A bitcoin atm scam works because the kiosk does one thing a payment slip never can: it sends your cash, as crypto, to a wallet the caller controls. The caller texts a QR code. You scan it at the machine and feed in the bills. That code is not a receipt, it is the destination. The FTC's September 2024 data spotlight describes this sequence, and notes that scammers have even called the machines "safety lockers."
No bank, agency or utility takes payment at a crypto kiosk, so a demand to scan a QR code there is the scam itself.
- The QR code is the scammer's wallet, so cash fed into the kiosk cannot be recalled.
- A demand bigger than the daily cap needs repeat visits, which exposes the script.
- Refunds in Arizona and North Carolina depend on reporting within 30 days.
- Hang up and call the organisation back on a number you looked up yourself.
Why does a Bitcoin ATM scam end with you scanning a QR code?
The QR code is the scammer's wallet address, not a payment slip: scanning it tells the kiosk where to send the crypto your cash buys, so the money lands with the caller instead of any bank or agency. California's financial regulator says plainly that such transactions cannot be reversed. One parent, commenting on an FTC consumer article in May 2024, wrote that a caller posing as a county sheriff's office demanded bail plus a monitor fee, texted a QR code, and took $800 from a kiosk. The parent's verdict: "We'd been duped."
The opener changes: a fake bank fraud call that shows your real bank's number, or a renewal invoice that lists a phone number. The kiosk step never does, because only that step puts cash beyond recall. We disagree with the common advice to double-check the QR code before scanning. Nobody can verify a wallet address by eye, so a code sent by a caller is never a payment instruction worth following.
Scale first. The FBI's Internet Crime Complaint Center reported on 15 May 2026 more than 13,400 complaints involving crypto kiosks in 2025, with over $388 million lost: up 23% in complaints and 58% in losses on 2024. Its tally includes mixed transaction types, so it is not a pure cash-to-kiosk count. Losses outrunning complaints means each case costs more. The FTC adds the typical size: a median reported loss of $10,000 in the first half of 2024. Four numbers decide whether a demand is plausible, and the grid sets them side by side.
Days To Feed In $10,000
5 days
Derived: five visits, not one
Median Reported Loss
$10,000
Half of reporters lost more
Complaints To The FBI
13,400+
Derived: over 250 a week
Rise In Loss Per Case
+28%
Derived from 2025 FBI growth
The weekly rate matters more than the total. A scam this frequent is a production line with rehearsed answers to every objection, such as "my bank is closed" or "the limit is too low." That is our inference from the volume, not an FBI finding.
A demand that no single visit can cover is a demand built to outlast your doubt. "Come back tomorrow" is the script admitting it.
Is there a daily limit at a Bitcoin ATM?
Where a state sets one, yes, and the three rules compared below differ by roughly a factor of ten, so find your own state's regulator and check the figure before you trust it.
A cap works less as protection than as a lie detector. A caller who needs more than one visit's worth must invent a second act. The compilation below sets three states' own rules side by side, as of November 2026.
| Where you are | Rule and date | What it means for you |
|---|---|---|
| 📊 California | $1,000 a day, per person | A $5,000 demand takes five visits |
| 📊 Arizona | $2,000 new, $10,500 existing, Sep 2025 | Existing wallet: $10,000 fits one visit |
| 📊 North Carolina | $2,000 new, $5,000 existing, Jan 2027 | Fees and spread capped at 12% |
| ⏱ Refund clock | 30 days from the transfer | Arizona needs a police report finding fraud |
Your own sum takes ten seconds: divide the amount you are told to pay by your state's daily cap, and round up. Anything above one means the script has to keep you obedient for days.
Worked example: a caller demands $10,000, the FTC's 2024 median loss, from a new customer in a state with a $2,000 daily cap. Assumptions: one kiosk, fees and spread at 12%, the most North Carolina will allow from 2027. Step one: $10,000 divided by $2,000 is 5, so the transfer takes 5 days. Step two: 12% of $10,000 is $1,200, so crypto worth $8,800 reaches the wallet. By the fifth visit, the first deposit is 4 days into its 30-day refund window.
Who should treat an unexpected cash demand as a scam first? Anyone over 50 with savings, and the relatives who might take that call, because this group carried roughly three-quarters of the losses. Derived from the FBI IC3 announcement of 15 May 2026: over $302 million of over $388 million, about 78%, in a tally that mixes transaction types.
Can you get money back after the kiosk takes it?
Sometimes, and only on a clock: Arizona and, from January 2027, North Carolina refund fraud reported within 30 days, while California's regulator says only that these transactions cannot be reversed.
Arizona refunds new customers in full, fees included, if they report within 30 days with a law-enforcement report finding they were fraudulently induced (Arizona Attorney General). North Carolina's statute refunds a new customer's full deposit but an existing customer's fees only, again inside 30 days, through the state Commissioner (G.S. 53-457). Outside those rules the operator's help is a favour, or rather, we found no duty in the rules compared here, and we did not survey every state.
Keep the receipt. The FBI asks for the transaction ID, the wallet address and the kiosk location, and wants reports filed with local police and at ic3.gov. If the operator itself phones to say your transactions look like fraud, the FBI says to stop or cancel. The same one-way payment pressure drives a fake dealership website that insists on a wire and a task scam that pays a small payout first.
- Count days from each deposit, not from the call: the 30-day clock runs per transaction.
- File locally first, because Arizona wants a police report before it acts.
- Fees ride on top, so the crypto that arrives is always less than the cash you fed in.
Stop and call back if any of these is true for you right now:
- Someone who contacted you first is telling you to withdraw cash.
- You were sent a QR code to scan on a kiosk screen.
- A first kiosk refused or capped the amount, and you were told to find another.
- The caller wants to stay on the line while you stand at the machine.
Tell the over-50s in your family this week: no real organisation takes payment at a crypto kiosk, and the FBI says no legitimate law enforcement or government official will demand it. If anyone who contacted you first asks for cash at one, hang up and call back on a number you looked up yourself.
How we checked this
We read the FBI IC3 announcement of 15 May 2026, the FTC data spotlight of 3 September 2024, North Carolina G.S. 53-457 (effective 1 January 2027) and the Arizona Attorney General's HB2387 notice (effective 26 September 2025), plus California's DFPI guidance, an undated page read on 12 November 2026. The worked example is our own arithmetic: a $10,000 demand, a $2,000 cap and 12% fees. No product was tested hands-on for this article. Last verified: 12 November 2026. Edited by Sheftali, reviewed after publication. Spotted something out of date? Tell us and we will correct it.
No comments
Post a Comment