Across the United States, crypto ATM fraud is rapidly transforming from a niche threat into a mainstream financial crime category that exploits older consumers and the broader blockchain ecosystem.
Summary
Escalating losses and the scale of crypto ATM scams
Losses tied to crypto ATMs surged to $333.5 million in 2025, with the FBI receiving more than 12,000 complaints between January and November 2025. Moreover, this represented a 33 percent increase over the $250 million reported for the comparable period in 2024, underscoring an accelerating threat trajectory.
The United States now hosts approximately 78 percent of the world’s 45,000 crypto kiosks, making it the primary theater for this form of fraud. These machines can convert cash to crypto in under five minutes, often with only minimal identity checks, creating what analysts describe as the lowest-friction extraction channel available to scammers.
Crucially, these kiosks are not standalone devices. Each terminal functions as a frontend connected to a centralized Crypto Application Server (CAS), which releases funds from an operator’s commingled hot wallet. However, the public blockchain only records the operator-to-destination transfer, not the victim’s cash deposit or identity.
This structural blockchain attribution gap forces law enforcement to subpoena operator CAS logs to link physical deposits to on-chain movements. That said, the only effective technical choke point is real-time wallet screening at the CAS before a transaction reaches the blockchain mempool.
How crypto ATM fraud works and how it evolved
Crypto ATM fraud is a form of financial exploitation that relies on social engineering rather than account compromise. Attackers direct victims to kiosks, where they withdraw and deposit physical cash that is immediately converted into cryptocurrency and sent to wallets controlled by the scammers.
Unlike traditional banking fraud, the attacker does not hack online banking credentials or intercept digital transfers. Instead, they manipulate the victim into voluntarily withdrawing cash from their own bank account, then depositing it into a kiosk that converts it into Bitcoin (BTC) or other tokens via a QR code supplied by the fraudster. Once broadcast on-chain, the payment exits the regulated banking perimeter and is effectively irreversible.
The method emerges from a clear historical progression. In the early 2000s, social engineering scams leaned on wire transfer services such as Western Union, which faced rising scrutiny and interception risk. Criminals then pivoted to gift card extractions, instructing victims to buy prepaid cards and relay the codes by phone.
As retailers improved staff training and card issuers enhanced fraud analytics, these channels became less reliable. Meanwhile, the global crypto ATM fleet exploded from a few hundred machines in 2016 to around 40,000 by early 2024, and an estimated 45,000 units by 2025. This shift gave scammers a faster, more anonymous, and more scalable extraction tool.
These kiosks blend the tangibility of cash with the speed of blockchain settlement, enabling near-instant international transfers. Moreover, long-standing scripts such as grandparent emergencies and government impersonation have been retooled into highly efficient, tech-enabled operations built around crypto terminals.
What are crypto ATM scams and how do they differ from other schemes?
Scams at kiosks are distinct from typical crypto hacks because they rely on the victim’s physical presence and voluntary action. The core differentiator is the hybrid bridge between legacy banking and decentralized networks, rather than direct compromise of private keys or wallets.
Phishing campaigns and wallet-draining attacks tend to focus on malware, fake interfaces, or malicious smart contract approvals. By contrast, kiosk-based scams exploit fear, trust, or confusion to push victims into a cash deposit that feels similar to using a traditional ATM, even though the legal protections are entirely different.
Fraudulent exchanges and token schemes often maintain elaborate online platforms, nurturing victims over weeks with fake dashboards and simulated returns. Crypto kiosk fraud favors high-velocity extraction. However, it bypasses cooling-off periods and strong know-your-customer checks that characterize major centralized exchanges, making bank interventions far less likely.
In practice, a bank may scrutinize an unusual international wire, but it is unlikely to block a face-to-face cash withdrawal. Once that cash goes into a kiosk, the protective perimeter of the banking system effectively disappears, leaving victims exposed to irreversibility and limited recourse.
