Somewhere between the lottery ticket machine and the change counter at a grocery store, a growing number of Americans have started noticing a new kind of terminal: a squat, brightly lit kiosk with a touchscreen, a bill acceptor, and a logo referencing Bitcoin or crypto. These machines, most commonly called Bitcoin ATMs or crypto ATMs, have quietly become a fixture of convenience stores, gas stations, laundromats, and strip malls across the country. Unlike a bank’s automated teller machine, which exists to move money between an account a customer already holds and cash in their pocket, a crypto ATM exists to convert physical cash into a cryptocurrency balance in a digital wallet, and in some cases to reverse the process. For a technology that started as a niche interest for enthusiasts trading online, the arrival of a cash-accepting kiosk at the corner store represents a significant and, to many people, confusing step into the physical, everyday world.
The confusion is reasonable, because crypto ATMs occupy an unusual position in the financial landscape. They are legal, regulated to varying degrees depending on the state, and in many cases operated by publicly traded companies with real revenue and real customers who use them for legitimate purposes. At the same time, they have become one of the most consistently flagged tools in government fraud warnings, showing up again and again in alerts from consumer protection agencies, state regulators, and law enforcement as a preferred mechanism for scammers extracting cash from victims. Both of these things are true simultaneously, and understanding crypto ATMs means holding both facts in view rather than treating the machines as either a harmless convenience or a scam device with no legitimate use.
Part of what makes these machines distinctive, and part of what makes them attractive to both ordinary users and fraudsters, is the same underlying property: a cryptocurrency transaction, once broadcast to the network and confirmed, cannot be reversed the way a credit card charge can be disputed or a bank wire can sometimes be recalled. For someone who wants a fast, permanent way to convert cash into a digital asset without going through a bank account or waiting days for a linked exchange transfer to clear, that finality is a feature. For a scammer who has just convinced a frightened victim that depositing cash into a machine will protect their life savings, that same finality is precisely what makes the fraud work, because once the machine dispenses the cryptocurrency to a wallet address the scammer controls, there is no bank, no card network, and no dispute process standing between the victim and a permanent loss.
The tension between access and exposure shows up clearly in how differently various parts of the financial and regulatory system have responded to these machines. A convenience store owner sees a piece of equipment that draws foot traffic and pays a modest commission for the floor space it occupies. A cryptocurrency enthusiast without a linked bank account sees a rare cash-to-crypto on-ramp that does not require the multi-day identity verification process common at online exchanges. A financial regulator, meanwhile, increasingly sees a documented and rapidly worsening fraud vector, and a family member who has just watched a parent or grandparent lose a retirement account balance to a scam call sees something closer to a weapon than a convenience. None of these perspectives is wrong, and the fact that crypto ATMs can be all of these things depending on who is standing in front of one is exactly why they resist a simple verdict of good or bad.
This article works through what a crypto ATM actually does, mechanically, and how a typical transaction unfolds. It looks at how quickly the machines have spread across the country and who operates them, using the industry’s own reported growth figures and the example of Bitcoin Depot, the first crypto ATM company to list on a major U.S. stock exchange. It examines what these machines actually cost to use, drawing on Federal Reserve research into the industry’s fee structure, and it looks closely at documented Federal Trade Commission data on how crypto ATMs have become entangled in a rapidly growing category of fraud, including who is most likely to be targeted and how the scam scripts typically unfold. It also covers how regulators, starting with California, have begun responding with specific legal limits on the machines, and it closes with an honest accounting of the narrow set of situations in which using a crypto ATM actually makes sense, alongside the situations in which it almost never does.
What a Crypto ATM Actually Is and How It Works
Despite the name, a crypto ATM does not connect to a bank account in the way a traditional ATM does, and it is more accurate to think of it as a specialized vending machine for cryptocurrency than as a cousin of the machine a person uses to withdraw cash from a checking account. The machine is typically owned and stocked with cryptocurrency inventory by an operator, one of a few dozen companies that run networks of these kiosks across a region or the country, and it is placed inside or just outside a retail location under a revenue-sharing arrangement with the store owner. The store itself usually has little to do with the machine’s operation beyond hosting it and, at most, keeping an eye on it; the transaction itself runs entirely through the operator’s software and back-end systems.
