Bitcoin ATMs: How Crypto Kiosks Work, What They Cost, and the Scam Playbook

You have probably seen one inside a gas station, a corner store, or a strip mall: a glowing kiosk that looks like a bank cash machine and promises to turn your dollars into Bitcoin in about a minute. These machines, usually called Bitcoin ATMs or crypto kiosks, have spread to tens of thousands of locations across the United States. For some people they are a quick way to buy a small amount of crypto with cash. For a growing number of others, especially older adults, they have become the last stop before their savings disappear.

This guide explains what a crypto kiosk really is, how a transaction actually works, what these machines tend to cost, and why regulators keep warning about them. We will keep every claim checkable against a primary consumer source, and we will be honest about what you can and cannot undo once the cash goes in. If you want the bigger picture on fraud, our crypto scam field guide maps the full landscape; this article zooms in on the one tool that has become a scammer favorite.

A crypto ATM is not really an ATM

The name is the first thing to unlearn. A traditional bank ATM is connected to your account. You can pull cash out or put cash in, and the bank keeps a ledger it can correct if something goes wrong. A crypto kiosk does something very different. When you feed in cash, the machine converts it into cryptocurrency and sends that crypto to a wallet address, which is just a long string of letters and numbers that is often shown as a scannable QR code. The Consumer Financial Protection Bureau made this point years ago in a consumer advisory, stressing that Bitcoin "ATMs" are not ATMs at all and warning that they can cost far more to use than a credit card or even plain cash.

That difference matters, but it is easy to overstate. A bank can reverse a fraudulent debit from your account. A confirmed crypto transaction, by contrast, is written to a public network that no one can simply edit, so the coins themselves usually cannot be clawed back once a transfer is final. California's financial regulator, the Department of Financial Protection and Innovation, puts it plainly in its consumer guidance: payments through these kiosks are quick, hard to reverse, and often difficult for consumers to trace. Here is the important nuance that many warnings blur, though: the blockchain being hard to rewrite is not the same thing as having no help available. The operator that runs the machine is a real company, often licensed, that typically offers customer support and, in a growing number of states, carries a legal duty to refund certain defrauded customers. We come back to those rights later. The point here is to keep the technology separate from your options for recourse, because they are not the same thing.

The CFPB advisory also flagged a protection gap that follows from this design. Virtual currencies are not covered by federal deposit or share insurance, so if a company holding your coins fails, the government does not step in to make you whole. And if something goes wrong, the advisory warned, you may not get the kind of help you would expect from a bank, a debit card, or a credit card provider. A kiosk carries those gaps too, with one extra wrinkle, because the transaction happens in public, in cash, and can move quickly once you confirm.

How a crypto kiosk transaction works

Most machines follow a similar script. Understanding each step helps you see exactly where your money goes and why it is often hard to claw back once the process finishes.

A few details are worth spelling out. Because of anti money laundering rules, many operators now ask for a phone number, a scan of a government ID, and sometimes a live photo before the machine will accept a large amount of cash. These checks can feel reassuring, but they do not protect your money the way a bank account does. They mostly help operators meet their own compliance obligations and help investigators later. Some jurisdictions also cap how much a new customer can buy in a day. In California, for example, the Digital Financial Assets Law prohibits kiosk operators from accepting more than 1,000 dollars per person per day. Those limits exist precisely because the machines move money quickly and because a transfer can be hard to reverse once it settles.

It helps to picture the flow in stages rather than as one instant event. First the machine accepts and counts your cash. Then it broadcasts the transfer to the network. Then the network confirms it, which can take minutes or longer depending on the coin and how busy the network is. Operators can, and sometimes do, pause or hold a transfer in between those stages for anti money laundering checks, a fraud review, or technical and network issues, and some deliberately delay transactions for brand new customers. So there is not always a magic undo button, but it is also not accurate to say nothing is ever pending. A transfer can sit in a pending state before it becomes final. The low-friction speed is the selling point, and it is also the risk, which is exactly why acting fast if something feels wrong can matter.

