Guide · Last checked 12 October 2026

Bitcoin ATM scams, and the state rules.

The short answer

No real government agency, bank or business will ever tell you to pay at a Bitcoin ATM. If someone on the phone is telling you to take out cash and put it into a crypto kiosk, or hands you a QR code to scan, it is a scam. Hang up. If you have already paid, call the kiosk operator, then report it at ic3.gov.

The FBI’s Internet Crime Complaint Center recorded 13,460 crypto kiosk complaints and about $389 million in losses in 2025, up 58 percent on 2024. States are responding: five have banned kiosks or cash deposits at them in 2026, and at least twelve more have passed laws that cap what a customer can send or require refunds for fraud.

General information, not legal advice. Checked against the primary sources listed at the foot of this page on 12 October 2026. Rules change; confirm against the source before you rely on it.

What is happening

Crypto kiosks turn cash into cryptocurrency and send it to a wallet address. Scammers posing as government agents, bank fraud teams or tech support tell victims to withdraw cash and feed it into a kiosk, often staying on the phone the whole time and giving them a QR code for the address. Once sent, the money is very hard to recover.

  • The FBI’s figures. 13,460 complaints and $389 million in losses in 2025. People over 60 filed 6,188 of those complaints and lost $257.5 million.
  • The FTC’s figures. Reported losses rose nearly tenfold from 2020 to 2023, and in the first half of 2024 people aged 60 and over were more than three times as likely as younger adults to report losing money at a Bitcoin ATM.
  • FinCEN’s notice. In August 2025 FinCEN reminded kiosk operators that they are money services businesses under the Bank Secrecy Act, with registration, reporting and anti-money-laundering duties, and listed the red flags (FIN-2025-NTC1).

Warning signs, for you and your family

  • A government agency or your bank tells you to use a kiosk. The FTC says it will never send consumers to a Bitcoin ATM; the FBI says no legitimate official will call to demand payment by kiosk.
  • You are given a QR code. The FTC: only a scammer will give you a QR code to pay.
  • Someone keeps you on the phone while you withdraw cash or stand at the kiosk.
  • You are told to keep it secret, or to act now, or that a kiosk will “protect” your money.
  • A large, unusual cash withdrawal after an unexpected call or message.
  • The operator calls to warn you. If a kiosk operator says a transaction looks like fraud, stop.

The state rules

Checked against each state’s chaptered law or legislature page on 12 October 2026. “New customer” periods differ by state. Other states have passed or are considering kiosk laws; check your state’s financial regulator.

Bans

  • Indiana. HEA 1116, Public Law 143-2026, signed and in force 9 March 2026: no person may operate a virtual currency kiosk in Indiana.
  • Tennessee. HB 2505, Public Chapter 766, signed 23 April 2026, in force 1 July 2026. Operating a kiosk is a Class A misdemeanor. A court challenge continues.
  • Vermont. H.648, Act 142, signed 16 June 2026, in force 1 July 2026. Registrations ended that day.
  • Minnesota. SF 3868, Laws 2026 chapter 65, signed 5 May 2026. Kiosks banned from 1 August 2026; operators must pay customers out by 31 December 2026.
  • Hawaii. HB 1642, Act 224, signed 9 July 2026. From 1 October 2026 a kiosk may not accept US dollars, by cash or card, for crypto.

