Fraud involving cryptocurrency ATMs is becoming a problem for banks in the same way as most other cryptocurrency-related risks — through ordinary customers. A person withdraws cash, deposits it into a cryptocurrency ATM at the instruction of a stranger, and the funds disappear before bank employees even have time to suspect something is wrong.
Although crypto ATMs are in themselves a legal service, they are increasingly used by fraudsters, and the greatest harm from such schemes is suffered by elderly people.
For a bank, such fraud remains almost entirely "invisible." At first the money exists as cash, and once it has been dispensed the bank can no longer track the further movement of the funds. Then it is turned into cryptocurrency through a device that the bank neither owns nor controls. As a result, a gap arises between these two stages that cannot be closed by any single universal control mechanism.
They have two main tools at their disposal:
- 1. The first is prevention at the stage of dealing with traditional money.Trained branch employees and transaction-monitoring systems are able to detect a suspicious cash withdrawal before the customer even leaves the bank.
- 2. The second is blockchain data analysis. It makes it possible to detect operations connected to cryptocurrency ATMs.If the bank has the address of a customer's crypto wallet or information about a transaction on the blockchain, specialists can determine whether the funds are connected to a specific crypto ATM. What used to remain a "blind spot" becomes a measurable risk factor.
How crypto ATM fraud schemes work
In such a scheme, the attackers convince the victim to withdraw cash and deposit it through a cryptocurrency ATM. Once deposited, the cash is automatically converted into cryptocurrency and sent to a wallet fully controlled by the fraudsters. Almost all such crimes unfold according to the same scenario.
As a rule, the fraudster poses as someone the victim is inclined to trust. This may be an employee of a government agency, the police, a bank's security service, a utility company, an acquaintance, or even a romantic partner.
Contact is established by phone or email. The attacker comes up with a convincing pretext for the conversation and almost always creates a sense of urgency. For example, they report supposedly unpaid taxes, threaten criminal prosecution, or demand that certain actions be taken immediately.
After this, the person is convinced to withdraw cash and is directed to a specific cryptocurrency ATM. There the victim scans a QR code prepared in advance by the fraudster and transfers the funds directly to the crypto wallet belonging to them.
The cryptocurrency thus obtained is then distributed among many different wallets, passed through cryptocurrency mixers, exchanges, and sometimes transferred into other blockchain networks in order to make tracing the money flows as difficult as possible.
Fraudsters prefer to use crypto ATMs precisely because they make it possible to avoid many of the restrictions and checks typical of other ways of transferring money. In the US, operators of such devices are required to comply with anti-money-laundering legislation, yet the US agency FinCEN has repeatedly noted that many companies either fail to register as money transmitters at all, or do not meet the transaction-control requirements provided for by law.
How to recognize a crypto ATM scheme at the cash-withdrawal stage
For a bank, the main signal becomes the very fact of a cash withdrawal. An unusual cash-withdrawal transaction often turns out to be the first sign that a customer is being drawn into a fraudulent scheme involving a cryptocurrency ATM. Most often, such situations develop according to a characteristic scenario.
Bank branch employees are in the best position to notice such signals in time, if they know what questions to ask. This is especially true for elderly customers, who far more often receive service directly through the teller.
The answers to these questions often make it possible to understand almost immediately whether a fraudulent scheme is taking place. For such situations, a bank should have clear internal rules defining when an employee may approve a cash withdrawal right away, when it is necessary to temporarily suspend the operation, and when the information should be passed to the anti-fraud unit. Every decision made must be documented.
All the measures listed above relate to dealing with traditional money. However, there is also a second side to the problem — the movement of funds already within the blockchain.
How crypto ATM risk is visible on the blockchain
In addition, in the US such data helps banks cooperate with law enforcement authorities. If FinCEN requests information under Section 314(a) of the PATRIOT Act, or if banks voluntarily share information among themselves under Section 314(b), blockchain analysis makes it possible to provide a significantly more complete picture of the movement of funds. Three important points should be taken into account here.
