Elliptic has noted that Crypto ATMs, often called Bitcoin ATMs because of the cryptocurrency’s dominance, provide a straightforward way for people to convert physical cash into digital assets. While these machines serve legitimate customers, they have also become a favored tool for fraudsters. Scams typically reach banks indirectly through everyday account holders who withdraw funds and feed them into a kiosk under false instructions.
In a typical scheme, a criminal contacts the target by phone or email while posing as a government official, bank fraud specialist, utility representative, or even a relative or romantic partner.
Elliptic also explained that the caller creates urgency—claiming unpaid taxes, imminent arrest, or an account emergency—and directs the victim to withdraw cash and insert it into a specific crypto ATM.
QR codes supplied by the scammer route the resulting cryptocurrency straight into wallets under the criminal’s control.
From there, the funds are often split, mixed, or moved across exchanges and blockchains to complicate recovery.
The financial toll is substantial and growing. According to the FBI’s Internet Crime Complaint Center, losses linked to crypto ATM fraud exceeded $388 million in 2025, marking a 58 percent rise from the previous year.
Older adults account for a disproportionate share of the victims. Fraudsters prefer these machines because they convert cash to crypto with minimal friction.
Although US operators are supposed to maintain anti-money-laundering programs under the Bank Secrecy Act, many have failed to register properly or apply basic controls.
Banks are not without defenses.
On the cash side, staff can watch for red flags: customers who rarely withdraw large sums suddenly making repeated or sizeable cashouts; vague or suspicious explanations involving “government agencies,” “fraud teams,” or “crypto machines”; memo fields containing phrases like “IRS fine” or “safe wallet”; and heightened vulnerability among older clients or those previously targeted by scams.
Simple questions—who requested the withdrawal, why, how contact was made, and whether a QR code or specific machine was mentioned—often reveal the scam before the money leaves the branch.
Clear escalation protocols help staff decide when to approve, delay, or refer the transaction.
Once cash becomes cryptocurrency, blockchain analytics closes the visibility gap.
Public ledgers allow institutions to measure a customer’s exposure to known ATM operators, even when funds pass through intermediate wallets.
Some kiosks operate as nested services inside larger exchanges, making attribution more challenging, but high-quality analytics can still surface the underlying operator.
Banks may also encounter ATM operators seeking accounts; on-chain patterns—lack of proper registration, absent customer checks, mismatched cash volumes, or prior regulatory actions—serve as due-diligence warning signs.
Traceability remains possible.
In a December 2025 case, US authorities secured a forfeiture order for more than $200,000 after elderly victims were tricked into depositing cash at crypto ATMs by impostors claiming to be bank fraud teams.
Investigators followed the funds on-chain to an exchange wallet in the Seychelles.
Regulators worldwide have taken notice. Roughly 30 US states have enacted restrictions, with several imposing outright bans.
Proposed federal legislation would mandate registration, transaction limits, identity checks, fraud warnings, and refunds for new customers.
Similar measures appear in the UK, Australia, and Canada, where authorities describe the machines as ready-made collection points for scammers.
Banks can reduce exposure by combining well-trained branch staff and transaction monitoring on the fiat side with blockchain analytics on the crypto side. Elliptic has now concluded that these tools turn an otherwise opaque risk into something measurable and manageable, helping institutions effectievly protect customers and meet rising supervisory expectations.