States crack down on bitcoin ATMs as scams surge

The big picture: Cryptocurrency provides criminals with a way to receive money that a third-party can't roll back. Since crypto works like cash, once a person has a digital token in their wallet, it's theirs.

• These kiosks have popped up all over the country. And over the last few years, scammers have increasingly utilized them in all manners of schemes.

Between the lines: While not all crypto scams get paid off via ATMs, they are handy for scammers, with a familiar form factor for victims who have never dealt with a blockchain.

• And for many victims, paying off a scammer might be their first (and only) experience with cryptocurrency.

By the numbers: Fraud losses specifically involving crypto kiosks jumped nearly 10x from 2020 to 2023, the FTC reported last September.

• The FBI reported $247 million in losses tied to the kiosks in 2024, with a 99% increase in complaints from the year before.
• Schemes have particularly impacted older Americans, both the FTC and FBI warn. People 60 and over were more than three times as likely as younger adults to report a loss using a crypto kiosk, per FTC data.

States taking action include Illinois. The state legislature sent a bill to Gov. JB Pritzker in early June, who had called for legislation to address the issue early in the year.

• Among other things, the law would require crypto ATM operators to include details on every receipt — such as the blockchain address where funds are sent — that would help law enforcement with any future fraud investigation.

Other states have taken similar actions. Vermont passed a law in May. One thing it does it put a daily limit on usage for these machines — pulling back the throttle on how much criminals can gouge victims.

• Nebraska stamped a new law in March that establishes a licensing system for crypto ATM operators. Nebraska has been eager to bring crypto business to the state.
• Arizona, which also enacted a bitcoin reserve fund, established a law in May that requires refunds on fraudulently induced transactions.
• An Oklahoma law, which survived a veto by the state's governor, will go into effect on Nov. 1, establishing similar protections.

• The latest: Rhode Island's governor signed one into law Monday. In addition to enacting similar measures as other states, that one requires a warning about the irreversibility of cryptocurrency transactions stated clearly on the kiosk.

Cities have also homed in on the issue too. The City of Spokane, Washington, voted to ban all crypto kiosks on June 16. And they've been a topic in Minnesota cities including St. Paul, Stillwater and Forest Lake.

Zoom out: AARP, which has been urging state legislators to pass these bills, says they have endorsed 12 bills that have passed in different states so far.

Follow the money: Crypto ATMs — which allow crypto holders to convert their digital assets into cash, and vice versa — can be a strong business. Bitcoin Depot, one operator, reported a margin of 20% on $33 million in profits for the first quarter.

What we're watching: Scammers have been using AI to make their tricks more convincing. The most popular strategies security firms are spotting include using AI to clone familiar voices, Ponzi schemes and social engineering (either lucky offers or dire warnings).

• A good rule-of-thumb for scam spotting: it's always a red flag if someone is trying to create a sense of urgency around sending money.

The bottom line: There's a policy trend here, and it's reaching red, blue and purple states.