Physical cryptocurrency ATMs, kiosks installed in convenience stores, gas stations, and strip malls that accept cash and send crypto to a wallet address, have become a common last step in a range of scams that have nothing to do with crypto at the start. A romance scam, a fake tech support call, or a threatening impersonation of a government agency can all end the same way: the victim is told, often while still on the phone with the scammer, to withdraw cash and feed it into a nearby kiosk.
Why this channel is attractive to scammers
A bank wire or cashier's check involves a teller, a hold period, and in many cases a second person who might ask an uncomfortable question. A crypto ATM removes nearly all of that friction. The transaction is typically completed alone, in a few minutes, with the funds converted and sent on-chain before the victim has left the parking lot. Once confirmed, the transfer cannot be reversed by the kiosk operator, the network, or anyone else, which is precisely the property that makes crypto attractive for legitimate use and exploitable for this purpose.
Kiosks also tend to have comparatively high per-transaction and daily limits relative to how quickly cash can be fed in, and many operate with lighter identity verification than a bank, particularly for smaller transaction amounts. A scammer coaching a victim by phone will often specifically instruct them to split a larger sum across multiple visits or multiple machines to stay under thresholds that would otherwise trigger additional verification.
Once cash is fed into a kiosk and the transaction confirms on-chain, there is no reversal path through the machine, the operator, or the network. This is functionally the final, irreversible step of the scam, not an intermediate one.
What a coached victim typically looks like
Kiosk operators and store staff who host these machines are often the last person with a chance to interrupt the transaction before it completes. Certain behaviors recur often enough to be treated as reliable warning signs, particularly in combination.
- The person is on a phone call, sometimes with a wired or bluetooth headset, and appears to be following instructions rather than acting independently.
- They are unfamiliar with basic crypto terminology, asking what a wallet address is or how to scan a QR code, despite conducting a transaction that requires one.
- They describe an urgent reason for the transfer, an unpaid bill, bail, a warrant, a computer virus, or a frozen bank account that only this payment can resolve.
- They are visibly anxious or resistant to answering questions about who they are sending funds to, or give an explanation that does not match how any legitimate service actually operates.
- They are conducting multiple transactions in a short window, or across several nearby machines in the same day.
What victims and bystanders can do
If you are approached by kiosk staff or a bystander while mid-transaction and something they say gives you pause, it is worth stepping outside the call and independently verifying the request through a channel the caller does not control, a phone number you look up yourself, not one they provide. Most reputable kiosk operators have some capacity to flag or hold a transaction if reported quickly enough, though this window is short given how fast a transfer confirms.
If a transfer has already completed, the immediate priority is the same as with any crypto theft: record the transaction ID, the destination wallet address, and the exact kiosk location and time, and report it to both the kiosk operator and law enforcement without delay. That record is also what any later attempt to trace where the funds moved after the kiosk will need to start from, since the kiosk transaction itself is simply the entry point where cash became crypto.