How Crypto ATM Scams & Bitcoin Fraud Create AML Risks for Financial Institutions

A customer takes out $12,000 from her checking account, drives to a gas station kiosk, and scans a QR code sent by a caller via text. Just minutes later, that cash has turned into Bitcoin held in a wallet controlled by the fraudster. This is a crypto ATM scam, and it’s quickly becoming more widespread. In 2025, the Federal Bureau of Investigation’s Internet Crime Complaint Centre (IC3) recorded over 13,400 complaints related to these kiosks, resulting in reported losses reaching $388 million, a staggering 58% increase from 2024.

The scheme combines social engineering tactics with irreversible transactions, prompting customers to lose their savings. Meanwhile, banks, crypto ATM operators, and AML compliance teams are responsible for detection.

What Is a Crypto ATM Scam and How Does It Work?

A crypto ATM is a kiosk that allows customers to exchange cash for digital assets and is commonly found in convenience stores and gas stations. While the terms Bitcoin ATM and crypto ATM are often used interchangeably, many of these machines also let you buy coins like Ether and Tether.

The machine itself isn’t inherently fraudulent. In a typical crypto ATM scam, criminals use a legitimate cash-to-crypto service as a payment channel. The fraudster provides a wallet address or QR code, and the kiosk sends the converted cash directly to that address.

Once recorded on the blockchain, the operator cannot reverse the transaction. Recovering the funds depends on whether you can trace them to an exchange or issuer willing to freeze them.

How Does a Bitcoin ATM Scam Unfold?

In a typical Bitcoin ATM scam, a customer gets a call from a fake federal agent. The caller says that their personal details have been linked to a laundering case and they must move their savings to avoid arrest.

• Social engineering sets the hook. The caller builds fear with threats of arrest, account freezes, or financial loss, and keeps them on the line.
• The cash withdrawal comes next, often with coaching on what to say if bank employees make routine enquiries
• They then make the crypto ATM deposit at a kiosk the caller names, scanning a QR code sent by text and feeding in the notes.
• Fund movement finishes the job. The cryptocurrency lands in the fraudster’s wallet, then moves through other external wallets or cryptocurrency trading services.

The withdrawal is often the bank’s last chance to stop the scam before the customer loses control of the funds.

What Are the Common Forms of Crypto ATM Scams?

Every crypto ATM scam ends at a kiosk, but each pulls a different psychological lever.

Government impersonation scams

Fraudsters pose as police, tax authorities or other agencies and demand payment to avoid arrest. Fear of authority pushes people to comply before checking the claim or verifying it.

Technical support and bank impersonation scams

Fraudsters claim an account, phone, or computer has been accessed by someone else and urge a move into crypto, playing on panic over losing savings. The Financial Crimes Enforcement Network names tech and customer support scams as the most common kiosk typology.

Romance and investment scams

These schemes establish a relationship over weeks through a fake partner or investment service. By the time the victim reaches a kiosk, affection or the promise of returns has replaced suspicion.

Why Does Cryptocurrency ATM Fraud Create AML Risks?

Cryptocurrency ATM fraud spans two systems that rarely share data.

Cash-to-crypto conversion creates monitoring challenges

The bank sees a cash withdrawal, and the kiosk operator sees a deposit and a wallet address. Neither sees the full transaction flow, leaving each control to judge half the transaction.

Potential use of crypto ATMs for money laundering

Weak customer verification, gaps in transaction oversight and poorly controlled kiosks also attract launderers, and FinCEN has linked kiosks to suspected drug proceeds. Still, victim payments and laundering are different stages of financial crime. The deposit is the fraud, while laundering starts when criminals move and disguise the proceeds.

Third-party wallets complicate investigations

Kiosks often ask customers to verify they own the destination wallet. Scammers coach victims to agree, so records name the depositor as owner while the real recipient stays hidden.

Repeated transactions can signify suspicious activity

Deposits split across machines, accounts, or days deserve review when they break from the customer’s financial profile. Scammers often tell victims to stay under limits, which resembles structuring.

What Are the Red Flags of Crypto ATM Fraud?

Banks, kiosk operators and compliance teams can refer to FinCEN guidance and the crypto ATM misuse indicators published by the Australian Transaction Reports and Analysis Centre. These are the most practical crypto ATM fraud warning signs to monitor.

Weigh these indicators together and alongside other customer information because one signal rarely proves a scam. Age alone is never evidence of suspicious activity.

How Banks and Other Financial Institutions Can Spot and Prevent Crypto ATM Fraud?

Strengthen customer due diligence

Verified identity, an accurate profile, and a documented risk assessment give analysts a baseline; without them, a sudden large cash withdrawal looks routine.

Introduce risk-based transaction monitoring

Transaction monitoring rules should flag unusual cash withdrawals, repeated card payments to kiosk operators and behaviour outside the norm. Segment-level thresholds cut the false positives that bury real scam alerts.

Apply enhanced due diligence

In response to higher-risk alerts, the Enhanced Due Diligence process incorporates source-of-funds inquiries and additional verification steps. By calmly asking the customer about their need for cash, you can uncover if a third party is providing instructions.

Improve suspicious activity investigation

Alert prioritisation pushes likely scam cases up the queue. Clear records with prompt referral to the relevant team help the Money Laundering Reporting Officer decide whether to file a Suspicious Activity Report.

Coordinate intervention across teams

Branch staff often recognise anxious customers quickly and need a direct connection to the fraud and AML teams. Kiosk providers also play an important role by sharing wallet information with banks and law enforcement.

Preventing crypto ATM fraud depends on teams working together from onboarding through ongoing customer reviews, rather than relying on a single alert.

What Do Recent Regulations Say About Cryptocurrency ATM Fraud?

Regulators increasingly acknowledge the growing use of digital assets in ATM fraud, but the measures they have adopted and their requirements vary.

In 2026, regulatory action gathered momentum as states like Indiana, Tennessee, and Minnesota implemented statewide kiosk bans. Additionally, in August, AUSTRAC suspended the registration of operator Cryptolink, which led to the removal of 96 machines from operation.

How AML Watcher Supports Stronger AML Risk Management

AML Watcher is a compliance technology provider that helps financial institutions strengthen Anti-Money Laundering (AML) compliance through effective risk assessment, monitoring, and investigation. Its transaction monitoring system lets teams configure monitoring scenarios without needing technical development skills to spot activity that falls outside normal behaviour, withdrawal and payment patterns. With configurable risk scoring, customer assessments stay focused on risk, while alert checklists and case handling features support analysts in prioritising and keeping investigation records organised. Continuous monitoring and screening ensure each customer’s risk profile stays up to date.

A recent crypto ATM scam highlights how familiar fraud tactics can exploit digital asset payment channels. Detecting unusual customer behaviour across cash, card, and transfer activities can be quite challenging. AML Watcher helps teams strengthen risk assessments and better oversee customer transactions, helping them limit financial damage before it happens.