Taxonomy of attacks and victim profiles
Psychological levers and attack narratives
Crypto ATM fraud schemes are best classified by the emotional trigger used to drive the victim to the machine. All of them aim to induce heightened arousal, isolate the target from helpers, and coach them through real-time cash deposit steps.
- Law enforcement impersonation: exploits fear and urgency through threats of arrest or asset seizure; typical losses range from $8,000 to $15,000.
- Tech support scams: create panic over compromised devices or frozen bank access, usually costing victims $5,000 to $12,000.
- Romance or relationship fraud: builds trust and aspiration over time, often inflicting losses of $10,000 to $50,000+.
- Grandparent scams: leverage empathy and fear for family safety, with $5,000 to $20,000 typical loss ranges.
- Fraud recovery schemes: prey on desperation after prior losses, extracting $3,000 to $10,000 in additional payments.
Authority impersonation remains the most common technique. Attackers claim to be from the IRS, FBI, Social Security Administration, or local police. They invent crises involving compromised Social Security numbers, frozen accounts, or pending criminal charges, and direct victims to move funds into purportedly safe government-controlled wallets via nearby kiosks.
Relationship-based fraud, often called pig butchering, unfolds over an extended period. The scammer builds emotional dependence through messaging apps, then introduces a crypto ATM as the on-ramp to a fabricated investment platform. Moreover, fake dashboards display non-existent profits to justify ever-larger deposits. In 2025, this approach drove the largest individual loss figures and overlapped with Southeast Asian scam compounds.
An especially troubling pattern emerging in 2025 involved fraud recovery targeting, where earlier victims were re-contacted by the same or allied networks. These callers posed as investigators or recovery specialists who claimed they could retrieve lost funds for an upfront fee payable at a kiosk.
Who are the primary targets?
Victimology is sharply skewed toward older adults. An AARP analysis in 2025 concluded that approximately 86 percent of recorded losses involved individuals over age 60. Furthermore, the D.C. Attorney General’s investigation into Athena Bitcoin machines in Washington, D.C. identified a median victim age of 71.
Several factors underpin this concentration. Seniors typically hold higher liquid savings and often display a digital literacy gap around the distinction between bank ATMs and crypto kiosks. Many assume that any physical machine in a familiar retail environment offers equivalent consumer protections, including reversibility and dispute mechanisms.
Social isolation magnifies the risk, particularly as criminals deploy AI-generated voice cloning and deepfake video to mimic trusted relatives or local officials. However, FBI IC3 data from 2025 also reveals a growing cohort of victims under 40, especially in romance and fake investment schemes, though their average losses per case remain lower than those of older adults.
From data breach to kiosk: the fraud access vector
The attack sequence begins long before a victim encounters a kiosk. Criminal groups source lead lists from large-scale data breaches and illicit data brokers that compile age, geography, financial institution, and past scam exposure into curated profiles.
These profiles fuel automated smishing and vishing campaigns. Initial contacts trigger fear, excitement, or panic, prompting targets to engage. Once engaged, the attacker maintains a continuous phone or video link, deliberately isolating the victim from family, bank staff, or law enforcement who might intervene.
By the time a victim reaches a kiosk, they have often spent 30 minutes to several hours under continuous coaching. Attackers walk them through the interface, tell them how to respond to on-screen fraud warnings, and script cover explanations for bank tellers questioning large cash withdrawals.
Inside the technical architecture and forensic blind spots
Understanding kiosk infrastructure is critical to designing effective atm fraud prevention strategies. Despite consumer perceptions, crypto ATMs do not act as isolated vaults for digital assets. Instead, they serve as input terminals wired to a backend Crypto Application Server that controls a centralized hot wallet.
When a user inserts cash and scans a QR code, the machine sends a signal to the CAS, which releases funds from the operator’s hot wallet to the recipient address. Simultaneously, the CAS may trigger an API call to exchanges such as Kraken or Coinbase to rebalance inventory and hedge price risk.
Because on-chain transfers originate from the commingled hot wallet, public blockchain data shows only an operator-to-destination payment. The link between a specific victim and that payment exists solely in the operator’s internal logs. Consequently, investigators cannot reconstruct the full path from blockchain data alone; they must compel CAS records to close the Attribution Gap.
