Bitcoin ATM Scams — $388M, Median Age 71 (2026)

The short answer

Bitcoin ATMs are legal — but in 2025 the FBI's IC3 logged 13,400+ complaints and $388 million in reported losses tied to them, up 58% on 2024. Over half the victims were aged 50+; people aged 60+ alone lost $257.4 million across 6,188 complaints. The DC Attorney General sued one major operator, Athena Bitcoin, in September 2025 alleging 93% of its DC kiosk deposits were scam-related. The median victim is 71 years old. The median loss per transaction is $8,000. Once the cash goes into the kiosk and converts to cryptocurrency, federal banking protections do not apply and the money is, in nearly every case, gone.

"Athena's bitcoin machines have become a tool for criminals intent on exploiting elderly and vulnerable District residents."
— Brian L. Schwalb, Attorney General of Washington, DC, September 8, 2025, on filing suit against Athena Bitcoin, Inc. in DC Superior Court. The complaint alleged 93% of deposits to Athena's DC kiosks during the company's first five months of operation were scam-related, that nearly half of all deposits were flagged as fraudulent, and that Athena charged hidden fees of up to 26% per transaction — compared to 0.24-3% on legitimate exchanges. The median victim age was 71. One victim lost $98,000 across nineteen transactions.

I think the Bitcoin ATM is the cleanest example in the United States of an entire payment rail that exists primarily because it is unregulated. The operators will tell you the machines are for retail crypto purchase by ordinary investors; the data — including the operator's own data, exposed in the DC AG's lawsuit — says otherwise. When 93% of one operator's deposits at one location flag as scam-related during the first five months of operation, the machine is not an investment kiosk that scammers occasionally exploit. The machine is a scam-cash-out kiosk that occasionally processes an investment.

I am writing this piece in first person because the institutional accountability question matters and I want my name on the answer. The companies running these machines know what their numbers look like. The states that have not yet passed kiosk-fraud laws know what the FBI's numbers look like. The FBI knows that Operation Level Up has had to recover money these machines should never have processed in the first place. The path forward — federal regulation, mandatory refunds, state license requirements, kiosk-level fraud warnings, daily transaction caps — exists. It is being implemented in pieces. It is being implemented slowly. And meanwhile, the median victim is seventy-one years old, the median transaction is eight thousand dollars, and the machines are still on the corner.

What a Bitcoin ATM actually does

The terminology is misleading. The machine looks like an ATM. It is operated like an ATM. It is not connected to your bank account, your bank's regulatory framework, or anybody's deposit insurance. Here is the real picture:

—You insert cash, the machine sends cryptocurrency. You scan a wallet address (your own or someone else's) into the kiosk. You insert physical cash. The kiosk's operator, behind the scenes, uses that cash to fund the purchase of an equivalent amount of cryptocurrency (usually Bitcoin), which is sent to the wallet address you scanned. The wallet address can be any address — your own crypto wallet, an exchange account, or a scammer's address. The kiosk does not verify whose wallet you are sending to, and indeed cannot.

—The transaction is irreversible by design. Once the cryptocurrency leaves the operator's wallet and arrives at the destination address, it is on-chain. Reversing it requires either a chain reorganisation (impossible at any meaningful scale) or the destination wallet holder voluntarily returning the funds (the scammer will not). This is structurally different from every other payment method in this site — credit card chargebacks under the Fair Credit Billing Act, debit card protections under Regulation E, Zelle's nascent reimbursement framework, even Cash App's CFPB-mandated dispute process — all of which have at least some recovery pathway.

—The operator's fees are very high. Industry-standard exchange fees for buying Bitcoin online are between 0.24% and 3% of the transaction. Bitcoin ATM operators routinely charge between 10% and 26% per transaction (the DC AG alleges Athena charged up to 26%). These fees are often disclosed only on a small screen during the transaction, well after the victim has been verbally walked through the deposit by the scammer on the phone.

—Roughly 80% of the world's Bitcoin ATMs are in the United States. The US has by far the most permissive regulatory environment for crypto kiosks. As of 2026 there are roughly 30,000 machines in the US, operated by a handful of large companies including Bitcoin Depot, Athena Bitcoin, CoinFlip, Coinhub, and RockItCoin. The UK has effectively banned consumer-facing Bitcoin ATMs. The geography of the harm follows the geography of the regulation.

The standard scam script

Every Bitcoin ATM scam follows the same arc. The variations are in the cover story — what the scammer claims to be — but the call structure is invariant.

