MalwareZero
A person in a store holds up a phone showing a QR code to a crypto kiosk while clutching a handful of twenty dollar bills, the last step of a bitcoin ATM scam.
Cash from the bank, a QR code from the caller. The kiosk is the last step.

What to do

Someone told me to pay at a bitcoin ATM. Is it a scam?

Updated 26 September 2026

Bitcoin ATMs, also called crypto kiosks, sit in gas stations, convenience stores and supermarkets. You put in cash, scan a code, and the machine sends cryptocurrency to a digital wallet. Scammers love them because the money reaches their wallet within minutes and there is no bank in the middle to stop it. The FBI counted more than 13,400 complaints about these machines in 2025, with losses over $388 million, and on September 23, 2026 the city of Jackson, Michigan voted to ban them outright.

How does the bitcoin ATM scam work?

It almost always starts with a call, a text or a popup that creates a crisis. Your bank account has been hacked. There is a warrant out for your arrest. Your computer is infected and your identity is being used for crimes. The details change, the ending does not: you need to move your money right now, and the safe way to do it is in cash at a kiosk.

The FBI describes what happens next in its May 2026 kiosk alert. The caller gives "detailed instructions" on how to withdraw cash from your bank, how to find a kiosk, and how to deposit and send the funds. In practice that usually means:

  1. A reason to panic. A fake fraud department, a fake deputy or a fake Microsoft technician says your money or your freedom is at risk.
  2. A reason to stay quiet. You are told not to tell the bank teller, because the teller "may be involved," or not to tell family, because the case is confidential.
  3. A cash withdrawal. Often in large bills, often more than you have ever taken out at once. If the teller asks, you are coached to say it is for home repairs or a car.
  4. A drive to a specific kiosk. The caller picks the machine, sometimes one far from home. The US Treasury's financial crimes unit, FinCEN, says scammers have sent victims to particular kiosks, in some cases across state lines, likely to avoid operators with stronger fraud controls.
  5. A QR code. The caller texts or emails a QR code and tells you to hold it up to the kiosk camera. That code is the scammer's wallet address.
  6. Cash in, coins out. You feed in the bills. The machine converts them to bitcoin and sends them to the address in the QR code.

The caller usually stays on the line the whole time, talking you through each screen. That is not courtesy. It keeps you from hanging up, thinking, and calling someone who would stop you.

Why do scammers insist on a bitcoin ATM?

Because it is fast, it is final and it works with cash. FinCEN's August 2025 notice on crypto kiosks spells out the difference from a bank transfer: once the kiosk sends the coins, the recipient "instantly owns" them and often moves them straight to another wallet. A bank or wire transfer, by contrast, can sit pending for a day or two before it settles, which gives banks time to catch fraud.

The fees do not put scammers off either. FinCEN says kiosk fees run from 7 to 20 percent, far more than other ways of sending money, and scammers accept that cost because they get the coins so quickly.

There is a second reason. A bitcoin ATM feels official. It looks like a bank ATM, it sits in a familiar store, and it asks for ID. For someone who has never bought cryptocurrency, following instructions at a machine feels safer than handing cash to a stranger, which is exactly why scammers steer people to it.

Which scams send you to a crypto kiosk?

The FTC's analysis, "Bitcoin ATMs: A payment portal for scammers," found three types behind most of the losses. Each has its own page here if you want the full script:

Law enforcement also sees kiosks used in romance scams, family emergency calls and fake lottery wins, according to FinCEN. A grandparent scam caller who asks for bail money at a kiosk is running the same con with a different story.

How big is the problem?

Big and still growing. The figures below come from reports filed by victims, so they undercount, because many people never report.

The FTC's August 2025 review of large losses among older adults found cryptocurrency was the most common way money left, at 33% of losses of $10,000 or more, mostly through bitcoin ATMs.

Are cities and states banning bitcoin ATMs?

Some are. On September 23, 2026, the city council in Jackson, Michigan unanimously passed an ordinance banning crypto kiosks in the city, WILX reported. The ban also covers crypto purchases made through a store cashier. Existing machines get 90 days to be removed once the rule takes effect, and each machine left running can be fined $500 a day. The council pointed to the FBI's national loss figures.

