Bitcoin ATM Scams: How They Work and What to Do If You Paid

A Bitcoin ATM scam starts when someone tells you to take cash to a crypto kiosk (a machine that turns cash into crypto) and put it in. If that is happening to you right now, stop before the cash goes in. A payment at a kiosk usually cannot be undone.

Checked against the FTC (opens in a new tab), FinCEN (opens in a new tab) and FBI IC3 (opens in a new tab) pages, October 2026.

How a Bitcoin ATM scam works

FinCEN says (opens in a new tab) many scammers who use kiosks start with an unsolicited call. Contact can also start with an online ad, a pop-up or an email. The scammer then often stays in constant phone or online contact, giving step-by-step instructions until the payment is done.

The FTC says (opens in a new tab) callers scare people into keeping it a secret, even from their closest loved ones. Check the story with someone you trust before you do anything.

Whatever the story, FinCEN says the criminals typically explain how to withdraw cash from your bank, find a kiosk, and deposit and send the funds. They normally supply a QR code so the crypto goes to a wallet they control.

That is the Bitcoin ATM QR code scam. The FTC says (opens in a new tab) that as soon as people scan a QR code provided by scammers at the machine, their cash is deposited straight into the scammers' crypto account.

The scripts scammers use

Crypto ATM scams use different stories. The tell is in the last column.

The rows follow FinCEN's kiosk scam examples (opens in a new tab), which include government impersonation, bank impersonation and romance scams. FinCEN's August 2025 notice also says tech and customer support scams, where scammers pose as well-known companies, are the most common type associated with kiosks. That is FinCEN's finding for the US.

On the tells: the FTC says (opens in a new tab) there is no legitimate reason for someone to send you to a Bitcoin ATM, and that someone from the US government never will. IC3 advises (opens in a new tab) never to send payment to someone you have only spoken to online, even if you believe you have built a relationship.

Caller ID proves nothing. The FTC says (opens in a new tab) scammers can make any name or number show up on your caller ID, which is called spoofing. Whatever the name on the screen, the request that follows is the same: cash into a kiosk.

Are Bitcoin ATMs legit? The machine versus the instruction

The machine and the instruction are different things. A kiosk can be run by a business that follows its legal duties: FinCEN says (opens in a new tab) kiosk operators that meet their Bank Secrecy Act obligations play a key role in combating fraud. That is a US rule, and FinCEN adds that an operator's registration is not a certification of legitimacy.

Being told to use one is the scam. A caller, a text or a new online friend who sends you to a kiosk is following a script. For what a genuine kiosk purchase costs, read what a Bitcoin ATM purchase costs.

Where to stop: a made-up example

This timeline is invented: the amounts are round numbers and no real operator is named. It shows four places to stop.

1. A caller says they are your bank's fraud team and asks you to stay on the line. Stop point: hang up. The FTC says (opens in a new tab) to call your real bank on the number on your account statements, not the number the caller gives you, because that leads back to the scammer.
2. The caller says your money is unsafe and tells you to withdraw $4,000 in cash. Stop point: the FTC says your money is fine where it is, however urgently they say otherwise. If you are already at the bank, tell the teller the real reason. FinCEN, a US Treasury agency, lists (opens in a new tab) a customer who says a person on the phone directed them to deposit cash into a kiosk as a red flag for US banks.
3. The caller names a kiosk and talks you through it. Stop point: IC3 advises (opens in a new tab) not to follow instructions from someone you have never met to scan a QR code and pay at a kiosk.
4. The kiosk screen asks you to scan a code the caller sent. Stop point: only a scammer gives you a QR code to "help" you deposit your savings. Scanning it would send the $4,000 to their wallet.

Each stop point costs nothing. Once the cash is in the machine, getting it back depends on other people.