—The unsolicited contact. A phone call, text, or pop-up that the victim did not initiate. The caller claims to be from a high-authority institution — Microsoft, Apple, the FBI, the IRS, the Social Security Administration, the victim's bank, a hospital with news about a family member. The opening line is always urgency: your account has been hacked, there is a warrant for your arrest, your grandchild is in custody, your computer is infected and 'streaming your bank credentials right now.'

—The trust transfer. The first scammer often passes the victim to a 'specialist' — a fake bank fraud officer, a fake federal agent — to build credibility. The script borrows from real institutions' protocols (case numbers, badge numbers, transfer protocols) carefully enough that older victims, who grew up with phone-based banking, find them plausible. The digital arrest scam playbook is closely related — same trust-transfer structure, often the same scripts.

—The 'safe' instruction. The fake authority figure explains that the victim's bank account is at imminent risk and must be 'moved to safety.' The 'safe' destination is, naturally, a Bitcoin wallet — described as a 'federal lockbox,' a 'Treasury holding account,' or 'a verified digital safe under your name.' The Bitcoin terminology is deliberately obscured because the goal is to ensure the victim does not say the words 'Bitcoin' or 'crypto' to anyone they might trust.

—The chaperoned journey. The scammer stays on the phone with the victim. The victim is walked to their bank, told to withdraw cash (often a multi-thousand-dollar amount), told what to say to the teller if questioned ('I'm helping my granddaughter buy a car'), then walked to the nearest Bitcoin ATM via Google Maps. The scammer dictates each step of the deposit — scanning the QR code (the scammer's wallet address), feeding bills into the machine one at a time, confirming the transaction on the touch screen. The whole process takes 60-90 minutes, during which the victim is on a phone call that does not end.

—The escalation. After the first successful deposit, the script escalates. The 'specialist' explains that the fraud is larger than initially feared and additional transfers are required to 'complete the secure migration.' Multiple deposits across multiple kiosks, sometimes across multiple days, are common. The DC AG's complaint cites one victim who lost $98,000 across nineteen separate transactions over several days. The single largest losses I see in the inbox are produced by this stage of the script.

The phone call that does not end is the single highest-confidence Bitcoin ATM scam signal that exists in 2026. No legitimate institution — no bank, no police force, no government agency, no court — will keep you on the phone for ninety minutes while you withdraw cash and deposit it into a Bitcoin ATM. The duration of the call is itself the scam.

What the DC Attorney General alleged about Athena Bitcoin

The Schwalb lawsuit, filed September 8, 2025 in DC Superior Court, is the single most detailed public account of how a major Bitcoin ATM operator's books actually look. The numbers in the complaint are not estimates — they are alleged based on Athena's own data, obtained through the DC AG's investigative authority.

—93% of Athena's DC deposits during the first five months were scam-related. Not 'a meaningful share.' Not 'some.' Nine in ten. This figure is for the first five months of Athena's operation in DC — the period during which the company would presumably most want to demonstrate legitimate retail use to justify a regulatory presence.

—Nearly half of all deposits were flagged as fraudulent within Athena's own systems. This is the part of the complaint I find hardest to ignore: Athena's own internal fraud-detection systems flagged roughly half of the deposits, and the company processed them anyway. The complaint alleges this is not a passive operator that failed to spot the scam pattern; it is an operator that built a fraud-detection system, watched it flag half of all transactions, and continued to take fees from those transactions.

—Hidden fees of up to 26% per transaction. Industry-standard online exchange fees are 0.24% to 3%. The DC AG alleges Athena charged up to 26% — a fee delta of roughly 10x to 100x — without clearly disclosing the fees to victims. When victims sought refunds after realising they had been scammed, Athena's policy was 'no refunds,' including failing to refund the fees themselves on transactions Athena had already internally flagged as fraudulent.

—Median victim age: 71. Median transaction loss: $8,000. One victim lost $98,000. The demographic concentration is the part the FBI's national numbers also bear out — 6,188 of the 13,400 IC3 complaints in 2025 were from victims aged 60 and older, accounting for $257.4 million of the $388 million in total losses. Bitcoin ATM scams are, in the aggregate, a financial-exploitation-of-the-elderly story being staged in convenience stores.

The DC AG's complaint cites the Consumer Protection Procedures Act and the Abuse, Neglect, and Financial Exploitation of Vulnerable Adults and the Elderly Act. The relief sought includes compelling Athena to comply with District law, restitution for the victims, and civil penalties. As of mid-2026 the case remains active.

