Bitcoin ATM Scams: Script, Losses and State Kiosk Laws

A bitcoin ATM scam is a fraud in which a stranger, usually posing as a bank, a government agency or a tech-support company, persuades you to withdraw cash and put it into a cryptocurrency kiosk that sends the purchase to a wallet the stranger controls. In 2025 the FBI's Internet Crime Complaint Center (IC3) received 13,460 complaints involving a kiosk, with adjusted losses of $388,981,267, which averages $28,899 per complaint.

That average hides a wide spread, and the IC3 itself warns that some of the money in those complaints moved by other routes. The legal picture is just as uneven. Between March and June of 2026, Indiana's kiosk ban took effect, Wisconsin enacted a $1,000 daily cap, Minnesota's governor signed a ban, and Florida's governor approved a registration and refund law that starts in 2027. California has capped kiosk transactions at $1,000 a day since January 1, 2024. Whether you can ask an operator for money back depends on which of these rules covers the machine you used, how long you had been a customer, and how fast you contacted the right people.

This article separates three kinds of evidence that are often blended: what the FTC counted in its own reports, what the IC3 counted in its complaints, and what the statutes say. Every legal row below was checked on October 23, 2026 against statute or session-law text, or against the state regulator's own summary where the text could not be fetched, and each row says which.

How the script runs, in the agencies' own words

Both agencies describe the same sequence. The FTC's August 2024 data spotlight says many of these scams "start with a call or message about supposed suspicious activity or unauthorized charges on an account." Others begin with a fake security warning on a computer screen that imitates a company such as Microsoft or Apple. From there, the FTC says, "the story quickly escalates": the caller says all the victim's money is at risk, or that the victim's information is tied to money laundering or drug smuggling. A second person, sometimes claiming to be from the "FTC" itself, may join the call to raise the pressure.

The kiosk enters as a solution. Scammers tell victims that putting cash into the machine will protect their money or fix the invented problem, and the FTC reports that they have even called the machines "safety lockers." The victim is sent to a bank to withdraw cash, then to a nearby kiosk, often a specific one, and is texted a QR code. Once the victim scans it, the FTC says, the cash "goes right into the scammer's wallet."

The IC3's May 2026 notice describes the instructions the same way: criminals tell people "how to withdraw cash from their bank, how to locate a kiosk, and how to deposit and send funds using the kiosk." That detail matters for the legal sections that follow. Almost every state rule is aimed at one of those steps: the bank withdrawal, the screen the victim sees at the kiosk, the amount the kiosk will accept, or the receipt printed afterward.

The FTC reported how first contact happened in the first half of 2024. About 47 percent of reports named a phone call, 16 percent an online ad or pop-up and 9 percent an email. Reports that named an ad or pop-up typically described fake computer security alerts, and the FTC notes that those messages included a phone number to call. The shape of the script does not change much: a phone call produces urgency, urgency produces cash, and the kiosk turns the cash into something that cannot be pulled back.

The same IC3 notice lists what bystanders can notice. Its indicators include people making large cash withdrawals for the first time, asking for large bills, holding a QR code they cannot explain, talking on a phone while confused at a bank counter or kiosk, and lingering at a kiosk while someone coaches them. It also gives a rule that cuts through the cover stories: "No legitimate law enforcement or government official will call to demand payment via a cryptocurrency kiosk." For the fuller list of warning signs across all crypto scams, see the crypto scam red flags checklist. The ATM-specific wrinkle is that the victim is usually physically present, on a phone, in a public place, which is why several statutes now put a warning on the kiosk screen itself.

What the FTC counted, and what it did not

The FTC's data spotlight, "Bitcoin ATMs: A payment portal for scammers," is dated August 2024 and uses reports in the Consumer Sentinel Network, the FTC's database of consumer reports. Its numbers are estimates built by searching the narratives of reports that named cryptocurrency as the payment method; the FTC says not all reports name a payment method or give enough detail to tell whether a kiosk was used. The figures below are not IC3 figures and should not be added to them or divided by them.

Three details in the footnotes are easy to miss. First, the FTC points out that kiosks "often handle" cryptocurrencies other than bitcoin, so "bitcoin ATM" understates what the machines do. Second, the spotlight cites research finding that only about 4.8 percent of people who experienced mass-market consumer fraud complained to a Better Business Bureau or a government entity, so the FTC says its counts probably reflect "only a fraction of the actual harm." Third, footnote 12 says scammers appear to steer victims to particular operators, and that many consumers name the operator in their reports. The FTC concludes that "differences in fraud prevention measures taken by various operators likely play a role." That is a reason to be cautious about any single statewide number: a cap or a warning screen only binds the operators that are subject to it, and the FTC's own data suggests criminals pick operators with fewer checks.

