Bitcoin ATM Scams: The Script, the Machine, and Why the Money Is Gone

A Bitcoin ATM scam is not a broken machine or a hacked app. It is a phone script. Someone posing as your bank, the government, tech support, a relative or a romantic partner convinces you that your money is in danger, sends you to a Bitcoin ATM, and has you feed cash into it while you scan a QR code they sent. That code is their wallet. The moment the machine sends, the money is theirs, and in almost every case it is gone for good. The FBI logged 13,460 complaints involving these machines in 2025, with $389 million in reported losses, and people 60 and over lost about two of every three of those dollars.

One rule stops every version of it: if anyone tells you to pay at a Bitcoin ATM, it is a scam. Not usually. Every time. No bank, government agency, utility, tech company or real person who loves you will ever send you to one of these machines to "protect" your money or settle a debt.

Read more: Bitcoin for Beginners | What Is a Bitcoin Wallet?

Are Bitcoin ATMs Safe? The Machine Is Legal, the Script Is the Scam

The machine itself is a legal piece of equipment in most of the country. You put in cash, it converts the cash into bitcoin, and it sends that bitcoin to a wallet address you show it. People use them to buy bitcoin with cash, and plenty of those transactions are exactly what they look like.

What makes the machines dangerous is not a flaw in the hardware. It is that they do something nothing else in a strip mall does: they turn a stack of cash into a payment to anyone on the planet in a few minutes, and that payment generally cannot be pulled back. A bank teller might ask why you are withdrawing $20,000. A gas station kiosk does not ask anything.

Scammers figured that out, and the numbers followed the machines. According to the FTC, operators reported about 4,250 Bitcoin ATMs in the U.S. in January 2020 and about 32,000 by June 2024, counts the operators supplied themselves to an industry website. Over roughly the same stretch, losses reported to the FTC through these machines grew nearly tenfold, to over $110 million in 2023. The FBI's newer count is larger still: $389 million in 2025.

Regulators are now acting on the machines, too. Minnesota banned crypto kiosks outright starting August 1, 2026, with every machine to be physically removed by December 31, according to the City of Rochester. In Washington, D.C., the Attorney General sued one large operator in September 2025, alleging that 93% of the deposits at its machines in its first five months there were the direct result of scams and that the victims' median age was 71. Those are allegations in a lawsuit, not court findings, but they show how lopsided the traffic at some machines can be.

None of that makes Bitcoin itself a scam, any more than wire fraud makes banks a scam. It makes one payment channel a favorite tool of people who need money to move fast and never come back.

The Script, Call by Call

The reason this scam works on smart, careful people is that it is not improvised. It is a script, repeated across thousands of reported cases, and the FTC has described it step by step in its consumer alerts. Once you see the beats laid out, you can recognize them in any costume.

Beat 1: The alarm

It starts with a call, a text or a pop-up on your computer saying something is wrong. Your bank account has suspicious charges. Your Social Security number was tied to a crime. Your computer has been hacked and your bank login stolen. The FTC's data spotlight says these scams often "start with a call or message about supposed suspicious activity or unauthorized charges," or with a fake security warning that impersonates a company like Microsoft or Apple. The goal of beat one is fear, because frightened people do not stop to check.

Beat 2: The secret

Next comes isolation. The caller tells you not to tell anyone, not your spouse, not your kids, not the teller at the bank. Sometimes there is a reason attached, such as a confidential investigation. The CFTC lists demands for secrecy and coaching on what to say to others as red flags. Secrecy is the scammer's protection, because the first person you tell is the person most likely to stop it.

Beat 3: The fix

Then the caller offers a way out: move your money somewhere safe before the criminals, or the government, can take it. The FTC says scammers have even called Bitcoin ATMs "safety lockers." This is the turn that matters. Nothing about a real fraud problem is ever solved by withdrawing your own money in cash.

Beat 4: The cash

You are told to withdraw cash, often a large amount, and drive to a specific machine, the kind found in convenience stores and gas stations. An FTC alert notes the caller will "stay on the phone the whole time." That is not friendliness. It keeps you from hanging up, thinking and calling someone. The CFTC lists telling you to split your payments as a red flag.

Beat 5: The code

At the machine, the caller texts you a QR code. You scan it, feed in the cash, and confirm. The code holds the scammer's wallet address, so the bitcoin your cash buys goes straight to them. The FTC's March 2024 alert puts it bluntly: "Only a scammer will give you a QR code to 'help' you deposit your life savings in a Bitcoin ATM."