Most modern kiosks use tiered verification thresholds. Smaller transfers, often below $500 to $1,000, may require only SMS-based verification, while larger amounts trigger ID scans or Social Security validation. However, criminals coach victims to split deposits into multiple smaller transactions to avoid enhanced checks, a practice that itself constitutes structuring under the Bank Secrecy Act.
Once funds leave the hot wallet and settle on-chain, they rapidly merge into broader laundering flows involving mixers, cross-chain bridges, and decentralized exchanges. At that stage, they are indistinguishable from other illicit transfers. Accordingly, the CAS ingress point remains the sole uniquely defensible node in the crypto kiosk fraud pipeline, making real-time wallet screening and transaction scoring essential.
2025 threat landscape and enforcement response
Global metrics and regional concentration
Between January and November 2025, the FBI’s IC3 documented more than 12,000 complaints tied to kiosks and $333.5 million in losses. During just the first half of 2025, losses hit $240 million, roughly double the prior year’s pace, leading the FBI to describe a clear, unrelenting rise.
The global crypto ATM market is dominated by North America. The United States accounts for about 78 percent of the world’s 45,000 machines, followed by Canada at 9.4 percent and Australia at 5.2 percent. Within the U.S., Florida, California, and Texas consistently report the highest loss volumes.
Broader crypto crime data adds perspective. Chainalysis estimated in its 2026 Crypto Crime Report that scam operations received at least $14 billion on-chain in 2025, with impersonation scams surging by approximately 1,400 percent year-over-year. Notably, AI-enabled scams were found to be 4.5 times more profitable than traditional methods.
Key enforcement cases and regulatory moves
A pivotal enforcement action emerged in September 2025, when the D.C. Attorney General sued Athena Bitcoin, Inc., a major operator with about 4,100 machines across five countries. The complaint alleged that 93 percent of deposits at Athena’s seven District of Columbia kiosks were linked to fraud.
The investigation reported a median victim age of 71 and median per-transaction losses of $8,000. Moreover, Athena allegedly embedded undisclosed markups of 13 to 26 percent into its exchange rates, far above the 0.24 to 3 percent fees on large exchanges, and then enforced a strict no-refund policy, sometimes demanding liability waivers from victims seeking help.
Internal logs indicated that 48 percent of deposits during the firm’s first five months of D.C. operations involved customers directly reporting that they had been scammed. However, despite this awareness, Athena’s safeguards were found to be inadequate, including ineffective on-screen warnings for victims under live coaching by scammers.
Separately, FinCEN issued an alert in August 2025 reminding institutions that kiosk operators are money services businesses under the Bank Secrecy Act. This status requires registration, anti-money-laundering programs, and suspicious activity reporting, with a particular focus on tech-support and bank-impersonation scams affecting older adults.
Laundering hubs and cross-border asymmetries
While extraction happens largely in Western retail locations, the laundering infrastructure is anchored in jurisdictions with lighter regulation. Asian-language money laundering networks processed an estimated $16.1 billion in illicit crypto flows in 2025, equivalent to approximately $44 million per day.
These services accounted for roughly 20 percent of attributed global illicit flows and have grown more than 7,000 times faster than transfers to centralized exchanges since 2020. Operations are typically staged via Telegram channels that connect clients to launderers advertising capacity and posting proof-of-liquidity screenshots.
Operational hubs cluster in Southeast Asia, notably the tri-border region of Myanmar, Laos, and Thailand, as well as Cambodia. The United Nations Office on Drugs and Crime estimates that East and Southeast Asian countries lost about $37 billion to cybercrime in 2025, with scam compounds contributing materially to GDP in some jurisdictions.
This geography creates a sharp enforcement imbalance. Victims are concentrated in nations with dense kiosk coverage and robust consumer laws, while the financial back-end resides in regions with limited regulatory reach, severely hampering cross-border recovery and coordinated prosecutions.
