Fearing Scams, States Add Regulations to Crypto ATMs

States are increasingly worried about scams involving cryptocurrency ATMs.

These kiosks are often located in gas stations, grocery stores or convenience stores and allow customers to use cash or a debit card to purchase cryptocurrency and send it to a crypto wallet of their choice. The machines are marketed as a convenient and private way to purchase digital assets, but stories also abound of scammers tricking people, frequently seniors, into using the ATMs to purchase thousands of dollars’ worth of crypto and then send them to the scammers’ wallets in irreversible transactions.

Rhode Island Sen. Victoria Gu, whose cryptocurrency regulation was signed into law in June, says local police have been reporting hefty thefts: “Folks had been losing $15,000 in one day … or someone had lost $40,000 over two days,” she says. And older individuals are especially targeted. “When I visited our local senior center, it seemed like everyone had been targeted with some sort of scam … or knew someone who’d been.”

It’s a big issue for AARP, which says that in 2023, 65 percent of the money lost in crypto kiosk fraud was from victims aged 60 and up. The organization has been advocating for states to add consumer protection regulations. States tend to have fewer fraud protections and regulations on crypto ATMs compared to banks, per AARP.

The issue has crossed partisan lines and won support on both sides of the aisle. This year, laws regulating crypto ATMs passed in Arizona, Arkansas, Colorado, Iowa, Maine, Maryland, Nebraska, North Dakota, Oklahoma and Rhode Island. (Several other states passed regulations in prior years.)

Wisconsin Democrats Rep. Ryan Spaude and Sen. Kelda Roys just this month introduced a bill intended to make it harder for scammers to swindle people — or at least reduce the damage they can wreak. Crypto ATMs have been sprouting up rapidly across the state, rising from a few thousand kiosks a couple years ago to over 30,000 today, Roys says. And there’s currently a “wild west situation,” according to Spaude, with crypto kiosks acting like money transmitters but not regulated like ones.

“There are law enforcement agencies all around the state that have been sounding the alarm on this,” Roys says.

Iowa’s attorney general sued two major crypto ATM companies in February. The AG charged that the companies failed to protect customers from losing over $20 million to scams in fewer than three years, while profiting by taking a 21-23 percent cut in fees.

New Take on Old Scams

One scam involves fraudsters passing themselves off as law enforcement or the IRS and telling victims that they must send money to a particular crypto wallet to avoid legal or financial consequences. In one reported instance, a scammer impersonating tech support convinced a 76-year-old that her identity was stolen and that, to protect her life savings, she should withdraw the money and deposit it at a crypto ATM. Other times, scammers pretend to be a loved one in trouble, or they masquerade as someone romantically interested in the target, all the while persuading them to send more and more money. These aren’t new schemes, but they’re playing out with newer technology, and people may not be aware of the potential for fraud, lawmakers say.

“Anytime there's a novel technology, there's a learning curve as people sort of adjust and realize what the risks are,” Roys says. “And, because [these operators have] been able to operate sort of outside the scope of regulation, that has really meant that they [crypto ATMs] are incredibly useful for criminals and scammers.”

And unlike fraudulent credit card transactions that can be reversed, cryptocurrency transactions are permanent.

Still, some in the ATM industry say concerns are overhyped.

“Despite a lot of the hysteria … there's actually more fraud that happens with credit cards and debit cards,” says David Tente, executive director of USA and the Americas for ATMIA, a global ATM industry trade association. He says only a slim portion of crypto transactions worldwide are fraudulent. “The scams that are out there … have been around for literally decades … they just used different payment methods.”

Crafting Regulations

Spokane, Wash., went as far as to outright ban crypto ATMs due to scam concerns. Vermont’s 2024 law, meanwhile, imposes both new regulations and a one-year moratorium on new crypto ATMs. But many other jurisdictions’ rules avoid bans.

Many state regulations institute per-person daily transaction limits, trying to restrict how much victims can lose in one go when scammers are pressuring them to act fast. (Spaude also hopes this may set off warning bells for victims, seeing that someone on the phone is urging them to complete a transaction larger than the limit allows.) States vary on the details: Wisconsin would set the daily limit at $1,000 per customer, while Oklahoma caps it at $2,000 for new customers only.

Tente says transaction limits needlessly burden legitimate customers, who have to wait a day and come back. But Roys contests this is a well-established idea: Traditional ATMs have transaction limits, too. And serious crypto traders can turn to online platforms if they want to avoid those caps.

Common state regulations — like in Arkansas and Maine — also include requirements that kiosk operators place clear notices on ATMs about scam and fraud risks. States like Nebraska and Oklahoma obligate operators to get licensed by the state as money transmitters. Arizona, Maryland and others require crypto ATMs to provide transaction receipts. Arizona and Illinois (which sent its bill to the governor in late June) specify that receipts should include the crypto wallet address for the transaction recipient. North Dakota and Oklahoma require kiosk operators to have a staffed customer service line available while the kiosk is open. Rhode Island and others require kiosk operators to designate a staff member to be responsible for ensuring the company complies with state regulations.

The recent spate of state regulations frequently include provisions instructing kiosk owners to refund customers for fraudulent transactions, under certain conditions. Some states only require this if the victim is a “new customer,” which in Rhode Island means they made their first crypto ATM transaction at the kiosk within the past 30 days, and in Oklahoma means they did it within the past 72 hours. Wisconsin’s bill, meanwhile, makes no distinction between new and returning customers, which Roys says is important to help victims of romance scams, which aren’t one-off incidents but rather see targets defrauded again and again over months. States vary in whether kiosk operators must refund just the transaction or the fees as well. Tente says that such measures are problematic because they require ATM owner-operators to refund money that went to scammers, not them. Rhode Island’s Sen. Gu, however, says this mirrors how financial institutions refund victims of credit card fraud.

Some lawmakers also take issue with one legitimate part of crypto ATM practices: the fees. Some crypto ATM kiosks charge fees equal to 19 percent or more of the transaction — something Roys and the House sponsor of Oklahoma’s legislation, Republican Rep. Mark Lepak, call “predatory” or close to it. Their measures cap fees, with Oklahoma limiting them to 15 percent and the Wisconsin bill capping it at 3 percent or $5, whichever is larger.

Lepak is particularly worried about fraud victims incurring large fees when scammers are pressuring them into thinking they have no other option but to use the kiosk. His legislation has kiosk operators refund not just the transaction but also the fees.

“If some senior is getting buffaloed by [a scammer] … they're not looking at transaction fees,” Lepak says.

Critics of some of these regulations include Republican Oklahoma Gov. Kevin Stitt, who vetoed his state’s legislation, stating that it added unnecessary levels of regulation and was contrary to a free-market philosophy. The Legislature overrode the veto.

Eyes are also on the federal scene, where Illinois Sen. Richard Durbin filed legislation in February that would pre-empt conflicting state provisions, but permit states to add additional rules. It would require defrauded new customers get refunded their transaction amounts and fees, and defrauded recurrent customers recoup just the fees. Kiosk operators would also need verbal confirmation via a live video or phone call to permit a new customer transaction above $500, among other regulations.