A basic transaction begins with the customer selecting the cryptocurrency they want to buy, most commonly Bitcoin, though many modern machines support several other coins as well. The machine then asks for a destination wallet address, which the customer provides either by typing it in manually or, far more commonly, by scanning a QR code generated by a cryptocurrency wallet app on their phone. Depending on the transaction size and the operator’s compliance program, the machine may require a phone number for identity verification through a text message code, and above certain thresholds set by anti-money-laundering regulations, it may require a government-issued photo identification, a selfie captured by the machine’s camera, or both. Once identity checks are satisfied, the customer feeds cash into a bill acceptor, the machine displays the amount of cryptocurrency that cash will purchase after fees, and upon confirmation, the operator sends that cryptocurrency to the specified wallet address, usually within several minutes as the transaction confirms on the underlying blockchain network.
The identity verification step is worth pausing on, because it is a meaningful point of variation between operators and a frequent source of confusion for first-time users. Federal anti-money-laundering rules require crypto ATM operators, like other money service businesses, to verify customer identity above certain transaction thresholds, and many operators choose to apply at least basic phone-based verification to every transaction regardless of size as a fraud-prevention measure. This means that, contrary to an assumption some users bring from cash transactions generally, a crypto ATM transaction is rarely anonymous in any meaningful sense; the operator typically retains a record tying a transaction to a phone number, and often to a verified identity document, which is available to law enforcement through the same legal processes used to obtain other financial records.
Behind the touchscreen, every crypto ATM operator in the United States is required to register with the Financial Crimes Enforcement Network as a money services business, and in most states must additionally hold a money-transmitter license issued by the relevant state banking or financial-protection regulator, the same category of license held by companies that process traditional wire transfers or prepaid cards. These obligations carry ongoing compliance costs: operators must file currency transaction reports for larger cash transactions, monitor for and file suspicious activity reports on transactions that fit known fraud patterns, and maintain records that examiners from state regulators can review during periodic compliance audits. This regulatory layer is largely invisible to the person standing at the machine, who typically experiences it only as a request for a phone number or a photo, but it is the same infrastructure that gives law enforcement a paper trail to follow after a fraud report is filed, even though that paper trail arrives too late to return money that has already been converted and moved by a scammer.
Physically, most machines share a similar set of components regardless of manufacturer: a bill acceptor capable of validating and storing cash, a touchscreen interface running the operator’s transaction software, a camera used for identity verification and security monitoring, and in the case of a two-way machine, a cash dispenser mechanism similar to the one found in a traditional bank ATM. Machines are typically connected to the operator’s back-end systems over a cellular data connection rather than the host location’s own internet service, both for reliability and to keep the transaction and compliance systems under the operator’s direct control rather than dependent on a retail partner’s network security.
One-Way vs. Two-Way Machines and the Buying/Selling Process
Crypto ATMs fall into two broad categories based on which direction of transaction they support. One-way machines, which represent the substantial majority of the installed base, allow a customer to insert cash and receive cryptocurrency, but they do not accept cryptocurrency for conversion back into cash. Two-way machines support both directions: a customer can buy cryptocurrency with cash as described above, or they can sell cryptocurrency by sending it from their own wallet to an address the machine displays and then receiving cash from the machine’s dispenser once the transaction confirms on the blockchain. Two-way machines are more expensive for operators to run, since they require the machine to hold physical cash reserves sufficient to pay out sell transactions, and they are correspondingly less common, concentrated more heavily in larger metropolitan areas and in machines operated by the largest network operators.
The buying process, as the more common of the two, follows the sequence described above: cash in, identity verification as required, wallet address provided, cryptocurrency out. The selling process reverses this but adds an important extra step from the customer’s perspective, since the customer must first send cryptocurrency from their personal wallet to an address the machine provides, and that transaction must receive at least one confirmation on the underlying blockchain network before the machine will dispense cash. Depending on network congestion, this confirmation can take anywhere from a few minutes to, in rare cases of a congested network, much longer, and unlike a simple software glitch, a customer cannot cancel or reverse a cryptocurrency transaction once it has been broadcast, meaning a mistake in selecting the destination address or transaction amount cannot be corrected after the fact.
