Scammers Direct Victims to Bitcoin ATMs as Final Step in Multistage Scam Pipeline
Law enforcement data released by the FBI and its Internet Crime Complaint Center (IC3) reveals that cryptocurrency kiosks have become a critical chokepoint in fraud schemes, with victims converting cash into scammer-controlled crypto at Bitcoin ATMs and similar devices. In 2025, kiosk-specific complaints totaled 13,460 with adjusted losses of $388,981,267, representing a 23% increase in complaints and a 58% increase in losses compared to 2024.
The scam pipeline typically begins online. Victims receive fake bank alerts, cloned voice calls, romance messages, or tech-support pop-ups. Scammers then pressure victims to withdraw cash and visit a cryptocurrency kiosk to convert funds into digital assets. Once the cash converts to crypto and moves to a scammer-controlled wallet, the transaction cannot be reversed.
Kiosk fraud has grown sharply. FTC data cited by the IC3 shows reported fraud losses involving Bitcoin ATMs increased nearly tenfold from 2020 to 2023. In the first half of 2024 alone, Bitcoin ATM fraud losses topped $65 million, with a median reported loss of $10,000 per victim.
Victims skew older. More than half of kiosk complaints involved people over 50, accounting for $302 million in losses during 2025. Scammers exploit urgency and fear, using fake social profiles, voice clones, identification documents, and deepfake videos to create pressure. Some instruct victims to split deposits across multiple machines or amounts to avoid detection systems.
Cryptocurrency kiosks, as defined by the IC3, are ATM-like devices or terminals that allow users to exchange cash for cryptocurrency. Operators typically charge fees ranging from 7% to 20% per transaction. The speed and finality of kiosk transactions make them attractive to scammers: funds move instantly and cannot be recalled.
Regulatory Response and Operational Gaps
The Financial Crimes Enforcement Network (FinCEN) has flagged non-compliant kiosk operators as especially vulnerable to abuse. The agency warned that scammers may direct victims to specific kiosks across state lines to exploit weaker regulatory controls in certain jurisdictions.
Two states have enacted new safeguards. California’s Department of Financial Protection and Innovation (DFPI) prohibits kiosk operators from accepting more than $1,000 per person per day under the Digital Financial Assets Law. Florida’s new crypto ATM law requires warnings, receipts, transaction caps, registration of operators, and conditional refunds for certain transactions.
The broader context underscores the scale of crypto-related crime. In 2025, the IC3 received 181,565 cryptocurrency complaints totaling $11 billion in reported losses. These complaints represented a subset of the center’s total intake of 1,008,597 complaints, which encompassed $21 billion in cyber-enabled crime losses. AI-related fraud complaints alone accounted for $893 million in losses.
IC3 notes that its kiosk complaint data may include other transaction types beyond cryptocurrency kiosks, limiting precision of the loss figure. Regulators and law enforcement have not disclosed intervention rates or the effectiveness of monitoring programs implemented by banks and kiosk operators to prevent scam-directed transactions.