Caps, refunds and fee limits

  • California. SB 401 (2023): $1,000 a day per customer; fees capped at the greater of $5 or 15 percent from 1 January 2025; kiosk operators licensed from 1 July 2026.
  • Illinois. SB 2319, Public Act 104-0429, in force 18 August 2025: new customers $2,500, existing $10,500; refunds for new customers’ fraud losses; fees capped at the greater of $5 or 18 percent; live support and blockchain analytics required.
  • Connecticut. Section 36a-613: new customers $2,000 a day, existing $5,000; refunds for new customers; fees capped at 15 percent; a recorded call for new customers over 60.
  • Iowa. SF 449, from 1 July 2025: $1,000 a day, and $10,000 in a new customer’s first 30 days; full refund for fraud reported within 90 days; fees capped at the greater of $5 or 15 percent.
  • Nebraska. LB 609, in force 3 September 2025: new customers $2,000, existing $10,500; refunds for new customers; fees capped at 18 percent. Amended by LB 717 in 2026.
  • Maryland. SB 305, Chapter 117 of 2025, in force 1 July 2025: new customers $2,000, existing $10,500; fees capped at the greater of $5 or 15 percent; registration from 1 January 2026. SB 741 (Chapter 417 of 2026, from 1 October 2026) brings kiosk software operators into registration.
  • Arizona. HB 2387, A.R.S. 6-1236, in force 26 September 2025: new customers $2,000, existing $10,500; refunds for new customers; 24-hour live support and blockchain analytics.
  • Colorado. SB25-079, in force 1 January 2026: new customers $2,000, existing $10,500; refund of a first transaction sent abroad, within 60 days.
  • North Dakota. HB 1447, in force 1 August 2025: $2,000 a day; licensing and blockchain analytics.
  • Rhode Island. Public Laws 2025 chapters 113–114, in force 23 June 2025: new customers $2,000, existing $5,000; refunds for new customers.
  • Alabama. HB 303, Act 2026-369, in force 1 October 2026: new customers $1,000 a day and $10,000 a month, existing $10,500; refunds (in full for new customers, half for existing); two mandatory warnings, ID at every transaction and round-the-clock US live support.
  • Florida. CS/HB 505, chapter 2026-178, in force 1 January 2027: new customers $2,000, existing $10,000; refund of a first transaction; registration with the state regulator.

In Congress, the Crypto ATM Fraud Prevention Act of 2025 (S.710) and the Stop Crypto ATM Scams Act (H.R.9268) have been introduced and referred to committee; neither has been enacted.

For operators: the controls that stop it

FinCEN’s August 2025 notice (FIN-2025-NTC1) lists the red flags it expects kiosk operators and other institutions to watch for; read it in full and write them into your programme. In general terms, the controls are:

  1. Pause before releaseGive larger transactions, and new customers’ transactions, a check before the crypto is sent, and talk to the customer: a scam victim is often being coached on the phone.
  2. Screen the destinationCheck the receiving address against OFAC’s SDN List before release.
  3. Read transactions togetherRead across kiosks and accounts, not one transaction at a time, for the patterns FinCEN describes.
  4. Show the warning at the screenPlainly, before the cash goes in, in the words the state requires.
  5. Keep the recordThe hold, the call, the screen, the decision and who made it, ready for the regulator and for refund claims.

Questions people ask

Are Bitcoin ATM scams common?
Yes. The FBI's Internet Crime Complaint Center recorded 13,460 crypto kiosk complaints and about $389 million in losses in 2025, up 58 percent on 2024, and people over 60 lost $257.5 million of it.
Will the government ever ask me to pay at a Bitcoin ATM?
No. The FTC says it will never send consumers to a Bitcoin ATM, and the FBI says no legitimate law enforcement or government official will call to demand payment through a crypto kiosk.
Which states have banned Bitcoin ATMs?
As of 12 October 2026: Indiana (from 9 March 2026), Tennessee (from 1 July 2026), Vermont (from 1 July 2026) and Minnesota (from 1 August 2026) have banned crypto kiosks, and Hawaii has barred kiosks from accepting US dollars for crypto from 1 October 2026.
Can I get my money back from a Bitcoin ATM scam?
It depends on the state and how quickly you act. Several states, including Illinois, Iowa, Connecticut, Nebraska, Arizona, Rhode Island and Alabama, require operators to refund some fraud losses if reported in time. Contact the kiosk operator at once, then report at ic3.gov.
Do Bitcoin ATM operators have to register with FinCEN?
Yes. FinCEN's notice FIN-2025-NTC1 of 4 August 2025 says crypto kiosk operators are money services businesses under the Bank Secrecy Act, which must register with FinCEN and meet reporting and anti-money-laundering requirements.

Primary sources

General information, not legal advice. BSJ Ventures publishes methods; it never publishes clients, cases or verdicts, and it claims no relationship with any agency or maker named here.

← All guides and checks
For kiosk operators

Run kiosks or crypto payouts? Hold before you release.

For operators only, never for victims. One read of your transactions against the patterns above and the state rules where you operate, with the holds and screens written as rules you own and the record kept. We screen addresses and companies against public lists; we never trace funds to identify a person.

Request an exposure check

A person reads every request and answers within a business day. Pricing is on inquiry.