The medians are worth setting side by side. A median kiosk loss of $10,000 compares with $5,400 for crypto payments overall and $447 for fraud generally, all in the same six months of FTC reports. On that single basis, the typical reported kiosk loss is about 22 times the typical reported loss across all fraud reports ($10,000 divided by $447 is 22.4). The IC3 figures below use a different basis and cannot be put into that ratio.

The FTC has not, in the pages we could fetch, published a kiosk-specific figure for 2025. A secondary source circulating online attributes a 2025 FTC kiosk total to the agency; we could not confirm it on an FTC page, so it is left out here.

The IC3's 2025 table, recomputed

The IC3 published state-level kiosk data on May 15, 2026 (alert I-051526-PSA) as a supplement to its 2025 annual report. It reports complaints and "adjusted losses" by state. The notice says that more than 13,400 complaints reported kiosk use, with losses over $388 million, a 23 percent increase in complaints and a 58 percent increase in losses from 2024, and that more than half of complaints involved people over 50, whose losses topped $302 million. The attached table is more exact than the headline: 13,460 complaints and $388,981,267 in adjusted losses. It includes rows for territories and a row labelled "Other Country" (225 complaints, $6,268,662), so shares of the grand total below include those rows.

Two caveats from the IC3 apply to every number here. The notice states that IC3 statistics are "an assessment taken at a point in time" and may change with further analysis. It also says a complaint counted here may include other types of transactions, so "overall losses cannot be solely attributed to cryptocurrency kiosks." The columns we added (share and loss per complaint) are our own arithmetic on the IC3 table, not IC3 statistics.

The ten states with the largest adjusted losses account for 56.8 percent of the total ($220,889,710). Texas alone is 14.6 percent. Florida has the most complaints (1,213), but Texas has larger losses on slightly fewer (1,179). The more interesting column is the last one. Among states with at least 100 complaints, Kentucky has the highest loss per complaint ($70,934, from 179 complaints) and Arkansas the lowest ($14,544, from 102). A small number of very large losses can move a state's average, so a mean from 100 to 200 complaints is not a stable ranking. We include it to show that the national $28,899 is an average across very different state profiles, not a typical case. For comparison with the FTC's $10,000 median, remember that a mean and a median are different statistics from different agencies covering different periods; they are not two estimates of one thing.

A reader looking up their own state will find that table in full in the IC3 notice linked under Sources. The point of the extract above is the pattern: the largest dollar totals sit in large states, the per-complaint averages do not follow state size, and none of it shows whether a state's law reduced losses. Most of the rules in the next section took effect in 2025 or 2026, or take effect in 2027, so a table of 2025 complaints describes conditions before or during the early life of those rules. It does not measure them.

State kiosk rules, each checked against the text

The table below covers the eight jurisdictions where we could read statute or session-law text, or a state regulator's own summary, on October 23, 2026. Other states have kiosk laws and several more took effect in 2026; they are left out because we did not verify their text, and a short table with a citation on each row is more useful than a long one with guesses. The last column says what the row rests on.

Daily limits apply per customer. "New customer" and "existing customer" are defined differently in each state, which matters for the refund rules in the following section.

The text-level details change how the numbers should be read.

Arizona's existing-customer limit applies to what an operator's kiosks accept or dispense "for a single person in this state using one or more cryptocurrency kiosks," and the section says a new customer becomes an existing customer ten days after becoming one.

Connecticut's 15 percent is a ceiling on the combined fee and commission, so a $500 purchase can carry at most $75 under it. California's ceiling is the greater of $5 or 15 percent, which is also $75 on $500 and $150 on $1,000; Illinois's, per the IDFPR summary, is the greater of $5 or 18 percent, which is $90 on $500. Those figures are our arithmetic on the stated percentages, not a statement about what any operator charges. Florida's enrolled text and Wisconsin's act contain no fee ceiling that we found, though Florida requires the receipt to state "the total fee charged."

Wisconsin's act carries no effective date of its own in the text we read. The act reproduces s. 991.11, under which an act that does not prescribe a date takes effect the day after publication, which would be April 10, 2026. It also separates the identity rules: the customer-identification section first applies to transactions on the 60th day after the effective date. A Wisconsin kiosk may not be within 5 feet of an ordinary ATM or function as one.