Beat 6: Gone

The machine sends the bitcoin to the scammer's wallet, and from there they can move it on. The caller may even come back days later with a new problem that requires another deposit, or with an offer to recover the first one for a fee.

Why the Money Cannot Come Back

If someone steals your credit card number, you call the card company, dispute the charge and usually get your money back. That safety net exists because a bank sits in the middle of every card payment and can reverse it. A Bitcoin transaction has no one in the middle.

The FTC says it plainly: "Cryptocurrency payments typically are not reversible," and they "do not come with legal protections" like the dispute rights on credit and debit cards. Once you pay, getting the money back generally depends on the person you paid choosing to return it. A scammer is not going to.

This is not a bug. It is the design. The original Bitcoin paper from 2008 argued that "transactions that are computationally impractical to reverse would protect sellers from fraud." Finality is what lets two strangers trade without a bank, and it is the same property that makes holding your own bitcoin work, as covered in our guide to Bitcoin self-custody. Nobody can claw back what you own. The flip side is that nobody can claw back what you send.

A Bitcoin ATM scam turns that property against the buyer. In this transaction the scammer plays the role of the seller the design protects, and you are the buyer with no escrow and no dispute button. The machine did exactly what it was built to do.

There are narrow exceptions. Some states now force ATM operators to refund certain victims, which is covered below. Operators sometimes flag a transaction as possible fraud before it goes through, and the FBI's guidance is simple: if a kiosk operator tells you a transaction looks like fraud and advises you to stop, stop. But once the bitcoin has left the machine and landed in the scammer's wallet, no button anywhere undoes it. That is why everything useful about this scam happens before the cash goes in.

Who Gets Targeted, by the Numbers

Anyone can be targeted, but the losses are not spread evenly. The FBI's 2025 Internet Crime Report breaks crypto ATM complaints down by age, and the shape of the chart is the story.

People 60 and over filed 6,188 of the 13,460 complaints and reported $257.5 million in losses, about 66% of the $389 million total. Divide those losses by those complaints and the average comes to roughly $41,600 per complaint for people 60 and over, against roughly $16,100 for everyone under 60 combined. Those averages are rough, since some complaints also include other kinds of transactions, but the gap is too wide to be noise.

The FTC's earlier data points the same way. In the first half of 2024, people 60 and over were "more than three times as likely" as younger adults to report a loss at a Bitcoin ATM, and the median reported loss was $10,000, against $447 for fraud in general, according to the FTC data spotlight. About 86% of those reports involved government impersonation, business impersonation or tech support scams. The Treasury's FinCEN warned banks in an August 2025 notice that some of the tech support and bank imposter scams paid through kiosks "disproportionately impact older adults."

The same FTC data shows how the script reaches people, which tells you where to put your guard up.

Nearly half of the FTC's reports started with a phone call. That is the single most useful fact in this section for anyone protecting a parent. The danger is not the machine on the corner. It is the phone in their pocket, ringing with a voice that sounds like the bank.

Younger people are not safe, just less often the target. People under 60 still reported about $83 million in crypto ATM losses in 2025. And the totals are almost certainly too low: the FTC notes that only 4.8% of people who experienced mass-market fraud complained to a Better Business Bureau or a government agency.

Geography matters less than you might think. In a May 2026 alert, the FBI reported that complainants in Texas lost $56.8 million, Florida residents filed 1,213 complaints and lost $32.8 million, and California complainants lost $24.0 million. Big states top the list largely because they have more people. The script does not change at the state line.

The One Rule: If Anyone Tells You to Pay at a Bitcoin ATM, It Is a Scam

The federal agencies that track this scam all land in the same place. The FTC says nobody from the government, law enforcement, a utility company or a prize promoter will ever tell you to pay with cryptocurrency, and "If someone does, it's a scam, every time." The FBI puts it this way: "No legitimate law enforcement or government official will call to demand payment via a cryptocurrency kiosk."

The rule works because it does not require you to figure out who is calling. Scammers are good at sounding like a bank, and caller ID can be faked. You do not have to win that argument. You only have to notice one instruction: go to a Bitcoin ATM. That instruction alone ends the call.

The costumes overlap and stack. The FTC describes scams that start with a fraud alert and then bring in someone posing as a government agent, even one "claiming to be from the 'FTC'." Every handoff is another layer of costume over the same instruction.