A connection to a crypto ATM can be determined in advance
Modern blockchain analysis systems are able to link cryptocurrency wallets and their groups to known operators of cryptocurrency ATMs. Therefore, when screening a customer's or counterparty's wallet, it is possible to determine whether the funds came directly from a crypto ATM or passed through one several transfers earlier.
For banks that hold customers' digital assets or provide cryptocurrency services, this turns an assumption about the possible use of a crypto ATM into a concrete risk indicator. A particularly serious signal is considered to be direct interaction with an operator known for weak controls, or regular transfers of funds in both directions between a customer and such an operator.
Crypto ATMs often hide behind major crypto exchanges
In this case, the transactions on the blockchain look as though the funds pass solely through the exchange, while the crypto ATM operator itself remains hidden. As a result, the bank may see only a well-known exchange, without suspecting that behind it there is in fact a network of cryptocurrency terminals.
This is precisely why the quality of blockchain analysis plays a decisive role: some systems are able to identify only the name of the exchange, whereas more advanced ones make it possible to detect the hidden operator working within its infrastructure.
Crypto ATM operators are also counterparties of banks
A bank may encounter a cryptocurrency ATM operator not only while investigating fraud, but also as an ordinary corporate client. For example, if such a company opens a bank account to service its network of terminals.
In such cases, the analysis of blockchain operations becomes an important part of due diligence. It makes it possible to understand whether the actual movement of funds corresponds to the company's declared business model.
Even after cash is exchanged for cryptocurrency, the money can be traced
Once cash turns into cryptocurrency, many believe that the money disappears irretrievably. It is precisely on such an assumption that fraudulent schemes are built. However, when blockchain analysis is used, this is far from always the case.
A telling example occurred in December 2025. The US Department of Justice secured the forfeiture of more than 200 thousand dollars stolen from four elderly people. The fraudsters posed as bank security employees and convinced the victims to deposit cash through cryptocurrency ATMs. In the course of the investigation, law enforcement authorities were able to trace the path of the funds on the blockchain all the way to a cryptocurrency wallet registered at an exchange located in the Seychelles.
Such investigations require the analysis of an enormous amount of data. Funds may pass through dozens of wallets, cryptocurrency exchanges, transaction-mixing services, and even move between different blockchain networks. The task of analytical tools is to isolate the truly important chains of transfers among millions of operations.
It was precisely thanks to blockchain analysis technologies that investigators managed to reconstruct the route of the funds to the exchange in the Seychelles. Such tools allow banks to detect customers' connections to cryptocurrency ATMs and to assess potential risks far more accurately.
Why regulators have gone after crypto ATMs: the US, the UK, Canada
Regulatory authorities in various countries have concluded that cryptocurrency ATMs are used by fraudsters so widely that the situation calls for legislative intervention. That is why many states have already begun to take action.
Additional requirements are provided for by the Crypto ATM Fraud Prevention Act bill. Under it, operators of cryptocurrency ATMs will be required to undergo mandatory registration, set transaction limits, verify customers' identities, warn users about possible fraud schemes, and fully refund money to new customers if they report fraud within 30 days. The bill also provides for the mandatory use of blockchain analysis technologies, which shows the direction in which regulators' requirements will further develop.
The Canadian financial intelligence agency FINTRAC has named cryptocurrency ATMs one of the main tools for collecting and subsequently laundering fraudulently obtained money. The US Federal Trade Commission put it even more directly, characterizing crypto ATMs as a "payment portal for scammers."
What banks should do: a cryptocurrency risk management system
Fraud involving cryptocurrency ATMs represents a serious threat, yet banks have tools that make it possible to substantially reduce such risks.
Trained branch employees and effective transaction-monitoring systems help detect suspicious activity while still at the cash-handling stage. Once funds enter the blockchain, the analysis of cryptocurrency transactions makes it possible to assess the degree of risk, establish the origin of the funds, and reconstruct their further route.
Fraud involving cryptocurrency ATMs is only one of the many risks associated with digital assets. Today, financial regulators expect banks to be able to detect and control such threats regardless of the stage at which they arise. This is precisely why blockchain analysis technologies are gradually becoming an integral part of anti-fraud and anti-money-laundering systems.
