Crypto ATM Scam: $388 Million Fed Into Machines By Hand
No agency on earth has ever needed your cash fed into a machine beside the crisps.
In 2025 the FBI's complaint centre logged more than 13,400 reports involving cryptocurrency kiosks, with losses above $388 million — a 23% rise in complaints and a 58% rise in losses in a single year. More than half of those reports came from people over fifty, and their share of the damage was over $302 million. Every one of those transactions was typed in voluntarily, by hand, by the victim.
That is the uncomfortable geometry of this fraud. There is no exploit, no malicious contract, no drained approval — the technology behaves impeccably. A crypto kiosk is a one-way cash-to-crypto machine with a QR scanner, and the scam simply borrows it as a cash-collection desk with a receipt printer. The only vulnerability in the entire chain is a telephone call.
The Scheme In One Paragraph
Somebody calls, writes or pops up on screen claiming to be support, a bank's fraud desk, a police officer, a utility or a federal investigator. They tell the target their money is at risk and must be moved into a government-secured wallet tonight. They walk them through a bank withdrawal in large denominations, a drive to a convenience store, and a kiosk that turns notes into Bitcoin sent to a QR code the caller supplies. The kiosk charges its fee, prints a receipt, and the money is gone irreversibly.
It isn't a hack. It's an errand, given to a frightened person by a voice with a badge number.
Why The Kiosk Is The Perfect Collection Desk
Wire transfers can be recalled, cards can be charged back, and a bank teller can freeze a transfer while a compliance officer asks questions. A cash-to-crypto kiosk offers none of that friction: the cash is physical, the recipient is a string of characters, and the settlement is a blockchain that has never once cared who pressed the button.
It also solves the criminal's oldest problem — collecting from a stranger without meeting them. The victim supplies the cash, the transport, the identity documents at the kiosk, and the CCTV footage of a person who appears entirely willing. The scammer is a voice with no address, standing in the one place in the transaction with no camera pointed at it.
And the fees are somebody else's problem. Kiosk operators commonly charge margins far above exchange rates, which the caller never mentions because it is deducted from money the victim was never going to keep anyway. Operators sit inside the regulated perimeter — they register with FinCEN as money services businesses and keep records — but registration governs the seller of the coins, never the destination the customer types in.
The machine is not the criminal. It is the counter the criminal chose because nobody stands behind it.
The Script That Gets People Into The Car
Almost every kiosk case begins with manufactured authority. A pop-up warning about suspicious activity with a support number. A caller claiming to be the bank's fraud team. A voice claiming a warrant, a compromised account, or a relative in custody. The IC3's own indicator list reads like a stage direction: unsolicited contact, a demand for cryptocurrency, and instructions the victim cannot explain in their own words.
The second move is isolation. The target is told not to discuss it with bank staff, because the branch has been infiltrated or the investigation is confidential. That single instruction disables the one control that actually works — a cashier asking why an eighty-year-old needs $9,000 in hundreds.
The third move is the errand itself. The caller stays on the line through the drive, the door, the machine and the QR scan, narrating each screen. The FBI's indicators name it precisely: people at kiosks, on the phone, visibly confused, sometimes accompanied by a helper who is aiding the transaction rather than questioning it.
The con doesn't beat the security. It recruits the victim as staff and sends her to work.
Vocabulary, Decoded
The call sounds official because the words were chosen from an official dictionary. Here is the translation.
"Government-secured wallet"
What it sounds like
A protected federal account where your savings are held safe during an investigation.
What it is
A private wallet address printed as a QR code. No agency operates custody accounts for citizens, and none has ever asked a member of the public to convert cash at a kiosk.
"Verification deposit"
What it sounds like
A test amount sent to confirm the channel works before the real transfer.
What it is
The first payment, engineered to be small enough to survive doubt. Once it clears, the caller has proof of compliance and the amounts climb.
"Your account has been compromised"
What it sounds like
An urgent security alert from an institution that has your interests at heart.
What it is
The trigger sentence. Fear collapses the time available for verification, which is why the call never ends with an invitation to visit a branch tomorrow.
"Just scan this QR code"
What it sounds like
A convenience — no typing, no mistakes, the way a payment terminal works everywhere else.
What it is
An address the victim cannot read. A QR code is a wallet destination in a costume, and the IC3 treats unexplained QR documentation as a fraud indicator in its own right.