Who loses money: figures from the US

As of October 2026, these are US figures from official pages, each for its own year:

• The FTC reported (opens in a new tab) that US consumers reported losing over $110 million to Bitcoin ATM scams in 2023, nearly ten times the amount in 2020. In the first six months of 2024, consumers over 60 were more than three times as likely as younger adults to report losing money to them.
• In its 2025 annual report (opens in a new tab), the FBI's IC3 counted, for 2025, 13,460 complaints involving crypto ATM or kiosk use, with $389 million in losses. People aged 60 and over filed 6,188 of them, with about $257 million in losses.

IC3's own note (opens in a new tab) says its kiosk data includes complaints where a kiosk was used in the scam, but a complaint may include other types of transactions too. Read the losses as losses in scams that involved a kiosk.

If you already paid at a Bitcoin ATM

As of October 2026, do these in order, and move quickly.

1. Stop paying and stop answering. Do not send more money for any reason.
2. Contact the kiosk operator right away, using the operator's own number, for example from the receipt or the machine, never one the caller gave you. The FTC says (opens in a new tab) to tell them it was a fraudulent transaction and ask them to reverse it and refund your money. This is a request, and they may say no.
3. If the cash came from a bank or fund account, tell them right away too.
4. Keep the receipt, the QR code or wallet address, and the call log. IC3 says (opens in a new tab) to keep any receipts or transaction documentation, and asks people who report a kiosk scam for the transaction ID, the wallet address and the kiosk location, if they have them.
5. Report it where you live: see where to report a crypto scam in your country.

What a Bitcoin ATM refund depends on

The FTC says crypto payments do not have the same legal protections as credit and debit cards, so it can be hard to get your money back, but some US states have passed laws that might help. A refund might come from the operator or, in some US states, from a state law. None is guaranteed.

Arizona is one US example. On August 12, 2026, the Arizona attorney general said (opens in a new tab) her office had helped 35 victims obtain full refunds totaling $171,332 since the state's kiosk law took effect. Under that law (opens in a new tab), an operator must give a full refund, including fees, to a "new customer" (someone who has used that operator for less than ten days) who was fraudulently induced to use the kiosk and meets the law's conditions. That customer must contact both the operator and the police or the attorney general within thirty days, and give the operator a report from the police or the attorney general's office that finds they were fraudulently induced into the transaction. Other states and countries may have different rules, or none.

Outside the US: UK and Australia

As of October 2026, official pages in these two countries say the following.

United Kingdom

In a February 2025 release, the FCA said (opens in a new tab) it is illegal to operate crypto ATMs in the UK without FCA registration. The stop rule at the top applies in the UK too.

Australia

The Australian Federal Police said (opens in a new tab) in June 2025 that if someone, a business or a government agency asks you to pay using cryptocurrency, you should not send money. In the same release, AUSTRAC said it had placed new conditions on operators, including a $5,000 transaction limit (AUD). New South Wales Police said that if a person you do not know, or have only met on the internet, asks you to transfer funds using a crypto ATM, you are likely being scammed.

Everywhere else

Check your own country's financial regulator before you use a crypto kiosk. The stop rule at the top applies in every country.

Common misconceptions

• "The caller is a police officer or government official, so I have to pay." IC3 says (opens in a new tab) no legitimate law enforcement or government official will call to demand payment via a cryptocurrency kiosk.
• "A shop machine is safe, so paying is safe." A kiosk can be a real business, but the person telling you to use it is the scammer.

Risks to understand

As of October 2026:

• You could lose all the cash you put into the kiosk. FinCEN says (opens in a new tab) the nature of crypto transactions can make it difficult for law enforcement to recover the funds.
• Getting money back is hard: see what a refund depends on.
• A state refund law covers only some people. Arizona's applies to a "new customer" who contacts the operator and the police or attorney general within thirty days and gives the operator a police or attorney general report that finds they were fraudulently induced. A customer who misses one of these conditions does not meet the law's terms.
• A recovery offer after a loss can be a second loss. The warning in the refund section explains who does not contact victims and what not to pay.

Next, read crypto scams and their warning signs for other patterns, or how to buy crypto if you want to buy on purpose through a platform you chose yourself.