A detail that surprises many first-time users of either machine type is the display of the actual cryptocurrency exchange rate the machine is using, which is typically shown alongside the transaction summary before a customer confirms. This rate is where a substantial share of the machine’s cost to the user is actually embedded, separate from any explicitly labeled transaction fee, since operators generally price cryptocurrency at a markup above the prevailing market rate found on a mainstream exchange. A customer who only looks at the labeled “fee” percentage and does not compare the displayed exchange rate against a current market price can significantly underestimate what a transaction is actually costing them, a point that becomes especially relevant in the discussion of overall crypto ATM costs later in this article.
Every machine also enforces transaction limits set by its operator, which typically scale with the level of identity verification a customer has completed. A first-time user verifying only a phone number might be capped at a few hundred dollars for a single transaction, while a returning customer who has submitted a government-issued ID and completed a selfie match might be permitted to transact up to a machine-specific ceiling, commonly in the range of several thousand dollars per day before newer state-level caps discussed later in this article began overriding those operator-set limits in some jurisdictions. These tiered limits exist primarily for the operator’s own regulatory compliance rather than for the customer’s protection, though as the discussion of fraud later in this article shows, the two goals have increasingly converged as regulators have concluded that lower limits also happen to blunt the scale of damage a single fraudulent transaction can cause.
Where Crypto ATMs Come From and How Fast They’ve Spread
The first Bitcoin ATM was installed in a coffee shop in Vancouver, Canada, in 2013, at a time when the entire concept of a physical machine dispensing a purely digital asset seemed like a novelty act rather than the foundation of an industry. Growth was slow for the technology’s first several years, constrained by limited public awareness of cryptocurrency, regulatory uncertainty, and the practical challenge of building a compliance program capable of satisfying money-transmission and anti-money-laundering requirements across dozens of different state jurisdictions in the United States, which quickly became the industry’s largest market.
That growth curve changed dramatically over the following decade. According to installation figures self-reported by operators to the industry tracking site Coin ATM Radar, and cited by the Federal Trade Commission in its own analysis of the space, the number of Bitcoin ATM installations in the United States grew from approximately 4,250 in January 2020 to approximately 32,000 by June 2024, a more than sevenfold increase in roughly four and a half years. This growth tracked, and in some ways outpaced, the broader surge of retail and public interest in cryptocurrency over the same period, and it reflects a business model that scales relatively efficiently: once an operator has built the compliance infrastructure, software platform, and cash-logistics systems needed to run one machine, adding additional machines to new retail locations is a comparatively low-cost expansion compared to opening additional bank branches or exchange offices.
The United States represents the overwhelming majority of the world’s installed crypto ATM base, a concentration driven by a combination of relatively permissive state-level licensing regimes in many states, a large and geographically dispersed retail footprint of gas stations and convenience stores willing to host the machines, and comparatively high public familiarity with cryptocurrency relative to much of the rest of the world. A handful of large operators account for a disproportionate share of the installed machines nationally, running networks that can number in the thousands of individual kiosks, while a long tail of smaller regional operators fills in the remaining market with machines numbering in the dozens or low hundreds.
The economics that drive a store owner to host a machine are straightforward and explain why crypto ATMs cluster in the specific kinds of locations where most people encounter them. An operator typically pays the host location a commission based on a share of transaction volume or a flat monthly fee for the floor space, requiring little from the store beyond electrical power, a data connection or adequate cellular signal, and occasional attention if the machine jams or runs low on the receipt paper used for transaction confirmations. This low-effort, recurring revenue arrangement is particularly attractive to the kinds of small, independently owned businesses, convenience stores, gas stations, smoke shops, and check-cashing outlets, that operate on thin margins and have underused floor or counter space, which is precisely the retail category where crypto ATMs have concentrated most heavily rather than in large chain retailers or shopping malls with more selective tenant standards.
Bitcoin Depot and the Rise of a Public Crypto ATM Company
The clearest illustration of how large and commercially significant the crypto ATM industry has become is Bitcoin Depot, which on July 3, 2023, became the first cryptocurrency ATM operator to begin trading on a major U.S. stock exchange, listing on the Nasdaq under the ticker symbol BTM following a merger with a special purpose acquisition company. At the time of its public listing, Bitcoin Depot operated a fleet of more than 7,000 kiosks across North America, and the company subsequently set a goal of expanding to more than 8,000 installed kiosks by the end of 2024, underscoring both the scale the leading operator had already reached and its continued expansion plans even as regulatory scrutiny of the industry intensified elsewhere.
