Bitcoin ATM Scams: How They Work and How to Avoid Them

Bitcoin ATMs (crypto kiosks) are legal in most US states, but they have become a favourite payment route for scammers. In 2025 the FBI received 13,460 complaints involving crypto kiosks with $389 million in losses, up 58% on 2024, and people over 60 lost $257 million of it. The pattern is almost always the same: someone calls or messages, creates an emergency, and tells you to take out cash and feed it into a bitcoin ATM using a QR code they send. No real government agency, bank or tech company will ever ask you to do that.

Facts checked 26 October 2026

Bitcoin now

$79,864

International price, live

Lost via crypto ATMs (US, 2025)

$389m

13,460 complaints to the FBI; +58% on 2024

Lost by people over 60

$257m

About two-thirds of the total (FBI IC3, 2025)

How a bitcoin ATM scam works

Contact. A phone call, pop-up, text or social-media message. Phone calls were the first contact in about 47% of kiosk frauds reported to the FTC; tech-support pop-ups are the single most common scam type.
An emergency. The caller says they are your bank ("your account has been hacked"), the police or a court ("a warrant for your arrest", "missed jury duty"), a government agency, tech support, or a romantic partner or relative in trouble. Some use spoofed real phone numbers, fake uniforms or AI video.
Cash and a QR code. You are told to withdraw cash, often in large bills, take it to a bitcoin ATM, and scan a QR code or type a wallet address they give you, "to protect your money" or to pay the fine.
Coaching. The scammer stays on the phone, tells you what to say if a bank teller or kiosk clerk asks questions, and has you split the money across several machines or days to stay under limits.
It's gone. Kiosk transfers are immediate and usually irreversible, and the owner of the receiving wallet is hard or impossible to trace.

Red flags

Anyone you don't know asks you to pay in crypto, gift cards or cash.
Someone tells you to move money to "protect" it or to fix a problem with your account or computer.
A caller claiming to be police, a court, the IRS, a utility or your bank demands payment at a kiosk. The FBI: "No legitimate law enforcement or government official will call to demand payment via a cryptocurrency kiosk."
You've been given a QR code or wallet address by someone else.
Pressure, threats, secrecy ("don't tell your bank or family"), requests for remote access to your computer, or a caller who stays on the line while you pay.
The kiosk warns that the transaction looks like fraud: the FBI says stop or cancel.

If you have already paid

Call the kiosk operator immediately (the number is on the machine and receipt), say it was a scam and ask them to stop and refund it.
Report it to police and at ic3.gov (include the transaction ID, wallet address, kiosk location and the scammer's numbers), and at ReportFraud.ftc.gov.
Tell your bank, especially if you shared details or gave remote access.
Report to your state regulator or attorney general. Where a state refund law applies, reporting to the operator and to police within the deadline (as short as 14 days) is usually a condition for getting money back.
Keep every receipt and message.
Ignore "recovery" services that promise to get your crypto back for a fee: the FBI says law enforcement never charges victims.

Bitcoin ATM rules by state

Checked October 2026

5 states ban kiosks or cash-to-crypto kiosks (Hawaii, Indiana, Minnesota, Tennessee, Vermont), 28 set daily or new-customer limits, and 18 have no kiosk-specific limit in our data. Many of the newer laws also require scam warnings, cap fees and give new customers a refund if they report fraud quickly.