One lawsuit against one operator does not solve the industry pattern. What it does demonstrate is that the operator's own internal data — the data that I, sitting outside the industry, can only guess at — confirms the public narrative. The scam volume on these machines is not a small problem hiding in a large legitimate business. It is the business.

What states have already done — and what's still federal

The state-level response has been faster than the federal one, partly because the harm is local and visible (an elderly resident, a kiosk, a 60-Minutes-ready storyline) and partly because state AARP chapters have made it their top fraud priority since 2024. As of mid-2026:

—Vermont — $1,000 daily limit + 90-day refund for first-time fraud victims. Vermont requires kiosk operators to register with the state, caps daily transactions at $1,000 for new users, and obligates operators to refund first-time victims who report fraud within 90 days. This is the closest the US has come to the structural consumer protection that exists by default for bank ATMs.

—Maine — parallel 90-day refund framework. Maine has adopted similar refund-window legislation. Between Vermont and Maine, the model has emerged that AARP advocates have been pushing in other states. The political pattern is bipartisan — both blue and red state legislatures have passed similar laws in 2024-2025.

—Massachusetts, Connecticut, Rhode Island, Tennessee, Florida — pending or partial legislation. These states have draft bills or pending regulations adopting AARP's recommended package: daily transaction caps, mandatory scam warnings on the kiosks, operator state-license requirements, and refund options for fraud losses. AARP's government affairs director Françoise Cleveland said in early 2025: 'What we're trying to do is put some commonsense safeguards at the kiosks.'

—Twenty-four states have crypto-ATM laws of some kind by 2026. The number is moving. The patchwork is uneven — a kiosk in Vermont has guardrails the same kiosk model has none of in, say, Texas — but the direction of travel is uniform.

—Federal: Crypto ATM Fraud Prevention Act of 2025 (S.710). Senator Jack Reed (D-RI) introduced S.710 on February 26, 2025, with bipartisan co-sponsorship. The bill would create federal kiosk-licensing requirements, mandatory scam warnings, transaction caps for new users, and a mandatory refund framework for fraud victims. The bill remains in committee as of mid-2026. The federal pace is slower than the state pace, and predictably so.

The international comparison: UK, Australia, Canada

The geography of the harm follows the geography of the regulation, and the international contrast is the cleanest way to see this. Per the UK scam-reporting guide and the Australia guide, the regulatory frameworks in the major comparison countries are notably tighter:

—United Kingdom — effective ban. The Financial Conduct Authority (FCA) requires all UK crypto businesses to register and comply with money-laundering regulations. No retail Bitcoin ATM operator has successfully met those requirements. As of 2026, operating a consumer-facing crypto ATM in the UK is treated as unregistered cryptoasset activity, a criminal offence. The UK has effectively achieved a national ban without ever passing a 'ban' bill — the existing AML rules were sufficient when enforced.

—Australia — AUSTRAC compliance. The Australian Transaction Reports and Analysis Centre tightened crypto-ATM compliance through 2024 and 2025. Operators must register, report large transactions, and conduct customer due diligence. AUSTRAC has taken enforcement action against non-compliant operators including limits on machine deployment in high-risk areas. The Australian framework permits kiosks but with material guardrails the US framework currently lacks.

—Canada — FINTRAC reporting. FINTRAC (Canada's financial intelligence unit) requires crypto-ATM operators to register as money services businesses (MSBs) and to file Large Cash Transaction Reports for any transaction over CAD 10,000. The Canadian framework is closest to the US in posture but with materially better reporting infrastructure.

The 8-step playbook: what to do

This is the sequence I would follow if I were the person being walked to the kiosk right now — or if a parent or grandparent of mine had just been. None of this is exotic. All of it is what the regulatory void has externalised onto you because the operators are not stopping it themselves.

1Recognize the panic-call pattern before you leave the house. Every Bitcoin ATM scam starts with a phone call you did not initiate. The caller invents an urgent reason — hacked account, IRS warrant, grandchild in custody, infected computer — and the only acceptable payment is crypto via a kiosk. No legitimate institution will ever ask this of you. Ever.

2Hang up. Verify independently. Disconnect the call. Then phone the institution back using a number from the back of your bank card or from a website you type in directly. Do not trust any number the caller provided. The whole script depends on keeping you on the phone.

3If you are still uncertain — do NOT visit a kiosk. There is no urgent legitimate Bitcoin ATM transaction. The urgency is the scam. Stop, call a family member, take five minutes. Five minutes ends every scam and affects no real situation.