"The kiosk operator will refund you"
What it sounds like
A safety net, since the machine is a registered business with an address and a helpline.
What it is
A misunderstanding of what the operator sold. The operator sold a currency exchange, and it completed. The destination wallet was chosen by the customer.
Every phrase in that call belongs to a real institution. None of them belongs to the man saying it.
How The Con Runs, Step By Step
Five moves. The victim performs four of them personally.
1. The manufactured emergency
A pop-up, a spoofed number or a message announces fraud, a warrant or a compromised account. The pretext varies; the emotional requirement never does — the target must believe the loss is already happening.
Panic is not a side effect of this scam. It is the payment method.
2. The handover to an 'investigator'
The first voice escalates the call to a second, more senior voice with a case number, a badge number and a callback line that always answers. Institutional theatre costs nothing and buys everything.
Two people on the call means one of them can play the sceptic on your behalf.
3. The withdrawal coaching
The victim is told how much to withdraw, in which denominations, and what to tell the cashier — usually a home repair, a car, or a family matter. This is the step the FBI's indicator list is built around, because it is the last one with a witness.
The lie told to the teller is the moment the bank's protection is switched off from the inside.
4. The kiosk
Cash in, QR scanned, receipt printed, often across several machines and several days to stay under per-transaction limits. Operators may call the customer mid-session to warn them; the caller has already explained that such warnings are part of the breach.
The one safety call that could stop it was pre-emptively discredited an hour earlier.
5. The second squeeze
Once the funds move, a recovery specialist appears — sometimes the same crew, sometimes a buyer of the same victim list — offering to trace and return the money for an upfront fee.
The only asset with proven resale value here is the victim's phone number.
The Timeline Of A Single Victim
Compressed from the pattern the FBI describes across thousands of 2025 complaints.
Hour 0 — the alert
A full-screen warning claims her device is compromised and displays a support number. She calls it, because the number is on her own screen.
Nothing was compromised except the assumption that a screen tells the truth.
Hour 1 — the escalation
Support transfers her to a fraud investigator who says her savings are being drained from the inside and must be converted to crypto to be quarantined.
He gives a case number. Case numbers are free, and she writes it down carefully.
Hour 3 — the bank
She withdraws $9,000 in hundreds. Asked why, she repeats the line she was given: a kitchen renovation. The teller has no reason to press further.
This is the last point in the story where a stranger could have ended it.
Hour 4 — the kiosk
In a convenience store she scans a QR code from her phone, feeds in the notes, and receives a printed receipt confirming a completed purchase and transfer.
The receipt is genuine. It documents her own transaction, not his crime.
Day 2–4 — the ladder
The investigator explains that the quarantine is partial and requires the rest. Two more kiosks, two more trips, because daily limits exist and he knows them better than she does.
Kiosk limits do not protect anyone; they only set the visit schedule.
Day 5 — the silence
The callback line stops answering. She files with local police and with IC3, providing the receipts, the transaction ID and the kiosk address — which is exactly the right thing to do, and rarely enough.
Cash became crypto with no counterparty to sue and no rail to reverse.
Five days, three machines, one telephone number, and not a single line of malicious code anywhere in the file.
Red Flags You Can Check In Under A Minute
- Anyone at all directs you to a cryptocurrency kiosk.No bank, agency, court, police force or utility collects payment this way. The FBI states it plainly: no legitimate official will call to demand payment via a crypto kiosk.
- You were told what to say to your bank.A scripted answer for the cashier exists to disable the only human check in the process. Honest instructions never include a cover story.
- The destination is a QR code you cannot read.Unexplained QR documentation is on the FBI's own indicator list. If you cannot say whose address it is, you are sending money to a stranger by definition.
- Large cash withdrawals in big denominations, urgently.Speed plus cash plus secrecy is the signature of a coached victim, not a legitimate payment.
- The kiosk operator called to warn you and you were told to ignore it.The FBI's guidance is the opposite: if the operator says your pattern looks like fraud, stop or cancel the transaction immediately.
- Someone is standing beside you 'helping' at the machine.Loitering near kiosks and assisting operators is a listed indicator. Genuine help asks why you are doing this; a handler asks whether it went through.
Six checks, seconds each. The whole con depends on none of them happening while somebody is talking in your ear.
The Numbers That Settle It
All of it public, all of it federal, all of it dull enough that nobody reads it until afterwards.