California's cap is the one most often misquoted. Some summaries give a different figure for different years or for new customers only. The DFPI page says: "Effective January 1, 2024, a kiosk operator is prohibited from accepting or dispensing more than $1,000 in a day from or to a customer via a kiosk," and it notes that a Los Angeles Superior Court ruling of August 30, 2024 dismissed a legal challenge to the limit. We rely on that regulator wording, and the page cites Financial Code section 3902.

Two bans, one registration law, and what they replace

Indiana and Minnesota are the two jurisdictions in the table that stopped regulating kiosks and prohibited them. The Indiana Department of Financial Institutions says the bill that became HEA 1116 began as a regulatory scheme under which the department would have licensed kiosks, was amended in the Senate into a ban, and was declared an emergency, so it was "effective upon passage." As a result, the department says, kiosks have been banned in Indiana since March 9, 2026. The sponsor's release adds that violations can be pursued by the attorney general.

Minnesota's route was different and shows how a ban affects customers who already have money in the system. Chapter 65 adds section 53B.751. Starting August 1, 2026, no person may install, operate, maintain or make available a virtual currency kiosk. On or before December 31, 2026, an operator must remove kiosks from any location visible or accessible to the public. An operator that conducts transactions only through kiosks must pay out money or virtual currency held for or owed to customers by that date, in dollars at market value or to a wallet the customer designates, and a wallet payout must go out within 30 days of the customer's request. The same law repeals the earlier kiosk regulations in section 53B.75 on two dates: the disclosure, receipt and transaction-limit subdivisions on August 1, 2026, and the refund subdivision on January 17, 2027.

Florida went the other way, toward registration, and does not take effect until 2027. Its enrolled bill requires a kiosk business to register with the state, sets the two-tier daily limit shown above, and requires the kiosk screen to ask the customer whether they have used another kiosk that day and how much, so the machine can work out the remaining allowance. That question matters: the cap on the screen depends partly on what the customer says about use elsewhere, a point we return to below.

None of this settles whether bans or caps work. The IC3 table cannot tell us, because 2025 predates most of the rules, and the agencies we cited publish no evaluations. What the texts show is a regulatory trend, with some states reducing machines to zero, others lowering how much can move in a day, and others forcing warnings onto the screen.

What the refund provisions require, side by side

"Refund law" is a loose label. The statutes below create a duty on the operator to refund a customer who meets specific conditions. They are not general consumer protections, and each has a gate that many victims will not pass.

Read side by side, the statutes differ in four ways that decide who is covered.

The customer's history. Arizona, Connecticut, Florida and Minnesota tie refunds to the earliest phase of the relationship: under ten days in Arizona, within 72 hours of registering in Connecticut and Minnesota, the first transaction in Florida. Wisconsin attaches no such condition in its text. That is a meaningful difference because of how these scams run. The IC3 describes criminals coaching victims through each step, and the FTC describes an escalating story, but neither source reports how many deposits a typical victim makes or over how many days, so we cannot say how many victims fall inside a new-customer window. What we can say is that a victim whose deposits continue after the window closes may find the later deposits outside the refund language in four of these rules.

What counts as proof. Arizona requires a report from law enforcement or the attorney general that determines fraud, which puts a decision in someone else's hands before the operator's duty is triggered. Florida accepts a police report or a notarized affidavit. Connecticut requires that the customer file a report. Wisconsin's text requires only that the customer contacted the operator and an agency. A statute that conditions a refund on an agency's determination makes the speed of the agency part of the deadline, since Arizona's 30 days also cover getting the operator the report.

Who bears the cost of the clock. Every clock here runs from the transaction (or the last transaction in a window), not from when the victim realizes it was a scam. FTC reporting says the scripts are built to hurry victims, and by the time a victim understands what happened the shorter windows may be spent: 14 days in Minnesota's pre-ban rule, 30 in Arizona, Connecticut and Wisconsin, 60 in Florida. Those are the statutes' numbers, not a prediction about any case.

Fees. Arizona and Wisconsin say the refund includes the fees. The other texts say "full refund" or "full amount," and we read no further definition. We state what the text says and do not infer more.