Attacker organizations, tactics, and technology
Transnational structures and human trafficking links
Perpetrators of crypto kiosk fraud have evolved from lone actors into structured transnational organizations. These groups operate from fortified compounds across Southeast Asia and parts of Eastern Europe, often staffed by hundreds of workers.
Organizationally, they mirror corporations, with dedicated teams for data harvesting, high-pressure phone-based social engineering, and post-transaction money movement. Frontline callers are sometimes trafficking victims themselves, lured by false job ads and coerced into conducting scams. There are reports that crypto flows to services associated with human trafficking linked to these compounds surged 85 percent in 2025.
The groups allocate substantial budgets to AI voice cloning, deepfake video tools, and operational security stacks. However, while their laundering infrastructure is highly automated, the victim-facing layer relies on human operators trained to exploit emotional and cultural vulnerabilities in Western populations.
Tactics, social engineering, and operational security
The central procedural doctrine is continuous control of the victim from first contact to final deposit. Initial outreach is automated and multichannel, using spoofed caller IDs, cloned domains, and synchronized SMS, email, and phone sequences to mimic banks or agencies.
Once a target engages, attackers employ a stay-on-the-line protocol, maintaining a live call through cash withdrawal, travel, and kiosk interaction. This eliminates opportunities for bystanders or bank employees to interrupt. Attackers also script cover stories for bank tellers, such as home renovations or family emergencies, designed to avoid AML triggers.
Social engineering scripts focus on cognitive overload. In authority scams, this means alternating between threats of arrest and assurances that the caller is the victim’s only ally. In romance fraud, manipulation builds more slowly, with emotional intimacy used to justify later financial requests.
An increasingly common method in 2025, known as authority nesting, has callers escalate the interaction to supposed supervisors or senior officials to create a sense of formal process. Moreover, compelled secrecy instructions warn victims not to disclose the situation due to gag orders or banking security breaches, trapping them in an information bubble controlled by the attacker.
On the technology side, criminal networks use VPNs and virtual private servers to mask origin, making calls from Southeast Asian compounds appear to originate from local U.S. numbers. They often generate single-use QR codes that expire quickly, shrinking the forensic window. Following deposits, automated protocols push funds through mixers, chain-hopping services, or cross-chain bridges within minutes, sometimes before the call ends.
Detection, mitigation, and the policy response
Technical defenses and three-layer frameworks
Current technical countermeasures operate at three layers: on-chain analytics, kiosk-level behavioral monitoring, and network-wide intelligence sharing. Together, these form an emerging defense-in-depth framework.
On-chain analytics providers scan transactions for fraud signatures, such as immediate routing from kiosks to known mixers or high-risk bridges. When a wallet is flagged, operators can block its reuse or halt pending transactions. Moreover, graph-based clustering can link related addresses to the same entity, enabling proactive blocklists.
At the kiosk level, behavioral analytics watch for risk indicators, including first-time users transacting near maximum limits, repeated transactions in short bursts, and customers holding active phone calls while using the machine. Some operators test camera-based age estimation to flag older users for extra checks, though privacy concerns constrain deployment.
On the network layer, intelligence sharing accelerated in 2025. Operators such as Bitcoin Depot, CoinFlip, and Coinme formed a voluntary consortium to share blocklisted wallets and scam QR codes across their networks, shrinking reaction times from days to hours. FinCEN’s 314(b) framework further supports information sharing with law enforcement.
An emerging mitigation mechanism is risk-based transaction delay. Instead of generic cooling-off periods, machine learning models score each transaction in real time. Those with high estimated fraud probability face holds of varying length, while low-risk transfers clear quickly, balancing security with usability.
Consumer awareness and frontline education
Public awareness remains the most powerful upstream defense, as nearly all attacks rely on victims not understanding how kiosks and blockchain settlements work. When users recognize the pattern, the scam typically fails.
In 2025, organizations including AARP expanded fraud education for older adults, while law enforcement agencies in more than 20 U.S. states issued public warnings. The Arizona Attorney General released a dedicated alert in February 2026, and the California Department of Financial Protection and Innovation formalized guidance emphasizing that no legitimate institution will ever request problem resolution via cash deposits into kiosks.