Bitcoin Depot’s financial disclosures, required as a publicly traded company under U.S. securities law, give an unusually clear window into the actual economics of running a crypto ATM network at scale. The company reported second-quarter 2023 revenue of $197.5 million, an 18 percent increase over the same quarter the prior year, and for the full 2023 fiscal year, the company reported record revenue of $689 million, a 7 percent increase year over year. These figures represent gross transaction volume flowing through the company’s machines rather than net profit, but they establish, with the kind of independently auditable detail that a privately held competitor is not required to disclose, that crypto ATMs process a substantial and growing volume of real cash transactions rather than serving a narrow niche of hobbyists.
Bitcoin Depot’s public listing also placed the company’s operations under a level of disclosure and market scrutiny that most of its competitors do not face, including regular reporting obligations to the Securities and Exchange Commission and the kind of analyst and media attention that accompanies any Nasdaq-listed company. That scrutiny has, at times, extended to exactly the fraud-related concerns discussed later in this article, since a company of Bitcoin Depot’s scale and visibility is a natural focal point for regulators and journalists examining how the broader industry handles fraud prevention, and its public financial disclosures provide a useful benchmark against which the industry’s rapid installation growth and the fee structure discussed next can both be measured.
Bitcoin Depot is the largest operator to have taken the step of going public, but it competes with several other sizable networks that together make up the rest of the industry’s concentrated top tier, including CoinFlip, Coinme, and Athena Bitcoin, each running networks of machines numbering in the thousands across different regional footprints, along with a long list of smaller regional and single-market operators. This competitive structure matters for a customer trying to understand pricing, because fees, exchange-rate markups, and transaction limits vary not just by state regulation but by which specific operator’s machine happens to be installed at a given convenience store, meaning two machines standing a few miles apart can charge meaningfully different amounts for the identical transaction.
The Real Cost: Understanding Crypto ATM Fees
Crypto ATMs are, without much competition, among the most expensive ways to acquire or liquidate cryptocurrency that exist within the legal financial system, and the scale of that cost is documented in unusually direct terms by the Federal Reserve Bank of Kansas City, which published a payments-system research briefing examining the industry’s business model and fee structure. Drawing on operator-reported data compiled by Coin ATM Radar, the research found that the median fee for buying Bitcoin at a crypto ATM in the United States was approximately 16 percent of the transaction value, while the median fee for selling Bitcoin back to cash was approximately 15 percent. For comparison, a typical online cryptocurrency exchange charges a small fraction of a percent to low single digits for the same basic transaction, and even a relatively expensive traditional payment method like an international wire transfer or a credit card cash advance rarely approaches fees in this range.
The range across individual operators and locations is wide, and the median figure understates just how expensive some transactions can be. Some operators in competitive urban markets advertise fees as low as 8 to 10 percent, while others, particularly in markets with less competition or higher operating costs, charge 20 to 25 percent or more on a single transaction. A customer converting $500 in cash into Bitcoin at a machine charging 20 percent is effectively paying $100 simply for the convenience of that specific transaction at that specific location, a cost that would be immediately and obviously unacceptable in almost any other everyday financial context but that many crypto ATM customers accept, often without fully realizing the size of the fee, because the machine is physically present, immediate, and requires no bank account or prior relationship with an exchange.
It is worth explaining why fees run this high, since the answer is not simply that operators are charging whatever the market will bear, though profit margin is certainly part of the story. The Kansas City Fed’s research noted that a substantial share of every dollar collected in fees, on the order of 84 cents based on the operator-reported figures examined, goes directly toward purchasing the cryptocurrency actually dispensed to the customer, reflecting the underlying cost of the digital asset itself embedded in the exchange rate the machine displays. The remaining margin has to cover the machine’s physical hardware and maintenance, the cost of holding and transporting cash inventory, the compliance infrastructure required to satisfy anti-money-laundering and identity-verification obligations across many state jurisdictions, revenue-sharing payments to the retail host location, and, ultimately, the operator’s profit. None of this fully justifies fees an order of magnitude higher than comparable online alternatives, but it explains why the cost structure of a physical, cash-accepting, heavily regulated kiosk network looks nothing like the cost structure of a purely digital exchange platform operating without physical infrastructure or cash-handling requirements.