Arizona's section also contains a sentence that matters for readers who were warned on screen. Subsection I says a victim of fraud "is eligible to receive a refund even if" the operator provided the required disclosures and receipt. The disclosures do not waive the refund right. But the same section requires the second warning to say that "losses due to fraudulent or accidental transactions are not recoverable" and that "transactions in virtual currency are irreversible." Both statements sit in one statute. The refund is a limited claim against the operator, available on narrow conditions, and the on-screen warning remains the general rule.

None of these provisions promises that anyone will receive money. They place a duty on an operator, with conditions, and a customer who misses a condition may have no statutory claim. This site cannot tell any reader whether they qualify; the statutes' own agencies, and the state financial regulator or attorney general named on the kiosk receipt, are the places to ask.

A $10,000 loss under each cap

A daily cap does not cap a loss; it slows how fast a single customer can reach it at one operator. The hypothetical below uses a round $10,000, close to the FTC's first-half-2024 median kiosk loss but not derived from it, and counts the minimum number of days at the stated limit. It assumes one customer, one operator that enforces the limit exactly, and no other source of funds.

Arithmetic: $10,000 divided by $2,000 is 5 days, and divided by $1,000 is 10 days; an existing-customer limit of $10,000 or more clears the amount in one day. Connecticut's $2,000 and $5,000 limits would give 5 days and 2 days on the same pattern, but its new-customer status ends after 72 hours or three transactions, so the two tiers cannot be applied cleanly, and Illinois's new-customer definition was not in the summary we could read.

The table makes two points. In the tiered states the cap rises after seven to ten days, so a scheme that keeps a victim going past that point reaches the higher limit. The flat $1,000 caps in California and Wisconsin stretch the same $10,000 over ten days, which is more days in which a pause is possible. That last point is an inference from the arithmetic, not a finding by any agency. The IC3 tip says as much from the victim's side: if a kiosk operator calls to explain that the transactions look like fraud and advises stopping, "you should stop or cancel the transaction."

Several limits are only as strong as the operator's ability to recognize one person. Arizona ties its limit to a single person across that operator's kiosks. Florida's screen prompt relies partly on the customer's own statement of use at other kiosks. And the FTC's footnote that criminals favor some operators means a cap at one company does not stop the same person from reaching another. Those are built-in limits of per-operator rules. The statutes pair caps with warnings, receipts, live customer support and, in Connecticut, a required phone call to new customers over 60 before their first transaction.

What the receipts and warnings are for

Three of the state texts specify the receipt in detail, and the fields they list are the ones a report needs. Arizona's receipt must show the operator's name and contact information with a phone number for complaints, the state and local agencies that receive fraud complaints, the type, value, date and precise time of the transaction, the transaction hash and each virtual currency address, the sender and recipient names and contact information, the exchange rate, and a statement of the operator's refund policy. Wisconsin lists nearly the same items and requires both a physical and an electronic receipt. Connecticut's list adds the customer's name, a unique identifier and the Department of Banking's phone number. Florida's requires the transaction hash and each wallet used.

The IC3's reporting request for kiosk cases is the same set of details: the transaction ID, the wallet address that received the funds, and the location of the kiosk, plus any information on the subject such as phone numbers, email addresses and domains. The IC3 tells people who send funds through a kiosk to keep every receipt and transaction document. A reader who wants to see what a transaction hash identifies can follow the walkthrough on how to read a blockchain transaction explorer.

The warnings are also drafted from the scam script. Arizona's first warning lists contact that "may appear in many forms": claims of a frozen bank account or fraudulent bank transaction, identity theft or an employment offer in exchange for payment, requests for payment to a government agency or company, virus pop-ups, and communication from someone impersonating a bank representative or law enforcement officer. Florida's screen warning tells a customer directed to the machine by someone claiming to be a government agent, bill collector or law enforcement officer to stop immediately and contact a financial advisor or local law enforcement. Wisconsin's decal must sit within the customer's field of vision at 20-point type or larger and says "IF SOMEONE YOU DON'T KNOW IS ASKING YOU TO SEND VIRTUAL CURRENCY FROM THIS MACHINE, DO NOT PROCEED WITH THE TRANSACTION."

Compare those wordings with what a scammer says in the FTC's account. The legal warnings name the stories (frozen account, hacked computer, government agent) but they appear at a machine, after the victim has already been convinced, often while still on the phone with the scammer. The IC3's list of indicators, by contrast, describes behavior that can be seen at a bank counter or a kiosk rather than any single statement.

Reporting a kiosk loss: the details that are specific to kiosks

The points below cover only what is particular to kiosks, taken from the sources above; the general reporting steps follow at the end of this section.