At the machine level, several states now require high-contrast, non-skippable warning screens that describe common scam narratives before users can proceed. Florida’s SB 505, effective in 2026, mandates such messaging and obliges operators to maintain 24/7 fraud hotlines.
However, the Athena Bitcoin case showed that on-screen warnings are often ineffective when victims are on live calls with scammers who actively coach them to ignore alerts. This finding underscores the need for multi-layered interventions that go beyond static messaging.
Legislative frameworks in the EU, United States, and beyond
The global policy response to kiosk abuse is intensifying but remains fragmented. In the European Union, the Markets in Crypto-Assets Regulation (MiCA), in full effect since December 2024, treats kiosk operators as Crypto-Asset Service Providers.
Under MiCA, operators must secure authorization, implement robust KYC checks, monitor transactions, and report suspicious activity. Travel rule provisions require that originator and beneficiary details accompany transfers, significantly curtailing anonymity. Consequently, several operators have opted to exit EU markets rather than shoulder the new compliance burden.
In the United States, the proposed Crypto ATM Fraud Prevention Act of 2025, introduced in February 2025, would impose a 14-day onboarding period for new users, a daily cap of $2,000, and a cumulative ceiling of $10,000 during that window. It would also require verbal confirmations for transfers above $500 and mandatory warning screens. As of early 2026, the bill remains in the Senate Banking Committee.
State-level legislation has moved faster. At least 14 states enacted or proposed kiosk-specific rules in 2025 and early 2026. California’s Digital Financial Asset Law, effective January 2024, limits transactions to $1,000 per day and mandates biometric verification above $500. Florida’s SB 505 requires warning screens and hotlines, while Vermont and Connecticut have considered moratoriums on new machines.
Indiana advanced HB 1116, which would ban kiosk operations statewide. Meanwhile, some Australian lawmakers have proposed daily transaction limits and restrictions on further deployment. Several U.S. municipalities, including Chico, California, have enacted local moratoriums on new kiosk permits, reflecting growing concern at the city level.
Future threat trajectory through 2026 and beyond
The evolution of crypto atm fraud is likely to feature more automation, AI augmentation, and distributed attack models. The core incentives driving criminals toward this channel show no sign of reversing.
On the social engineering front, deepfake technology is moving from voice to real-time video. Attackers are starting to use live face-swap tools to impersonate relatives, local officials, or bank managers on camera, backed by AI-driven personalization engines that tailor scripts based on social media data.
Financially, backend infrastructure is shifting toward dynamically generated, single-use QR codes linked to decentralized liquidity pools or automated smart contracts. This design allows funds to be instantly fragmented across chains or rotated into privacy-focused assets, weakening the impact of simple wallet blocklists.
As states implement lower transaction caps and cooling-off mechanisms, criminals are experimenting with distributed victimization models, sometimes described as smurfing-as-a-service. Hundreds of low-dollar deposits across multiple kiosks can collectively generate substantial revenue while each isolated transaction appears innocuous.
Looking further ahead, analysts anticipate hybrid ransomware models where kiosks serve as designated payment portals. In such scenarios, victims of data encryption could be instructed to pay exclusively through physical deposits, complicating the already challenging task of tracing ransomware flows.
Practical recommendations for consumers, operators, and law enforcement
Guidance for consumers and elderly crypto victims
Any unsolicited communication instructing you to visit a cryptocurrency kiosk should be treated as a red flag. No legitimate government agency, bank, or tech support provider will ever ask you to resolve a problem or protect assets by depositing cash into a machine.
- Never send digital assets to a wallet address provided by someone whose identity you have not independently verified through trusted channels.
- Avoid scanning QR codes received via text, email, or social media at a kiosk; they may route funds directly to a scammer.
- If someone insists you stay on the phone while at a machine, hang up immediately and consult a trusted contact.
- Report suspected incidents to the FBI’s IC3 at ic3.gov, local law enforcement, and the kiosk operator, and notify your bank as soon as possible.
