A crypto ATM scam directs victims to feed cash into a Bitcoin ATM, sending the funds instantly and irreversibly to the fraudster. The machine turns a victim's physical cash into crypto in the scammer's wallet in one step, with no bank in the middle to slow it down or reverse it.
What is a crypto ATM scam?
A crypto ATM, sometimes called a Bitcoin ATM or BTM, is a kiosk that lets people buy cryptocurrency with cash. In a crypto ATM scam, the machine is not the con; it is the payment rail for another scam. Whatever the pretext, a fake government agent, a tech-support warning, a romance or investment pitch, the scammer instructs the victim to withdraw cash and deposit it into a specific crypto ATM, scanning a QR code that points to the scammer's wallet.
The appeal to fraudsters is finality and distance. The victim's cash becomes crypto sent directly to the attacker's address, usually within minutes, with no account to freeze and no chargeback. The QR code the victim scans is provided by the scammer, so the funds never touch anything the victim controls.
For fraud and AML teams, this shows up as cash leaving the banking system: unusual ATM or teller withdrawals, sometimes large, made by a customer who is on the phone and headed to a kiosk. The kiosk operator, meanwhile, sees a customer feeding cash into a machine while following instructions from a caller.
How a crypto ATM scam unfolds
The scam converges every pretext onto the same cash-to-crypto step:
- PretextCreate the emergency The scammer poses as an agency, support line, or love interest and manufactures an urgent reason to pay.
- WithdrawSend them for cash The victim is told to take out cash, often coached on what to tell the bank if asked.
- DepositFeed the crypto ATM At the kiosk, the victim scans the scammer's QR code and inserts the cash, buying crypto to that wallet.
- VanishFunds gone in minutes The crypto lands in the scammer's wallet and is moved on, with no way to reverse it.
Who is involved?
Who | Their role |
The scammer | Runs the pretext, coaches the victim to the kiosk, and controls the wallet behind the QR code. |
The victim | Withdraws cash and deposits it into the machine, believing they are paying a real debt, fee, or investment. |
The crypto ATM operator | Runs the kiosk and processes the cash-to-crypto conversion, and holds any limits and warnings at the machine. |
The victim's bank | Sees the cash withdrawal that precedes the deposit, often the last regulated touchpoint before the money is gone. |
What it looks like in practice
A customer gets a call from someone claiming to be a federal agent, warning that their identity has been linked to a crime and their accounts are about to be frozen. To protect the money, they are told to withdraw cash and convert it to crypto at a nearby kiosk, keeping the call open the whole time and not discussing it with bank staff.
The customer withdraws a large sum, drives to a convenience store, scans the QR code the caller texted, and feeds the cash into the crypto ATM. The funds arrive in the scammer's wallet within minutes and are moved onward. When the customer later tries to reverse it, there is no account to recall from and no chargeback available.
Why it matters for operators
Crypto ATM scams combine the irreversibility of crypto with the anonymity of cash, which makes recovery close to impossible once the deposit is made. They frequently target older adults, and the losses can be large because victims are told to move whole savings to protect them from a fake threat.
The realistic intervention point is the cash withdrawal before the deposit. A customer taking out an unusually large amount of cash, especially while on the phone or acting anxious, is a strong moment for a branch or app prompt asking whether someone told them to withdraw it or to use a crypto machine. Kiosk operators add friction too, through per-transaction limits, new-user caps, and on-screen scam warnings, but by the time the cash is in the machine the window has nearly closed.
What to watch in the data
- Out-of-pattern cash withdrawal. A large or repeated cash withdrawal that breaks the customer's normal behavior, sometimes just under reporting thresholds.
- On-the-phone stress. Branch or support notes describing a customer who is on a call, anxious, and reluctant to explain the purpose.
- Coached responses. Customers giving rehearsed reasons for a withdrawal, a sign they were told what to say.
- Repeat trips. Several withdrawals over days as the victim is bled or as kiosk limits force multiple deposits.
- Older or vulnerable profile. Age or vulnerability plus a sudden interest in crypto kiosks warrants a closer look.
Quick questions
Is the crypto ATM itself fraudulent?
Usually not. Most crypto ATMs are legitimate kiosks; the scam is that a fraudster directs the victim to use one as the payment method. The QR code the victim scans, however, points to the scammer's wallet.
Why is the money impossible to recover?
The victim's cash is converted to crypto sent straight to the scammer's address, then moved onward within minutes. There is no bank account to freeze and no chargeback, so recovery is extremely unlikely.
What pretexts lead victims to a kiosk?
Common ones include government or law-enforcement impersonation, tech-support warnings, romance and investment cons, and fake account-safety alerts. All of them converge on the same instruction to deposit cash into a crypto machine.
Where can operators intervene most effectively?
At the cash withdrawal that comes before the deposit. That is the last regulated touchpoint, so prompting a customer withdrawing a large sum, especially while on the phone, is the best chance to break the scam.
Who is most often targeted?
Older adults are heavily targeted, partly because scammers use authority and fear, and partly because larger savings balances make the payoff bigger. That said, victims span all ages.
Do kiosk limits and warnings help?
They help at the margin. Per-transaction and new-user limits and on-screen scam warnings can slow a victim down, but once cash is being fed into the machine the intervention window is nearly gone.
Crypto ATM scamと併せて知っておきたい用語
2026年 不正・AMLレポート
予測は不要です。このレポートは、不正・AMLチームが実際に直面していることと、その対応方法を分解して解説します。