State	Limit or ban	Kiosk law
Alabama	$1,000/day and $10,000/month new customers; $10,500/day existing	The Cryptocurrency Kiosk Fraud Prevention Act (HB 303, 2026) takes effect October 1, 2026. It requires fraud warnings, a US-based customer service line and daily caps. New users who report fraud to the operator, police and the Alabama Securities Commission within 60 days get a full refund including fees; existing users get half back.
Alaska	$1,000/day and $10,000 per 30 days per user	SB 249 (2026, ch. 50 SLA 26) takes effect October 1, 2026. Kiosk operators need a money transmission license and prior state approval for each kiosk location. Fees are capped at 10%, and fraud warnings, bilingual disclosures and law-enforcement contact lines are required.
Arizona	$2,000/day new customers; $10,500/day existing	Arizona's kiosk fraud-prevention law (HB 2387, 2025) took effect September 26, 2025. Customers must acknowledge on-screen scam warnings, and new customers who report fraud within 30 days get a full refund including fees.
Arkansas	$2,000/day new customers (first 72 hours); $7,500/day existing	Act 557 of 2025 (HB 1467) brought kiosks under the Uniform Money Services Act. Fees are capped at the greater of $5 or 18%, and fraud warnings and live support are required. New customers who report a fraudulent transaction from their first 72 hours after registration to a government or law enforcement agency are entitled to a refund.
California	$1,000/day per customer	Under the Digital Financial Assets Law (DFAL), kiosks have been limited to $1,000 per customer per day since January 1, 2024. Since January 1, 2025, fees are capped at the greater of $5 or 15%, and pre-transaction disclosures are required. Kiosk operators also fall under DFAL licensing from July 1, 2026.
Colorado	$2,000/day new customers (first 7 days); $10,500/day existing	The Colorado Vending of Digital Assets Act (SB25-079) took effect January 1, 2026. It requires disclosures and electronic receipts. A customer's first transaction sent to a foreign wallet or exchange must be fully refunded if fraud is reported to the operator and to police or a government agency within 60 days, with proof.
Connecticut	$2,000/day new customers; $5,000/day existing	Conn. Gen. Stat. 36a-613 (from P.A. 23-82, amended in 2024 and by P.A. 25-66 effective October 1, 2025) requires a licensed operator and caps kiosk fees at 15%. New customers can request a full refund for fraud in the first 72 hours after registration if they also report it to a government or law-enforcement agency.
Delaware	—	Delaware has no kiosk-specific law. A total kiosk ban (HB 441) passed the House in June 2026 but died in Senate committee when the session ended June 30, 2026.
Florida	$2,000/day new customers (first 7 days); $10,000/day existing (from Jan 1, 2027)	CS/HB 505 (ch. 2026-178, approved June 26, 2026) takes effect mostly January 1, 2027, and kiosk businesses must register with the Office of Financial Regulation by March 1, 2027. Operators must refund transactions made in a customer's first 72 hours if fraud is reported to the operator and to law enforcement within 60 days, with proof such as a police report.
Georgia	$2,500/day new customers (first 72 hours); $10,000/day existing	HB 945 took effect July 1, 2026. It caps all kiosk fees and spreads at 18% and requires irreversibility warnings, receipts, live phone support, a compliance officer and screening of high-risk wallets. Scammed new customers who request a refund within 72 hours get their money back. Banks may also put a temporary hold on transactions suspected of exploiting adults aged 65 or older.
Hawaii	Ban on cash-to-crypto kiosks from Oct 1, 2026	HB 1642 (signed July 2026) bars, from October 1, 2026, the ownership or operation of digital-asset kiosks that accept US cash for crypto. Hawaii News Now reports that existing account holders can still cash out.