The screen will also quote you a price and a fee before you confirm. This is the moment to slow down, because the number that matters is not just the stated fee. It is how much actual cryptocurrency you receive for your cash after the pricing is applied. Many people never check that, and that is where a lot of the cost hides.

What crypto kiosks actually cost

There are two kinds of cost to watch, but how they are presented varies a lot by operator, and that is where confusion creeps in. The first is a transaction fee, the percentage the machine says it is charging. The second is the exchange rate markup, often called the spread, the gap between the price the kiosk gives you and the real market price of the coin at that moment. Here is the catch that trips up a lot of comparisons: these two are not always separate, additive charges. Some operators do list a percentage fee and then also build a spread into the rate. Others define the fee as the spread itself. CoinFlip, for example, states in its current terms that its transaction fee is the difference between the fiat amount you pay and the market price of the coin, and that this fee is already included in the exchange rate shown on screen. In that model, adding a separate spread on top of the quoted fee would double-count the very same markup. The practical lesson is to ignore the labels and look at one figure: how much actual cryptocurrency you receive for your cash, measured against the live market price.

The CFPB advisory referenced kiosks charging transaction fees as high as 7 percent, and that was years ago. Citing media reports at the time, the same advisory also described exchange rates set around 50 dollars over the rate a buyer could get elsewhere. Those two figures show how both a headline fee and an embedded rate markup can be significant. Whether they truly add together, or whether the quoted fee already captures the markup, depends entirely on how a given operator defines its pricing, which is one more reason to judge by the crypto amount you receive rather than by the words on the screen. More recent news reporting and consumer complaints describe effective costs that run high once everything is accounted for, with some buyers finding they received noticeably less crypto than the cash they inserted would suggest.

To make the markup concrete, here is a simple, clearly hypothetical illustration. Imagine you insert 1,000 dollars in cash and the only variable is the total effective cost, meaning everything the operator charges combined, however it is labeled. The chart below shows how much crypto value you would walk away with at a few different total cost levels. These are made-up percentages for teaching, not a quote from any specific machine, but they show why a kiosk markup can quietly cost you far more than an online exchange would.

The takeaway is not that every kiosk is a ripoff. It is that the convenience of cash in, crypto out can carry a premium that is much larger than what a regulated online exchange charges. If you are buying anything beyond a small, one-time amount, the fee math usually favors funding an account on an exchange and moving the coins to a wallet you control. Our guide on cashing out crypto to your bank walks through the reverse direction and the fees to expect there too.

The gap on one small purchase is modest, but it adds up for anyone who buys regularly or who might otherwise feed a large sum into a machine. If choosing a lower-cost route lets you keep even a little more of your money each month, that is money you can save or put to work elsewhere. The tool below is a neutral, general illustration of how steady contributions can grow over time. It is not tied to any particular machine, coin, or exchange, and it is not a forecast or investment advice. It simply shows the shape of the math, so you can see why avoiding an outsized markup is worth a few minutes of comparison before you confirm.

Why scammers love these machines

Here is where the story turns serious. The same features that make a kiosk convenient, namely speed, cash, and the difficulty of reversing a confirmed transfer, make it close to perfect for fraud. The Federal Trade Commission reported that losses to Bitcoin ATM scams increased nearly tenfold from 2020 to 2023, and topped 65 million dollars in just the first half of 2024. The typical, or median, reported loss in that six-month stretch was about 10,000 dollars. People age 60 and older were more than three times as likely as younger adults to report losing money this way, and they accounted for roughly 71 percent of the reported kiosk losses in that period, around 46 million dollars.

The trend did not stop there. In a 2026 customer advisory, the Commodity Futures Trading Commission cited figures from the FBI's Internet Crime Complaint Center showing that scams involving crypto ATMs resulted in more than 388 million dollars in reported losses in 2025, a 58 percent jump over the prior year. Both agencies stress that these totals almost certainly understate the real harm, because most fraud is never reported.