4If you have withdrawn cash but not yet deposited — call your bank's fraud line immediately. Cash not yet deposited is still recoverable. Bank fraud teams are trained on this exact scenario and can alert local law enforcement to the kiosk location.

5If money has already moved — file with FBI IC3 at ic3.gov immediately. Include the wallet address from the kiosk receipt, the amount, the kiosk operator and location, the calling phone number, and the timeline. The FBI's Operation Level Up has occasionally recovered crypto when reports arrive in hours.

6If you are in Vermont, Maine, or another protected state — invoke the 90-day refund law via your state Attorney General's office. As of 2026, more than 24 states have crypto-ATM laws of some kind. The state route is your only direct claim against the operator.

7File complaints with the FTC at reportfraud.ftc.gov and with your state Attorney General's consumer protection unit. The complaint volume is what drives legislation. See the full US scam-reporting directory for state-by-state contacts.

8Lock down — and watch for recovery scams. The scammer now knows you paid via Bitcoin ATM. Within days, recovery scammers will call offering to retrieve your money for an upfront fee. They will sound credible because they have your details. Real recovery channels — your bank, IC3, FTC, state AG — are all free. See the recovery scams piece for the full pattern, and the 72-hour recovery playbook for the by-payment-method odds.

If you have posted publicly that you lost money to a Bitcoin ATM, recovery scammers will find you within hours. They will know your name, your loss amount, and your scam type — because this information has been sold on the same scammer infrastructure that runs the toll-smishing and family-impersonation operations. Their offer is identical to the original scam: an authority figure, a wallet you must fund, a promise of recovery that never materialises. Real recovery channels are always free.

From the field. The hardest cases in the inbox are not the people who recognised the scam mid-call and pulled back. They are the people who completed two or three deposits before something — a teller asking the right question, a stranger in the convenience store noticing the panic, a returned call from a family member — broke the script. By the time they understand what has happened, the first $24,000 is gone, the wallet address on the receipt is meaningless to anyone they can call, and the kiosk in the gas station does not have a phone number. The grief is shaped like the grief after a sudden theft from a relative — because that is what it is. The institutional response should be shaped accordingly. It is not.

So — what should you actually believe about Bitcoin ATMs?

Believe the numbers. Bitcoin ATMs in the United States in 2025 transferred at least $388 million in documented victim losses, and that is just the share that made it into FBI complaints. The real loss is higher because shame keeps elderly victims from reporting. The median victim is seventy-one years old. The median transaction is $8,000. The infrastructure that produces these losses is not hidden — it is in your neighbourhood gas station, with a sign on the front, regulated by no federal agency, refunded by no operator policy, and disclosed by no fee schedule a victim ever has time to read.

Believe what the DC Attorney General has put on the public record. When 93% of one operator's deposits at one location flag as scam-related and the operator's own internal systems flag nearly half — and the operator keeps processing — that is a business model, not an operational shortfall.

Believe that the regulatory response is coming, slowly, in pieces. Vermont and Maine have working refund laws. Twenty-four states have passed some version of consumer protection. The federal bill exists. The UK already has, effectively, a ban. None of this protects the next seventy-one-year-old who answers the phone tomorrow, but it is the direction of travel, and continuing to file complaints is the lever.

If you take one rule from this whole piece, take this: no legitimate institution — not a bank, not the FBI, not the IRS, not the Social Security Administration, not a hospital, not your grandchild — will ever ask you to deposit cash into a Bitcoin ATM. If anyone on a phone call instructs you to visit a crypto kiosk, the call is the scam. Hang up. Call back on a number you find yourself. Take five minutes. Five minutes ends every Bitcoin ATM scam ever attempted.

Already deposited at a Bitcoin ATM after a phone call? Let's look at what's still recoverable.

Tell us the kiosk operator, the date, the wallet address from the receipt, and what state you are in. A real expert reviews every case and replies within 24 hours. Free, confidential, no pressure.

Submit a free case review →Try the Scam Checker

Common questions about Bitcoin ATM scams

Is a Bitcoin ATM the same as a regular ATM?

No. A regular bank ATM dispenses cash from your existing bank account, controlled by a federally insured bank, and is backed by Regulation E protections for unauthorized transactions. A Bitcoin ATM (also called a crypto kiosk or BTM) takes cash from you and converts it to cryptocurrency that is sent to a wallet address you scan into the machine. The operator is a private company, the transaction is irreversible by design, and once you deposit cash, federal banking protections do not apply because no bank was involved. As of 2026, there are roughly 30,000 Bitcoin ATMs in the United States, operated by companies including Bitcoin Depot, Athena Bitcoin, CoinFlip, Coinhub, and RockItCoin.

