A crypto kiosk scam is any scam whose payment step is a Bitcoin ATM: the victim is told to withdraw cash and feed it into a machine, scanning a QR code the scammer supplies. The FTC recorded losses rising nearly tenfold to over $110 million in 2023, with a $10,000 median. No real business or agency ever asks anyone to use one.
This is not a scam with its own story. It is a payment step that other scams have moved to, and it deserves its own page because it is now where the largest losses physically happen.
The call is a bank fraud department, a government agency or a technology company — the schemes covered under bank impersonation, government impersonation and tech support. What is different is the ending. Instead of a transfer, the victim is told to withdraw cash and put it into a machine in a shop.
The FTC found reported losses at these machines rising nearly tenfold to over $110 million in 2023, and $65 million in the first half of 2024 alone. FinCEN puts IC3’s 2024 count at 10,956 complaints and about $246.7 million, with complaints up 99% in a year.
The median loss is $10,000 — roughly thirty times the median for gift card scams, because a machine will take as much cash as a person can carry.
And the whole thing is settled by one sentence from the FTC: real businesses and government agencies will never tell you to use a Bitcoin ATM.
Unauthorised activity on your account, a government official warning your identity has been stolen, or a security alert that looks like it came from a technology company. The FTC records those three.
The money has to be moved somewhere the fraudster cannot reach, and cryptocurrency is offered as that place — a detail the victim has no way to evaluate.
In person, usually with an explanation prepared for the cashier. This is the step a bank can still interrupt, and the script arms the victim against it in advance.
Where it could have stopped
No bank, agency or company asks anyone to withdraw cash and feed it into a cryptocurrency machine. There is no legitimate version of that instruction. This is the last moment at which a person standing at a counter, holding money they still own, can be stopped.
Often not the nearest. FinCEN records law enforcement observing victims sent to specific kiosks, sometimes across state lines, likely to avoid operators with strong compliance controls.
The destination wallet is encoded in the QR code. The victim never reads an address, never types one, and never picks a recipient — which removes the one step where an unfamiliar transaction might have looked like sending money to a stranger.
Often over several visits, and sometimes at several machines, because operators and states impose daily limits.
No chargeback, no recall, no intermediary bank. The paper slip from the machine is the only thing the victim comes home with.
The instruction arrives inside a crisis somebody else declared. By the time a kiosk is mentioned, the victim already believes their savings are being stolen. The machine is presented as the rescue.
Cryptocurrency is unfamiliar enough to be unfalsifiable. A person who has never bought any has no intuition for whether “move it into Bitcoin for safekeeping” is normal, and asking would mean admitting they do not know.
The QR code removes every decision. No address to read, no recipient to name, no confirmation that resembles paying a stranger.
Cash defeats the controls that now work. Banks question unfamiliar transfers; this is exactly why the FTC sees losses shifting to cash, kiosks and couriers. The rails that get intercepted are the ones being abandoned.
The machines are everywhere and open late. Convenience stores, petrol stations, cafés and supermarkets — heavy foot traffic and long hours, which suits a customer and suits a scripted errand equally.
And some operators do not ask. A third of one state’s kiosk companies were not even registered as money services businesses.
The scams behind the payments are the ones documented across this site. What is specific here is the infrastructure, and FinCEN’s notice of 4 August 2025 is the best account of it.
The machines multiplied nine times over. From 4,128 US kiosks on 1 January 2019 to 37,342 on 1 January 2025 — a figure FinCEN attributes to Coin ATM Radar while noting the data are self-reported and not comprehensive.
Compliance is patchy. A 2021 New Jersey investigation found more than a third of the state’s kiosk operators had not registered with FinCEN as money services businesses — the registration that brings identification, monitoring and reporting obligations with it.
And the gaps are being selected for. The single most revealing line in the notice is that scammers have directed victims to specific kiosks, sometimes across state lines, likely to avoid operators with strong anti-money-laundering controls.
Regulation is arriving unevenly. California’s Digital Financial Assets Law caps kiosk transactions at $1,000 a day per customer. Iowa’s Attorney General sued two operators in February 2025 over failures alleged to have let Iowans send more than $20 million to scammers. Neither is national.