- Be cautious of anyone promising to recover lost cryptocurrency for an upfront fee; these offers are themselves scams.
Obligations and best practices for operators
Kiosk operators occupy a pivotal choke point in the fraud pipeline and now face rising regulatory and legal scrutiny. The Athena Bitcoin case demonstrates that awareness of high fraud levels without corrective measures can lead to enforcement under consumer protection and elder abuse statutes.
- Deploy real-time on-chain monitoring and blocklisting at the CAS level before transactions are broadcast.
- Apply tiered KYC with mandatory government ID for transfers above $500 and enhanced checks beyond $1,000 per day.
- Use un-skippable, multilingual warning screens describing common scam narratives in clear language, explicitly stating that government agencies will never demand kiosk payments.
- Join industry intelligence-sharing groups so that addresses flagged at one network are blocked across others.
- Implement behavioral analytics to detect users on calls, first-time maximum-value transactions, and visible signs of distress.
- Maintain 24/7 fraud hotlines staffed by trained personnel capable of escalating suspected fraud-in-progress.
- Clearly disclose all fees, spreads, and markups separate from the displayed exchange rate.
Priorities for law enforcement and policymakers
Law enforcement agencies should elevate kiosk-based scams to a priority category and invest in specialized capabilities. Coordination across jurisdictions and with private analytics firms is essential.
- Train investigators on blockchain forensics platforms, including tools such as CertiK Skynet, to trace flows from deposit to off-ramp.
- Establish state-level crypto fraud task forces modeled on the FBI’s Virtual Currency Initiative, with streamlined subpoena processes for operator logs.
- Develop rapid freeze-and-hold agreements with operators to pause high-risk transactions while investigations begin.
- Create referral pipelines with Adult Protective Services and consumer agencies to support older victims immediately.
- Advocate for harmonized federal rules on reporting, transaction caps, and operator licensing to close state-by-state loopholes.
Conclusion
Crypto ATM fraud sits at the intersection of advanced social engineering, fragmented regulation, and technical design flaws that favor speed over consumer protection. The $333.5 million in reported U.S. losses during 2025 likely understates the real damage, especially for elderly victims losing retirement savings.
International criminal organizations exploit the rapid movement of funds beyond domestic jurisdiction, while some industry actors have historically prioritized transaction volume over safety. The Athena Bitcoin case signals a shift toward greater accountability, but meaningful change will require coordinated action from operators, regulators, and law enforcement.
Effective intervention must focus on the ingress point, where CAS-level screening and risk-based delays can stop fraudulent transfers before they settle on-chain. At the same time, sustained education campaigns and standardized federal legislation are crucial to protect vulnerable populations and reduce the appeal of this vector to organized crime.
As AI-driven deepfakes, automated cross-chain laundering, and distributed low-value deposit models mature, existing defenses will face escalating stress tests. The window for proactive reform is narrowing, but the frameworks, technologies, and policy tools described in this report offer a viable path to disrupt the fraud pipeline if adopted with sufficient speed and coordination.
Appendix: data sources and methodology
This analysis draws on open-source data and proprietary intelligence from multiple organizations. Key sources include the FBI Internet Crime Complaint Center (IC3), the Federal Trade Commission, and the American Association of Retired Persons (AARP) for complaint and victimology data.
Additional inputs come from the Chainalysis 2026 Crypto Crime Report, CoinATMRadar, and FinCEN‘s August 2025 guidance on kiosk operators as money services businesses. The D.C. Attorney General’s September 2025 complaint against Athena Bitcoin, UNODC reporting on Southeast Asian cybercrime, and proprietary intelligence from CertiK Skynet further inform this report.
State legislative records and municipal ordinances from California, Florida, Vermont, Connecticut, Indiana, Arizona, and specific U.S. cities, including Chico, were reviewed to map the evolving regulatory landscape. Quantitative data reflects the most conservative available figures as of February 2026, while forward-looking assessments are based on trend analysis and expert interviews.