The IC3 asks for a complaint at ic3.gov in addition to a police report with the local department, and asks for the transaction ID, the receiving wallet address and the kiosk's location. The FTC spotlight directs people to report scams at ReportFraud.ftc.gov. Several statutes also make the state's own agency part of the process: Wisconsin names the Department of Justice and the Department of Financial Institutions, Arizona names the attorney general, Connecticut names the Department of Banking on the receipt, and Florida refers to a law enforcement or government agency. Timing is the one variable the statutes make concrete, since each refund clock described earlier starts at the transaction. Contacting the operator is a separate step from reporting to an agency in all of those rules, and the statutes name both.

Two cautions come from the same material. First, none of the agencies in this article says a report will lead to money coming back, and Arizona's own mandated warning says the opposite as a default. Second, people who have lost money to a kiosk may be contacted by firms offering to get it back; the pattern is described in crypto recovery scams explained, and the FTC and IC3 pages cited here point only to official reporting channels. If the scam began as a long online friendship rather than a phone call, the script in pig butchering scams explained is the closer match, and kiosks are one of the payment routes it uses. The scams and fraud hub groups these pages.

If you or someone you know is partway through the script now, stop sending money, do not follow the caller's instructions about the kiosk, and contact the kiosk operator's number printed on the machine and local police directly. The next page to open is how to report a crypto scam, which covers the evidence list and the agency order in more detail than the kiosk-specific points above.

Frequently Asked Questions

Can you get your money back from a bitcoin ATM scam?

Sometimes an operator is legally required to refund, but only under narrow conditions that differ by state. Arizona, Connecticut, Florida and Wisconsin have statutes that require refunds in specified circumstances, such as a new customer who reports promptly and files a police report. The kiosk warnings themselves state that losses from fraudulent transactions may not be recoverable. No law or agency in this article guarantees that money comes back.

Why do scammers use bitcoin ATMs?

The FTC says the scammer sends the victim a QR code, and once the victim scans it at the machine the cash goes straight into the scammer's wallet. The IC3 adds that criminals coach victims through withdrawing cash, finding a kiosk and sending the funds. Arizona's required warning notes that virtual currency transactions are irreversible.

What is the daily limit at a bitcoin ATM?

It depends on the state and sometimes on how long you have been a customer. California caps kiosk transactions at $1,000 a day. Wisconsin's cap is also $1,000. Arizona allows $2,000 for new customers and $10,500 for existing ones, Connecticut $2,000 and $5,000, and Florida's law from 2027 sets $2,000 and $10,000. States without a statutory cap leave it to the operator.

Are bitcoin ATMs banned anywhere in the US?

Indiana has banned virtual currency kiosks since March 9, 2026, according to its Department of Financial Institutions. Minnesota prohibits installing or operating them from August 1, 2026 and requires removal from public locations by December 31, 2026. We did not verify bans in other states, so the list may be longer than the two we confirmed.

Do FTC and IC3 numbers for bitcoin ATM losses mean the same thing?

No. The FTC counts reports to its Consumer Sentinel Network and estimates kiosk use from the narratives; its latest kiosk-specific figures in this article are for 2023 and the first half of 2024. The IC3 counts complaints to the FBI's center, and its 2025 totals include complaints that may involve non-kiosk transactions. They use different bases, periods and methods, so the numbers should be quoted separately.

Will the kiosk operator contact me if it suspects fraud?

Some do, and the IC3 advises that if an operator calls to say your transactions look like fraud and suggests stopping, you should stop or cancel the transaction. Several states also require live support: Arizona requires 24 hours a day, seven days a week, and Wisconsin requires a toll-free line during all hours a kiosk is operable. Connecticut requires operators to phone new customers over 60 before their first transaction.

How are older adults affected?

The FTC found that people 60 and over were more than three times as likely as younger adults to report a kiosk loss in the first half of 2024, and reported about $46 million of the kiosk losses that period. The IC3 reports that more than half of its 2025 kiosk complaints involved people over 50, with losses over $302 million. The age bands, years and agencies differ, so the two sets of figures are not interchangeable.

Sources

CryptosEyes publishes general educational research, not investment, legal, or tax advice. This article describes statutes and agency data as of the dates stated and does not say whether any person qualifies for a refund or has a legal claim. If you have lost money in a scam, contact the operator's number on the kiosk, your local police, the IC3 and the FTC, and consider speaking with a licensed attorney.