Idaho	—	Idaho has no kiosk-specific law. Gov. Little vetoed S1359 in April 2026, citing drafting flaws. That bill would have required kiosk licensing and warnings and capped transfers at $2,000 per 24 hours and $10,000 per 30 days.
Illinois	$2,500/day new customers	The Digital Asset Kiosk Act (SB 2319, signed August 18, 2025) requires operators to register with IDFPR and report kiosk locations. It caps fees at 18% and requires full refunds for scammed new customers.
Indiana	Statewide kiosk ban (since Mar 9, 2026)	HEA 1116 (signed March 9, 2026, effective on signing) bans operating crypto kiosks anywhere in Indiana, the first statewide ban. Violators face Deceptive Consumer Sales Act penalties, and knowing violators can forfeit fees collected and their kiosks.
Iowa	$1,000/day; new customers max $10,000 in first 30 days	SF 449 (Iowa Code 533C.1004) has applied to operators since July 1, 2025. It caps fees at the greater of $5 or 15% and requires written fraud warnings, receipts and anti-fraud policies. Fraud victims, both new and existing customers, have refund rights. The Attorney General enforces it with penalties of up to $10,000 per violation, and has separately sued the kiosk operators Bitcoin Depot and CoinFlip.
Kansas	$1,000/day and $10,000 total in first 14 days for new customers; $10,500/day after	HB 2591 (signed April 9, 2026, effective July 1, 2026) requires kiosk operators to hold a money transmitter license and caps fees at the greater of $5 or 18%. Transactions in a new customer's first 14 days are held for 72 hours and can be refunded on request. After that, customers can claim refunds for fraud reported within 30 days.
Kentucky	$2,000/day per user; new users max $10,500 in first 30 days	SB 189 (signed April 13, 2026; Orrick reports an effective date of April 30, 2027) requires a Department of Financial Institutions license, a surety bond and $500,000 net worth. It caps fees at the greater of $5 or 18%. Fraud victims who submit proof such as a police report within 90 days must be refunded.
Louisiana	$3,000/day per user	Act 369 of 2025 (effective August 1, 2025) puts kiosk operators under the Virtual Currency Businesses Act, with a 72-hour waiting period and required disclosures. Act 482 of 2026 (SB 287, effective August 1, 2026) requires operators to answer refund requests within 10 business days and pay within 90 days. It also adds live phone support, quarterly refund reporting and full refunds when the operator is unlicensed.
Maine	$1,000/day per customer	The Virtual Currency Kiosk Act (PL 2025 c. 285, LD 1339) took effect June 12, 2025. It requires a money transmitter license and caps fees at the greater of $5 or 3%. Operators must fully refund transactions made in a customer's first 90 days with them, including fees, when statutory fraud-reporting conditions are met. A 2026 law (PL c. 542) bars registered cash-dispensing machines from acting as crypto kiosks unless the operator is a licensed money transmitter.
Maryland	$2,000/day new customers; $10,500/day existing	SB 305 (2025) took effect July 1, 2025, and each kiosk has had to be registered with the Commissioner of Financial Regulation since January 1, 2026. Fees are capped at the greater of $5 or 15%. Rules adopted March 30, 2026 require fee refunds when fraud is properly reported, and an August 2026 advisory requires markups to be disclosed.
Massachusetts	—	Massachusetts has no statewide kiosk law yet. The Senate added a kiosk ban to its economic development bill on July 23, 2026; the House version left it out, and a conference committee was still negotiating as of the latest reports. About 20 cities and towns ban kiosks, including Haverhill, Waltham, Revere and Peabody, and the Attorney General sued kiosk operator Bitcoin Depot in February 2026.
Michigan	—	Michigan has no kiosk-specific law. HB 5469 and HB 5470, introduced in January 2026, would regulate kiosks under the Money Transmission Services Act; both were still in committee.