How to say it to a parent

If you are reading this for someone else, say the rule before the call comes, not after. A rule someone heard from their own family last week beats a warning poster at the gas station. Keep it short enough to remember with a stranger shouting on the phone. The FTC's advice fits on an index card: slow down, talk with someone you trust before acting, and never withdraw cash because of an unexpected call or message. When in doubt, hang up and call the number on the back of the card or on the statement, never the number the caller gives you.

Then make one standing agreement: before moving any money because of a call, they phone one named person first, every time, no matter what the caller says. Make it a promise you both keep, not a test they can fail. Scammers count on embarrassment and urgency. A standing promise removes the need to explain anything, and it puts a trusted voice between the caller and the cash.

Print it, tape it next to the phone, and say it out loud together once. That is the whole conversation.

If It Already Happened: The First Hour

If you or someone you love already sent money, speed matters and shame does not. These scripts are built by professionals and they work on careful people. Arizona's Attorney General specifically urges victims not to feel embarrassed about coming forward, because a delay of even a few days can cost a refund.

What follows is general information from federal and state agencies, not legal advice. If large sums are involved, talk to your state attorney general's office or a lawyer you find yourself.

First, stop all contact and send nothing more. A scammer who got paid once has every reason to call again, with a new emergency or a fee that will supposedly unlock the first deposit. If the caller ever had remote access to your computer, disconnect it from the internet and have it checked before you use it for banking again. While it is fresh, write down everything you remember: the numbers that called, the names they used, the times, and what they told you to say. Then work down this list the same day.

The FBI's May 2026 alert asks victims to keep every receipt and transaction record and to include the transaction ID, wallet address and kiosk location in their report. Those details are what tie a report to a specific wallet and a specific machine.

State law is where real money sometimes comes back. Arizona's Cryptocurrency Kiosk License Fraud Prevention law took effect on September 26, 2025. According to the Arizona Attorney General, it caps daily transactions at $2,000 for new customers and $10,500 for existing ones, requires on-screen warnings and receipts, and requires operators to give full refunds, including fees, to new customers who report fraud within 30 days. Victims report to the Attorney General's office or local police inside that window. By August 2026, the office said it had helped 35 victims recover $171,332. Rules differ by state, and Minnesota went further by banning the machines, so ask your attorney general's office what applies where the transaction happened.

One more warning, because it catches people at their lowest point: recovery scams. Anyone who contacts you promising to get your bitcoin back for an upfront fee is almost certainly running a second scam on you. The FBI counted 10,516 recovery scam complaints in 2025 with $1.4 billion in losses, a total that can include money lost in the original scam, and it flagged fake law firms and people impersonating the FBI's own complaint center. Real agencies do not charge you to investigate.

If You Still Want Bitcoin, You Never Need an ATM

This section is optional. It is for readers who came here because they are curious about Bitcoin and worried it is all a scam. If you just lost money, skip it. Nothing here is a next step after being scammed.

The scam has nothing to do with whether Bitcoin is worth owning. It exploits a payment that cannot be reversed, sent to an address someone else chose. Remove those two things and the danger goes with them. A person who buys bitcoin for themselves never needs a kiosk, never needs to carry cash anywhere and never scans a code a stranger sent.

If you do decide to buy, the safer path is boring on purpose: an app you chose yourself, on your own phone, with a small amount on a regular schedule. Our step-by-step guides to buying bitcoin on Strike and buying bitcoin on Cash App walk through the setup, and the DCA calculator lets you size a weekly amount before you spend a dollar. Untaught never holds, moves or custodies anyone's money. The point is that you stay in control of every step, which is exactly what the scammer's script is built to take away.

And the rule from this article still applies to you forever: if anyone, for any reason, tells you to pay at a Bitcoin ATM, it is a scam.

Frequently Asked Questions

The Bottom Line

Bitcoin ATM scams are not clever technology. They are an old con, fear plus urgency plus secrecy, attached to a new payment that cannot be undone. The machine is legal. The script is the crime. And you do not need to understand Bitcoin, spot a spoofed number or out-argue a professional to beat it. You need one sentence, said to yourself and to the people you love before the phone rings: if anyone tells you to pay at a Bitcoin ATM, it is a scam.

Nobody taught most of us that money can move in ways that cannot be reversed. Now you know, and the most useful thing you can do with this article is send it to one person who answers calls from numbers they do not recognize.