The 2025 picture sharpens the point. Alongside the 388 million dollar total, the FBI's complaint center logged more than 13,400 reports tied to crypto ATM scams, and the burden again fell on older consumers. People over the age of 50 accounted for more than half of those complaints and reported losses of more than 302 million dollars, while adults 60 and older filed more than 6,000 complaints and reported more than 257 million dollars in losses. One honest caveat belongs here: the FBI's figures are not drawn only from kiosks, so a slice of that total reflects related payment methods rather than machines alone. Even with that caveat, the direction of travel is unmistakable. The through line across every warning is the same: these machines have become a preferred cash-out point for criminals who need to grab money fast and make it hard to trace.

The scam playbook

The lies change, but the structure almost never does. According to the FTC, the bulk of kiosk scam losses trace back to three impersonation styles: a fake government agency, a fake business, and fake tech support. The CFTC advisory adds that scammers often pose as an investment firm or a utility company as well. Whatever the costume, the goal is identical: manufacture an emergency so urgent that you pull cash out of your bank and feed it into a machine before you have time to think or ask anyone for a second opinion.

A typical sequence looks like this. You get an unexpected call, text, email, or computer pop-up. The caller claims your bank account has been hacked, your Social Security number is tied to a crime, there is a warrant out, or a company charged you by mistake and owes you a refund. They tell you the only way to protect or recover your money is to move it right now. They walk you to a nearby kiosk, often staying on the phone the entire time to keep you rattled, and they send you a QR code. You scan it, insert your cash, and the machine routes the crypto toward the scammer's wallet. California's DFPI describes this hand-holding behavior directly, noting that scammers frequently stay on the line and guide the victim step by step through the transaction.

There is a simple reason these scripts work. Each one borrows authority you already respect, a tax agency, your bank, a familiar utility, and pairs it with a deadline. Under time pressure, the part of your brain that would normally pause and verify gets crowded out, and that is exactly the effect the caller wants. The single most effective countermeasure is almost boring: hang up, wait a few minutes, and call the agency or company back using a number you find yourself, not one the caller gave you. Every regulator in this story repeats some version of that advice, because verification through an independent channel breaks the spell the whole scheme depends on.

The QR code is the quiet trick at the center of it all. On a legitimate purchase, the QR code represents your own wallet. In a scam, the code represents the criminal's wallet, so the coins you buy are sent toward them. Because you performed the transaction yourself at a real machine, there is no obviously fake website to spot and no card to charge back.

Red flags that should stop you cold

Regulators have converged on a short list of warning signs. If you notice any of these, treat the request as fraud until proven otherwise.

• Someone you did not contact first tells you to use a crypto ATM. The CFTC states the rule bluntly: no government agency, legitimate financial institution, or reputable company will instruct you to move money using crypto ATMs, gift cards, or couriers.
• They create urgency. Threats of arrest, frozen accounts, or a closing window to claim a refund are designed to stop you from pausing and verifying.
• They tell you to keep it secret. Scammers often warn you not to tell bank tellers, family, or store clerks what the money is for.
• They send you a QR code. A code handed to you by a stranger points to a stranger's wallet.
• They promise to protect your money by moving it. As the DFPI puts it, no legitimate organization will ever ask you to deposit cash into a crypto ATM to resolve an issue or protect your money.

Older adults are targeted so heavily that it is worth having this conversation with parents and grandparents before a scammer does. A simple family rule helps: if anyone ever says the solution to a problem is a Bitcoin machine, gift cards, or a courier picking up cash, the answer is no, and the next call is to a trusted relative, not the person on the phone. Framing it as a shared household policy rather than a lecture tends to land better, because it gives an older relative a ready-made reason to hang up without feeling embarrassed about it.

If you still choose to use a kiosk

Plenty of people use these machines legitimately, usually to buy a modest amount of crypto with cash for privacy or convenience. If that is you, a few habits keep the experience honest and the cost sane.

• Use a wallet you personally control. The receiving address should be one you set up in your own wallet app or hardware device, never a code someone texted or emailed you.
• Read the fee screen before you confirm. Note the amount of crypto quoted, then compare that amount against the live market price on your phone so you can see the true cost, whatever the fee is labeled.
• Start small. Buy a tiny test amount first to confirm the coins land in your wallet before you ever insert a larger sum.
• Keep the receipt. It carries the transaction details you would need if anything goes wrong, and some state refund rules specifically require it.
• For anything but small amounts, prefer a regulated online exchange. The fees are typically far lower, and support is generally easier to reach.