Minnesota	Statewide kiosk ban (from Aug 1, 2026)	SF 3868 (signed May 2026) bans crypto kiosks statewide from August 1, 2026, and existing machines must be removed from public view by December 31, 2026. It replaced Minnesota's earlier kiosk limits. St. Paul had already banned kiosks in 2025.
Mississippi	$1,000/day and $5,000 in first 30 days for new customers; $7,500/day existing	The Virtual Currency Kiosk Consumer Protection Act (HB 1625, signed April 8, 2026) took effect July 1, 2026. Operators must be licensed under the Money Transmission Modernization Act and report kiosk locations, provide risk disclosures, and pay valid fraud refund claims within 14 days.
Missouri	—	Missouri has no kiosk-specific law. The Attorney General opened a statewide investigation of five kiosk companies in December 2025, and a 2026 bill (HB 3043) did not pass.
Montana	—	Montana has no kiosk-specific law.
Nebraska	$2,000/day new customers; $10,500/day existing	The Controllable Electronic Record Fraud Prevention Act (LB 609, 2025) requires a money transmitter license, fraud warnings and receipts, and caps fees at 18%. If fraud is reported within 30 days, customers within 14 days of their first transaction get a full refund; other customers get their fees back. Omaha and Grand Island also require warning signs at kiosks.
Nevada	—	Nevada has no kiosk-specific law; operators are licensed only as money transmitters. AARP Nevada and the Attorney General warned in 2026 about unregulated kiosks, and the legislature does not meet again until 2027.
New Hampshire	$2,000/day per customer (from Dec 16, 2026)	SB 482 (ch. 187, signed June 19, 2026) takes effect December 16, 2026. Each customer's first transaction is held for 48 hours, IDs must be verified and warnings posted. Operators must fully refund fraud reported to them and to law enforcement within 14 days. The Union Leader reports that towns can adopt stricter local rules.
New Jersey	—	New Jersey has no kiosk-specific law. The Virtual Currency Kiosk Consumer Protection Act (A3386/S2957) was introduced in January 2026 and is pending.
New Mexico	—	New Mexico has no statewide kiosk law. On September 10, 2026, the Albuquerque City Council passed a citywide ban on crypto ATMs and cashier-assisted cash-to-crypto sales.
New York	—	New York has no kiosk-specific statute; kiosk operators need a BitLicense or a money transmitter license. A kiosk registration bill (S9891) passed the Senate 59-2 on June 3, 2026, but stalled in the Assembly.
North Carolina	$2,000/day new customers (first 30 days); $5,000/day existing (from Jan 1, 2027)	The Virtual Currency Kiosk Consumer Protection Act (H920, S.L. 2026-45) mostly takes effect January 1, 2027. Kiosk operators need a money transmitter license, and fees are capped at 12%. If fraud is reported to the Commissioner of Banks within 30 days, new customers get a full refund and existing customers get their fees back.
North Dakota	$2,000/day per customer	HB 1447 (2025) limits kiosk transactions and requires disclosures, receipts, fraud detection, blockchain analytics and live customer service. Operators must be licensed money transmitters (NDCC 13-09.1-50).
Ohio	—	Ohio has no kiosk-specific law. HB 648, which would require kiosks to register as money transmitters, is pending in a House committee.
Oklahoma	$2,000/day new customers	SB 1083 took effect November 1, 2025. Kiosk operators must be licensed money transmitters, and fees are capped at 15%. Operators must refund new customers defrauded within 72 hours of their first transaction, and some existing customers who report fraud within 14 days.
Oregon	—	Oregon has no kiosk-specific law. AARP Oregon plans to push for a statewide ban in the 2027 session, and Albany already restricts kiosks through zoning.
