof of anything.
Where oversight stands, and what is still unknown
The agencies cited here mostly publish warnings and data. The agencies cited here do not describe a single national rule governing how kiosks must screen or limit customers. Rules on kiosks may also be set at the state or local level, and this article does not set out a state-by-state picture. Readers should verify claims about particular state or city bans or limits with the relevant authority.
Several questions remain open. It is not yet clear how much of the reported growth reflects more fraud and how much reflects more reporting. The data do not show how often operators intervene in suspicious transactions. And the figures do not say how much money, if any, is later recovered.
Victims can report to the FTC at its fraud reporting site, to the CFTC through its complaint portal, and to the FBI’s Internet Crime Complaint Center for internet-enabled fraud, according to those agencies.
What the evidence points to
The official data point in one direction: reported losses linked to crypto kiosks rose sharply across the period covered, older adults are hit hardest, and the transfers are effectively final. The consistent advice from regulators is simple. A real bank, agency or company will not ask anyone to put cash into a crypto machine, and any such request should be treated as fraud until proven otherwise.
This article is general information, not financial, investment, tax or legal advice.
Sources: Federal Trade Commission; Commodity Futures Trading Commission