And fraud is not the only use. FinCEN records kiosks laundering suspected drug proceeds, with the DEA reporting transnational criminal organisations — Cartel Jalisco Nueva Generación among them — adopting virtual currency for rapid international transfer. The machine in the petrol station serves both trades.
FinCEN's notice of 4 August 2025 records 10,956 IC3 complaints involving crypto kiosks in 2024 with about $246.7 million lost — complaints up 99% in a year. It also records the machines growing from 4,128 to 37,342 in six years, a third of one state's operators failing to register, and scammers steering victims to specific kiosks to avoid the compliant ones.
The FTC reported in August 2025 that combined losses from older adults who lost more than $100,000 to impersonation scams rose eightfold, from $55 million in 2020 to $445 million in 2024. The payment instructions in those cases are physical: cash into Bitcoin ATMs, and stacks of cash or gold handed to couriers.
The FTC's September 2024 analysis found reported losses at Bitcoin ATMs rising nearly tenfold from 2020 to over $110 million in 2023, and topping $65 million in the first half of 2024 alone. The median loss was $10,000, people over 60 were three times as likely to lose money at one, and the losses come overwhelmingly from impersonation scams.
If you are being told to do this now. Stop and end the call. Nothing bad happens as a result — no account is frozen, no warrant is issued, no fraud completes because you hung up. Then call your bank on the number printed on your card, or the organisation on a number you look up yourself.
If you have withdrawn the cash but not used the machine. The money is still yours. This is the most recoverable moment in the entire scheme and it ends by doing nothing at all. Take the cash back to the bank and tell them what you were told to do.
If the cash is in the machine.
If it is happening to someone else. Interrupt the call and get to them physically if you can. The script depends on them not talking to anybody, and it does not survive a second voice in the room.
Faster and more finally than anywhere else on this site.
The notes stay with the kiosk operator, who keeps them along with a fee that is typically a substantial percentage. The operator then sends the equivalent cryptocurrency to the address encoded in the QR code — so the victim’s physical cash and the scammer’s crypto are two separate movements, joined only by the operator’s books.
That is precisely why the operator’s compliance matters so much, and why an unregistered one is a problem. A registered operator has identification, monitoring and reporting obligations, and its records are what an investigator asks for. An unregistered one is a cash-to-crypto conversion with no record attached.
From the receiving wallet the funds disperse within minutes, frequently across chains, along the route described on the fake platform page.
The other half of this story
Our sibling site Clean on Paper explains where the cash goes after the machine — how value moves between chains and assets to break the link to the address it started from.
No. That is the FTC's own wording — real businesses and government agencies will never tell you to use one. No bank moves your money to safety through a cryptocurrency machine, no agency collects a fine that way, and no refund is ever issued that way. The instruction alone identifies the call.
FinCEN records that law enforcement has seen scammers direct victims to specific kiosks, sometimes across state lines, likely to avoid operators with strong anti-money-laundering controls. If someone insists on a machine forty minutes away rather than the one nearby, that instruction is doing work.
That prompt exists because it discourages fraud, and the script anticipates it — victims are coached on what to answer before they arrive. Answering it wrongly is not your fault, but it is why the operator's records will show a customer who declared the destination as their own.
Very rarely, and only in the first minutes. There is no chargeback, no recall and no intermediary bank. Report it immediately anyway: the kiosk operator has a record of the transaction and the wallet address, and blockchain tracing has recovered funds in some cases where the report came in fast.
Because transfers get stopped. Banks now question payments to unfamiliar beneficiaries, and the FTC's data shows scams shifting to physical rails — cash into kiosks, and cash or gold handed to couriers — precisely because nobody intervenes there.
Get to them if you can, and interrupt the call — the script depends on them not speaking to anyone else. If they have already withdrawn cash, the money is still recoverable while it is in their hand; once it is in the machine it is not.
Report it
Reporting is what produces the enforcement data on this page. Find the right agency and phone number for your country on the report page. If money moved in the last few hours, call your bank first.