Pennsylvania	—	Pennsylvania has no kiosk-specific law. The Virtual Currency Kiosk Regulation Act (SB 1015) had a committee hearing in April 2026 but has not passed.
Rhode Island	$2,000/day new customers; $5,000/day existing	HB 5121 (signed June 23, 2025, mostly effective immediately) requires kiosk operators to hold a money transmitter license. Receipt rules took effect November 1, 2025.
South Carolina	—	South Carolina has no enacted kiosk law. H.4592, which would cap daily transactions at $2,000 for new customers and $10,500 for existing ones and require fraud warnings and refunds, has been in House committee since January 13, 2026.
South Dakota	$1,000/day and $10,000 per 30 days per user	SB 98 (signed March 11, 2026) took effect July 1, 2026. Kiosk operators must be licensed money transmitters, and all fees are capped at 3%. Operators must fully refund fraudulent transactions, including fees, within 72 hours once the user meets the reporting conditions.
Tennessee	Statewide kiosk ban (from Jul 1, 2026)	HB 2505 (signed April 13, 2026) bans installing or operating crypto kiosks from July 1, 2026, and covers businesses that host the machines. A violation is a Class A misdemeanor.
Texas	—	Texas has no kiosk-specific law; a 2025 bill (SB 1705) with a $3,000/day cap died. San Antonio has required bilingual warning signs at kiosks since July 1, 2026, and legislators are studying the issue before the 2027 session.
Utah	$2,000/day for first 3 days; $5,000/day after	HB 72 (signed March 25, 2026; kiosk provisions effective May 6, 2026) requires fraud warnings, receipts showing fees and exchange rates, and annual reports of kiosk locations. The Division of Consumer Protection is writing the rules.
Vermont	Statewide kiosk ban (from Jul 1, 2026)	Act 142 (signed June 16, 2026) bans crypto kiosks from July 1, 2026, and all kiosk registrations ended that day. Operators must fully refund any transaction made in violation of the ban. Before the ban, Vermont capped kiosks at $1,000/day with a 3% fee cap and a moratorium on new machines.
Virginia	$2,000/day new users; $5,000/day any user; $10,000/month (from Jul 1, 2027)	HB 665 (2026 Acts ch. 654/655) takes effect July 1, 2027. Kiosk operators will need a State Corporation Commission license, with applications accepted by March 1, 2027, and transactions by unlicensed operators are void. Fees are capped at 18%, and victims who report fraud within 90 days can get their fees refunded.
Washington	—	Washington has no statewide kiosk law: SB 5280, with a $2,000/day cap, died in the House in 2026. Spokane (2025) and, in 2026, Spokane Valley, Kennewick, Anacortes and La Conner have banned kiosks locally.
Washington, D.C.	—	D.C. has no kiosk-specific law. In September 2025 the Attorney General sued Athena Bitcoin, alleging that most of its D.C. kiosk deposits came from scams, and the Department of Insurance, Securities and Banking (DISB) warns residents about bitcoin ATMs.
West Virginia	$1,000/day new customers (first 10 days); $10,000/day existing	HB 5353 (2026) requires kiosk operators to be licensed money transmitters; operators already in the state had 90 days to apply through NMLS. New customers defrauded within 10 days of registering can get a refund if they report it within 30 days.
Wisconsin	$1,000/day per customer	2025 Wisconsin Act 226 (AB 968, enacted April 8, 2026, effective April 10, 2026) requires kiosk operators to be licensed money transmitters, collect customer ID and give itemized receipts. Operators must fully refund, including fees, fraud reported to them and to law enforcement or a government agency within 30 days.
Wyoming	—	HB 75 (2026 Session Laws ch. 60, signed March 6, 2026, effective immediately) lets only licensed money transmitters or chartered financial institutions operate crypto kiosks, and knowingly breaking that rule is a felony. The banking commissioner may set further rules. No dollar caps appear in the statute.