13,400+ complaints, $388M+ lost
IC3's 2025 figures for complaints involving cryptocurrency kiosks. Complaints rose 23% and losses rose 58% against 2024.
Over-50s carry the damage
More than half of the complaints came from people over fifty, with reported losses above $302 million — the age bracket most likely to be reached by a landline and a badge number.
State concentration is real
California logged 978 complaints and about $24.0M in adjusted losses; Arizona 460 complaints and roughly $14.5M. Kiosk density and reporting rates track each other closely.
Kiosks are one leg, not the whole scam
The FBI cautions that reported losses cannot be attributed to kiosks alone, because the same scripts also route victims through transfers and other rails.
The Second Act: Why The Cash Doesn't Come Back
The aftermath is as structured as the call, and it is structured around three hard facts.
Cash has no reversal
Notes went into a machine and crypto went out to an address. There is no acquirer, no chargeback window and no counterparty who agreed to hold the money in escrow.
The transaction was authorised
Every button was pressed by the victim. That is what makes the fraud durable and what makes the operator's paperwork clean when investigators ask.
The recovery vulture arrives
An upfront-fee asset recovery service appears within days, typically after harvesting the same complaint. Tracing is real work, but nobody legitimate charges you first and promises a result.
Report it anyway: TXID, wallet address and kiosk location to IC3 and your local police. Traces work far more often when they start in the first week.
The money left when the notes went in. Everything after that is either evidence or a second scam wearing a lanyard.
Why Careful People Do This
None of these requires naivety, which is the part that makes it hard to warn against.
The authority is borrowed, and borrowed well
Case numbers, hold music, callback lines and correct terminology are all cheap to fake and heavily weighted by human judgement. Competence reads as legitimacy.
The technology is unfamiliar
A person who has never used a wallet has no instinct for irreversibility. The kiosk looks like an ATM, and ATMs feel like banks — reversible, supervised, accountable.
The clock is always running
Every version of the script insists it must happen tonight. Urgency exists specifically to prevent the one phone call to a real institution that ends the whole thing.
Isolation is engineered first
Confidentiality instructions cut out family, tellers and kiosk staff — the three groups statistically most likely to interrupt.
The lesson isn't that victims were careless. It's that a fraud can be defeated by one outside question, and the script's whole purpose is to make sure nobody asks it.
What To Actually Do
Ordered by how much each one saves.
- Treat any instruction to use a crypto kiosk as proof of fraud. Not a warning sign — proof. The rule holds even when the caller knows your address, your bank and the last four digits of your card, because all three are cheap to buy.
- Hang up and call back on a number you found yourself. Use the number on your bank card or the agency's official site. Never a number from a pop-up, a text or the caller.
- Never scan a QR code supplied by someone you have not met. If you must send anything, type the address by hand and compare the first and last four characters on the kiosk screen — that screen is the only place the destination appears in full.
- Stop the moment a kiosk operator flags your transaction. Cancel it. A cancelled session leaves a record with an operator that keeps records; a completed one leaves only your own transaction with your own ID attached.
- Give the elders in your family one rule and one number. The rule: nothing said on a telephone requires a trip to a shop tonight. The number: yours, to be called before any withdrawal above a set limit, no exceptions.
Checks For This Week
Fifteen minutes, and they mostly protect somebody else.
Save your bank's real fraud number in the phones of your parents
Label it clearly. The goal is that the trusted number is already in the device before the frightening call arrives.
Add a trusted contact to older relatives' bank accounts
Most banks let a named person be flagged on unusual activity. It inserts a second human into a process the script assumes will stay private.
Lower the daily cash withdrawal limit on those accounts
A limit does not stop a determined victim, but it forces a branch visit and a conversation — and this scam is built to avoid both.
Check that the kiosk brand near you is a registered money services business
FinCEN publishes a searchable MSB registry. An unregistered machine tells you what kind of customer the operator is comfortable serving.
Run the destination address through our detector before anyone sends anything
Two minutes, no account, and it produces a permanent report you can show the relative who is currently on the phone with an investigator.
The cheapest fraud control ever invented is a second opinion from someone who isn't scared.
Crypto Kiosk Safety Checklist
Print it and put it where the cash decisions are made, not in a bookmark folder.
Nobody official — bank, police, court, tax office, utility — ever collects payment at a cryptocurrency kiosk.
Never call a support number that appeared on your own screen.
Never scan a QR code given to you by phone, message or email.