It is also worth knowing that the legal landscape is shifting under these machines. California's 1,000 dollar daily cap is one example, and other states have layered on their own licensing rules, disclosure requirements, fee caps, and in a handful of cases outright bans on kiosks. Several states have also written in refund rights for defrauded customers, which we cover below. Federal financial-crime regulators have likewise pushed banks to watch kiosk activity more closely. For you as a user, the practical upshot is that the rules, the limits, and even the availability of these machines may look different depending on where you stand, so do not assume the machine in front of you behaves the way one did in another state.

Think of a kiosk the way you might think of a currency exchange booth at an airport: fine in a pinch for a small amount, rarely the cheapest option, and never the right place to move your life savings.

What to do if you already sent money

If you realize, during or right after a transaction, that you were deceived, act immediately. Crypto can move quickly, but acting fast still matters for two reasons. First, a transfer is not always final in the first seconds, so an operator may be able to stop one that is still pending or under review. Second, and often more important, several states now give defrauded customers a legal right to a refund, but only if you report within a tight deadline.

This is the part many warnings get wrong. The fact that a confirmed blockchain transfer is hard to reverse does not mean you have no refund rights. States including Arizona and Nebraska have passed laws that require licensed kiosk operators to refund qualifying victims, typically customers who are new to that operator, when they were fraudulently induced into a transaction. Arizona's attorney general reported helping dozens of victims recover full refunds under a 2025 law, and the state's rules require reporting within 30 days of the transaction to qualify. Nebraska enacted a similar law, with its own reporting window and refunds for eligible new customers that can include the fees. The exact rules, deadlines, and definition of who qualifies differ by state and change over time, so do not assume you are out of options. Request a refund from the operator, in writing if you can, and promptly look up your own state's crypto kiosk law or ask your state financial regulator or attorney general's office, because the clock can be short.

Report the fraud to the FTC at ReportFraud.ftc.gov and to the FBI's Internet Crime Complaint Center at ic3.gov, since those are the primary channels regulators point consumers toward, and your report helps build cases even when recovery is not possible. The FBI's Internet Crime Complaint Center advises holding on to specific evidence for your reports and any refund request: the printed receipt or transaction documentation, any transaction ID and the public wallet address where the funds were sent, and the physical location of the kiosk. File a report with local police as well, because some banks, operators, and state refund programs will ask for a report number. Be realistic about outcomes: regulators are candid that kiosk transactions are often hard to reverse and hard to trace, so recovery is far from guaranteed, although state refund laws have genuinely improved the odds for some new customers who report quickly.

Finally, guard against the second wave. After a loss, victims are frequently contacted by someone claiming to be a recovery service, a lawyer, or a government agent who can get the money back for an upfront fee. The CFTC specifically warns that these payment methods are used to set up future scams. A real agency will not charge you a fee to recover funds, and anyone who promises guaranteed recovery for a payment is almost certainly running the follow-on con. If the first loss was painful, this second approach is designed to exploit the hope that you can undo it, so treat any unsolicited recovery offer as part of the same scheme, and pursue refunds only through the operator and your state's official channels.

The bottom line

A crypto kiosk is a machine that converts your cash into cryptocurrency and sends it to a wallet address, quickly and, once a transfer confirms, with no easy undo. It is not a bank ATM, and while a confirmed blockchain transfer is hard to reverse, that does not mean you have no options: operators run support lines, and a growing number of states now require refunds for qualifying fraud victims who report in time. The combined fee and exchange rate pricing can also cost far more than a regulated online exchange, so judge any machine by the crypto you actually receive. Used carefully, for a small purchase, into a wallet you control, it is a legitimate tool. Used the way a scammer wants, as an emergency place to dump cash because a stranger told you to, it is one of the fastest ways to lose money, and getting it back is hard even where state refund laws apply. The single sentence that protects almost everyone is the one the agencies keep repeating: no legitimate agency or company will ever tell you to fix a problem by feeding cash into a Bitcoin machine.