Other rules limit the damage instead of banning the machines. California's Digital Financial Assets Law, FinCEN notes, bars kiosk operators from taking more than $1,000 a day from a customer. States have also gone to court: in February 2025, Iowa's attorney general sued two kiosk operators, accusing them of failures that let Iowans send millions of dollars to scammers.

Useful as these rules are, a limit or a ban on one town's machines will not stop a determined caller. They simply send you to the next town, or tell you to come back tomorrow for a second deposit. The protection that works everywhere is knowing that the request itself is the scam.

I am at the machine right now. What should I do?

Stop. Hang up the phone, even mid-sentence, and step away from the kiosk. Do not put in another bill, even if the caller says the transfer is half done and you will lose everything unless you finish. That line is pressure, nothing more.

Then check the story yourself. Call your bank using the number on the back of your card, or the agency using a number you look up, not one the caller gave you. Ask a store employee for help if you are shaken. If you and your family have a family safe word, now is the moment to call a relative and use it.

If you have already put in some cash, keep the receipt. It has the transaction details you need for the next section.

I already paid at a bitcoin ATM. What now?

Move fast. Getting the money back is rare, but it is only possible in the first minutes and hours, before the coins are moved on.

  1. Call the kiosk operator immediately. The company name and support number are on the machine and on your receipt. Tell them the transaction was fraud, give them the transaction ID, and ask them to stop or flag it and to block the wallet address. The FTC says to report crypto scams to the company you used to send the money.
  2. Cut off the scammer. Stop answering their calls and texts. They will often call back with a new emergency and ask for a second deposit. Do not make one.
  3. Collect the evidence. The FBI asks for transaction IDs, wallet addresses, the kiosk's location, the caller's phone numbers and emails, and a description of what happened. Screenshot the QR code they sent you before you delete anything.
  4. Report to the FBI at ic3.gov and to your local police. A police report number also helps with your bank.
  5. Report to the FTC at ReportFraud.ftc.gov. Our list of where to report a scam covers the other agencies.
  6. Call your bank. Tell them about the cash withdrawal and what it was for. If the caller had you install remote access software or read out account details, ask the bank to secure your accounts, and follow the steps in I paid a scammer: what now.
  7. Protect your identity if you gave details. If the caller took your Social Security number or bank logins, a free credit freeze blocks most new accounts in your name.

Watch for the second scam

People who lose money at a kiosk are prime targets for a follow-up con. Someone calls, emails or messages to say they have traced your bitcoin and can get it back for a fee. Some even pose as the FBI or IC3. Real law enforcement never charges to return stolen funds. Our page on crypto recovery scams explains how the second con works.

How can I protect a parent or grandparent?

Older adults lose the most at these machines, and the money is often savings they cannot rebuild. A short conversation before any call arrives helps more than anything after.

Share this page, or just the one rule, with anyone who might get the call.

Quick answers

Would the police, the IRS or my bank ever ask me to pay at a bitcoin ATM?
No. The FBI says no legitimate law enforcement or government official will call to demand payment through a cryptocurrency kiosk, and no bank protects your money by having you turn it into cryptocurrency. A request to use a bitcoin ATM is enough on its own to know it is a scam.
Can I get my money back from a bitcoin ATM?
Usually not, because the coins reach the scammer's wallet within minutes. Call the kiosk operator's number printed on the machine or your receipt straight away anyway, give them the transaction ID and ask them to flag the wallet, then report to IC3 and the FTC. Speed gives you the only real chance.
The caller is still on the phone and I am at the machine. What do I do?
Hang up and walk away from the kiosk. Do not put in any more cash, even if the caller says the transfer is half finished. Then call your bank or the agency on a number you find yourself, or ask a store employee for help.
Is it illegal to use a bitcoin ATM?
No. The machines are legal in most of the US and some people use them to buy cryptocurrency for themselves. The problem is being told to send the coins to a wallet address or QR code that someone else gave you. Some states limit them, California caps kiosk deposits at $1,000 a day per customer, and some cities, such as Jackson, Michigan, have voted to ban them.
Someone says they can recover my bitcoin ATM payment for a fee. Is that real?
Almost certainly not. People who report a crypto loss get targeted by recovery scammers, some posing as the FBI or IC3. Real law enforcement does not charge a fee to return stolen money.