Never accept a script for what to tell your bank; the cover story is the scam's safety mechanism.
If a kiosk operator warns you mid-transaction, cancel it immediately.
Refuse 'verification deposits', 'quarantine wallets' and 'government-secured accounts' — none exist.
Keep the receipt, transaction ID, wallet address and kiosk address for every transfer.
Report to local police and IC3 in the first days, and ignore any upfront-fee recovery offer that follows.
Why This Rail And Not Another: A Reversibility Table
Fraud follows the payment method with the fewest brakes. This is the whole reason the kiosk exists in the script, laid out as a table because the comparison is the argument.
| Payment rail | Reversal window | Who can stop it | Used in this scam |
|---|---|---|---|
| Card payment | Chargeback, typically 120 days | Issuer and acquirer | Rarely — too traceable |
| Bank transfer | Hours to days, recall possible | Bank compliance, receiving bank | Often, as the first leg |
| Gift cards | None once redeemed | Retail staff at purchase | Frequently, for smaller sums |
| Cash at a crypto kiosk | Minutes, and only before confirmation | The victim, the teller, the operator's warning call | The preferred final leg |
Read the last row again. The only three brakes on that line are all human, and the script is written to remove each one in order.
The Interruption Script: Words That End The Call
Four sentences, one for each role that can still stop this: the target, the relative, the counter staff, and the person standing at the machine. Rehearsed lines survive panic; improvised ones do not.
If it is happening to you
"I'm going to hang up and call the number printed on my own bank card. If you are who you say you are, you'll still be there in ten minutes." Then hang up first, and dial before the doubt fades.
If a relative is on the phone right now
"Don't argue with him — just put the phone down on the table and don't touch it. Nothing has to be decided in the next hour." Removing the voice matters more than winning the argument.
If you are the bank teller or shop assistant
"Has anyone told you what to say to me about this withdrawal?" A coached victim hesitates on that question, because it is the only one the script has no line for.
If the cash is already in the machine
Cancel before you confirm, if the screen still offers it. After confirmation nothing on that machine can be undone, so the next call is to the police — not back to him.
This is the cheapest countermeasure in the whole file: four sentences, no software, no fee, and it works because the con was never technical.
Got a Suspicious Message?
Use our AI-powered detector to analyze potential scams instantly.
Key Takeaways
- 1.In 2025 the FBI logged over 13,400 crypto-kiosk complaints and more than $388M in losses — complaints up 23%, losses up 58% year on year.
- 2.People over fifty filed more than half the complaints and account for over $302M of the reported damage.
- 3.There is no exploit here: the victim withdraws the cash, drives to the machine and scans the QR code while a fake official narrates.
- 4.The bank teller and the kiosk operator are the only two brakes in the system, and the script disables both before they engage.
- 5.Cash-to-crypto is irreversible and authorised by the victim, which is why refunds effectively do not exist and recovery offers are usually a second fraud.
- 6.Report inside the first week with the receipt, TXID, wallet address and kiosk location — early, complete complaints are what make tracing and freezing possible at all.
“The machine did its job.”
So did the con.
Frequently Asked Questions
Sources & Citations
Research for this investigation compiled from publicly available blockchain data, security reports, and community documentation.
www.ic3.gov · Date not published or not verified
www.ic3.gov · Date not published or not verified
www.ic3.gov · Date not published or not verified
www.ic3.gov · Date not published or not verified
www.ic3.gov · Date not published or not verified
index pagewww.ic3.gov · Date not published or not verified
Consumer Advice · 21 Apr 2021
Consumer Advice · 21 Apr 2021
FinCEN.gov · Date not published or not verified
index pageFinCEN.gov · Date not published or not verified
Chainalysis · Date not published or not verified
index pageChainalysis · Date not published or not verified
Verification: On-chain references: none published for this case.
Methodology: Every case needs at least two independent sources before publication, plus verifiable on-chain evidence whenever a public transaction trail exists. Full standards: /methodology
Legal notice: This assessment is based on publicly available data, including on-chain records, official statements and reported incidents. It is journalistic and educational analysis, not legal advice, an accusation of criminal conduct or a court finding. Named companies, projects, domains, wallets and individuals are described as reported by the cited sources; a company name may appear because fraudsters impersonated it, not because the company did anything wrong. If you believe something is inaccurate or out of date, write to cryptostrapon@pm.me and we will correct it and log the change. Editorial policy