Why are scammers obsessed with Bitcoin ATMs?

Three reasons: speed, irreversibility, and anonymity. A Bitcoin ATM transaction settles to the scammer's wallet within minutes. Once the cryptocurrency leaves the machine, no bank, regulator, or operator can claw it back. The wallet address the victim scanned is not tied to a verified identity in the way a Zelle username or Venmo @handle is. AARP's director of fraud victim support, Amy Nofziger, told ABC News in October 2025 that 'requesting crypto is now the No. 1 preferred method of criminals.' Every other payment rail — credit card chargebacks, debit card Regulation E protections, Zelle's nascent reimbursement framework, Cash App's CFPB-mandated dispute process — has at least some recovery pathway. The Bitcoin ATM has none.

What scam scripts lead victims to a Bitcoin ATM?

Five dominant patterns in 2025-2026. (1) Tech support scam — a fake Microsoft or Apple popup or call convinces the victim their bank account is compromised; the scammer 'helps them move money to safety' via a Bitcoin ATM. (2) Government imposter — a fake FBI, IRS, Social Security, or police officer says there is a warrant or unpaid tax and the only acceptable payment is crypto. (3) Romance / pig butchering — months of relationship lead to an investment 'opportunity' that requires the victim to fund their wallet via a Bitcoin ATM. (4) The 'your loved one is in trouble' grandparent scam. (5) Job scams and inheritance / lottery scams. The unifying feature is a phone call that does not end — the scammer stays on the line, walks the victim to the bank to withdraw cash, then to the nearest Bitcoin ATM, and dictates each step of the deposit.

Can I get my money back after a Bitcoin ATM scam?

Honestly, usually no. The cash deposit becomes cryptocurrency in the scammer's wallet within minutes, and once it has moved on-chain there is no operator or regulator with the authority and the technology to reverse it. The exceptions are narrow and worth knowing. Vermont and Maine require kiosk operators to refund first-time fraud victims who report within 90 days. Several other states are passing similar laws as of 2026. The DC Attorney General's September 2025 lawsuit against Athena Bitcoin specifically seeks restitution for victims under DC consumer protection law. If you reported quickly and the operator has not yet 'swept' the funds out of their hot wallet, occasionally the FBI's Operation Level Up has been able to recover crypto before it is laundered. Plan as if the money is gone; treat any recovery as a surprise.

Which Bitcoin ATM operators have been sued by state attorneys general?

Athena Bitcoin, Inc. is the highest-profile case as of 2026 — Washington DC Attorney General Brian L. Schwalb filed suit on September 8, 2025, alleging that 93% of deposits to Athena's DC kiosks during the company's first five months of operation were scam-related, that nearly half of all deposits were flagged as fraudulent, and that Athena charged hidden fees of up to 26% per transaction compared to the industry-standard 0.24% to 3%. The complaint cites violations of DC's Consumer Protection Procedures Act and the Abuse, Neglect, and Financial Exploitation of Vulnerable Adults and the Elderly Act. Other major operators — Bitcoin Depot, CoinFlip, Coinhub, RockItCoin — face active state-level scrutiny and civil suits in several states; the regulatory pressure across the industry is real and growing.

Are Bitcoin ATMs legal in the UK, Australia, and Canada?

Each country has taken a notably different stance. The UK's Financial Conduct Authority (FCA) has effectively banned consumer-facing Bitcoin ATMs by enforcing money-laundering regulations no operator has been able to meet — as of 2026, operating a crypto ATM for retail customers in the UK is treated as unregistered cryptoasset activity, a criminal offence. Australia's AUSTRAC tightened compliance requirements in 2024-2025 and continues to permit operation under a registered framework, with notable enforcement actions against non-compliant operators. Canada's FINTRAC requires crypto-ATM operators to register as money services businesses and to file reports on transactions over $10,000 CAD. The US remains by far the most permissive jurisdiction — roughly 80% of the world's Bitcoin ATMs are located in the US, which is also why nearly all of the documented victim losses are reported here.

Sources & further reading

Every figure in this piece is drawn from these authorities. Click any of them to verify.

Bitcoin ATM scams: $388 million gone in 2025, the median victim is 71, and the machines are still on the corner.