Each state page has the full rules and sources. Laws with a future date are shown with it; check the state regulator before relying on a limit.

What bitcoin ATMs cost, even without a scam

FinCEN says kiosk fees range from 7% to 20%, against about 0.25–3% on mainstream apps and exchanges (the range cited by DC's attorney general), and it cited one operator charging up to 25%. State lawsuits allege bigger mark-ups: Iowa's attorney general says Bitcoin Depot takes 23% and CoinFlip 21%; Missouri alleges CoinFlip showed only a $2.99 network fee while a fee of up to about 22% sat in its terms, so a customer could get about $76 of bitcoin for every $100 deposited; Massachusetts alleges mark-ups of 15% to 50%. These are allegations the companies dispute. Many state laws now cap fees, often at 15–18% or the greater of a set dollar amount and a percentage. A 20% fee on $1,000 leaves you about $800 of bitcoin before any network fee.

Kiosk operators must register with FinCEN as money services businesses and follow anti-money-laundering rules. FinCEN's August 2025 notice told operators and banks to watch for scam red flags, and lists warning signs of a non-compliant operator: no FinCEN registration or state licence, no ID collected, unusually high or unclear fees.

State action against kiosk operators

State	Action	What it alleges or requires
Iowa	Lawsuit, Feb 2025	Iowa's attorney general sued Bitcoin Depot and CoinFlip under the Consumer Fraud Act: hidden fees and misleading refund claims; Iowans sent more than $20 million to scammers through the two companies' machines in under three years, mostly people over 60.
District of Columbia	Lawsuit, Sep 2025	The DC attorney general sued Athena Bitcoin, alleging 93% of deposits at its DC machines in the first five months came from scams, a median victim age of 71 and fees of up to 26%. Athena denies it.
Maine	Settlement, Jan 2026	Bitcoin Depot agreed to pay $1.9 million to refund Maine scam victims (claims closed 8 May 2026).
Massachusetts	Lawsuit, Feb 2026	The attorney general alleges more than 80% of Bitcoin Depot customers spending $10,000 or more at its Massachusetts kiosks were scam victims and that consumers lost over $10 million.
Missouri	Lawsuit, May 2026	The attorney general sued the CoinFlip operator, alleging it processed transactions it knew were scam-driven and hid fees. CoinFlip calls the case meritless.

Lawsuits are allegations until decided. Several states have banned kiosks outright since 2025; see the table above.

Canada

The Canadian Anti-Fraud Centre recorded C$14.2 million lost to scams through crypto ATMs in 2024, and estimates only 5–10% of fraud is reported. The April 2026 Spring Economic Update proposed banning crypto ATMs; it needs legislation and has no date yet. Report scams to the CAFC and local police.

Australia

Since June 2025 AUSTRAC has made crypto ATM operators apply a A$5,000 limit on cash deposits and withdrawals, scam warnings and stronger checks. AUSTRAC found people over 50 made almost 72% of crypto ATM transactions by value. Report scams to Scamwatch and ReportCyber.

United Kingdom

It is illegal to operate a crypto ATM in the UK without FCA registration. In February 2025 Olumide Osunkoya was jailed for four years for running an unregistered crypto ATM network: the UK's first criminal sentence for unregistered crypto activity. The FCA says the number of UK crypto ATMs listed online fell from more than 80 in 2022 to none in 2024, so a bitcoin ATM in the UK is a warning sign in itself.

Elsewhere

The same scripts are used worldwide. Wherever you are, a stranger who wants you to pay in crypto, gift cards or cash is the scam.

FAQ

Are bitcoin ATMs a scam?

The machines themselves are legal in most US states and are run by registered money transmitters, but they are expensive (fees of 7–20% or more) and are widely used by scammers. In 2025 Americans reported $389 million lost through crypto kiosks to the FBI. Five states — Hawaii (cash kiosks), Indiana, Minnesota, Tennessee and Vermont — have banned them.

Can I get my money back from a bitcoin ATM scam?

Sometimes, if you act fast. Call the kiosk operator at once, report to police and ic3.gov, and check your state's kiosk law: several states now require operators to refund new customers who report fraud within a deadline (for example 14, 30 or 60 days), sometimes including fees. Once the bitcoin has moved, recovery is otherwise very difficult. Beware of anyone who offers to recover it for a fee.

Will the police or the IRS ever ask me to pay with a bitcoin ATM?

No. The FBI says no legitimate law enforcement or government official will call to demand payment through a crypto kiosk. Hang up and call the agency on a number you look up yourself.

Why do scammers use bitcoin ATMs?

Because the victim can turn cash into crypto in minutes, the transfer can't be reversed, and the receiving wallet is hard to trace. Scammers send a QR code so the money goes straight to their wallet.

How much does a bitcoin ATM charge?

FinCEN puts kiosk fees at 7% to 20% of the transaction, and state lawsuits allege mark-ups of more than 20% at some operators. Several states cap fees by law. Mainstream exchanges and apps typically charge about 0.25–3%.

Are bitcoin ATMs legal in the UK?

Only an FCA-registered firm may operate one, and none appears to be operating: the FCA says listed UK crypto ATMs fell to none by 2024, and in 2025 an unregistered operator was jailed for four years.

Sources (19)

General information, checked October 2026. Kiosk laws change quickly; check your state regulator. Lawsuits listed are allegations unless decided. Not financial or legal advice.