The practical lesson for anyone considering using one of these machines is that the displayed percentage fee, if a machine even labels one clearly, is often not the full picture, because a portion of the real cost is embedded invisibly in the exchange rate offered rather than itemized as a separate charge. Comparing the cryptocurrency amount a machine promises for a given cash deposit against the prevailing market price available on a mainstream exchange app, which most users can check within seconds on their phone before completing a transaction, is the only reliable way to understand the true total cost of a specific transaction at a specific machine.
Fee disclosure itself has become a specific target of regulatory attention rather than being left to each operator’s discretion, precisely because the combination of a percentage fee and an undisclosed exchange-rate markup made it difficult for even a careful customer to determine the true cost before completing a transaction. California’s Digital Financial Assets Law, discussed in more detail later in this article, does not stop at capping the fee amount; it separately mandates new disclosures intended to make the total cost of a transaction, including any markup built into the exchange rate, clear to the customer before they confirm it, a response directly aimed at the kind of hidden-cost structure this section has described. Other states considering similar legislation have generally included comparable disclosure requirements, reflecting a growing regulatory consensus that a percentage fee alone, however prominently displayed, does not give a customer the information needed to understand what a transaction actually costs relative to buying the same cryptocurrency through a bank-linked exchange account.
The Scam Problem: How Crypto ATMs Became a Tool for Fraud
The same properties that make crypto ATMs convenient for a legitimate customer — speed, minimal friction, cash acceptance, and an irreversible final transaction — make them exceptionally well suited to a particular style of fraud, and government data on the scale of that problem has become increasingly stark over the past several years. The Federal Trade Commission’s Consumer Sentinel Network, which aggregates fraud reports submitted by consumers across the country, has tracked a rapid escalation in losses specifically tied to Bitcoin ATMs, publishing a detailed data spotlight on the trend in September 2024 that laid out the scale of the problem in concrete terms.
According to that FTC analysis, reported fraud losses involving Bitcoin ATMs increased nearly tenfold between 2020 and 2023, and losses topped $65 million in just the first six months of 2024 alone, a pace that, if it continued, implied a full-year total well above what had been reported for all of the prior year. The agency was careful to note that these figures almost certainly understate the true scale of the problem, since the vast majority of fraud victims never file a report with any government agency at all, meaning the documented losses represent a floor rather than a ceiling on the actual harm. The reported losses were also unusually concentrated in a specific category of fraud: the FTC found that about 86 percent of people who reported a loss involving a Bitcoin ATM in the first half of 2024 identified the underlying scam as a government impersonation scheme, a business impersonation scheme, or a tech support scam, rather than the fake investment schemes that dominate cryptocurrency fraud more broadly when a Bitcoin ATM is not involved.
The FTC’s methodology is worth understanding briefly, because it shapes how the resulting figures should be read. The agency’s Consumer Sentinel Network compiles fraud reports submitted directly by consumers along with reports forwarded from other agencies and organizations, and the specific dollar figures in its Bitcoin ATM analysis were derived from a keyword analysis of the free-text narratives consumers wrote when filing a report, since the standard report form does not always include a dedicated field specifying that a Bitcoin ATM was the payment mechanism used. This means the published totals are themselves an estimate built from reports that happened to mention a Bitcoin ATM clearly enough to be identified, rather than a complete census of every fraud report where one was actually involved, reinforcing the agency’s own caution that the real scale of harm sits above the published numbers rather than precisely at them. Even with that caveat, the size and consistency of the reported increase, year over year, across a dataset drawn from tens of thousands of individual consumer reports, is what has made this specific FTC analysis one of the most frequently cited pieces of evidence in state legislative debates over crypto ATM regulation.
The mechanics of these scams follow a recognizable pattern that the FTC described in detail. Most begin with an unexpected phone call, a text message, or a fake security pop-up on a computer, often impersonating a well-known company like Microsoft or a government agency, warning the target of supposed suspicious activity, unauthorized charges, or even a criminal investigation tied to their name. The scenario escalates quickly, sometimes with a second scammer posing as a law enforcement or government official joining the call to add pressure, and the target is told that the only way to protect their money or resolve the fabricated problem is to withdraw cash from their bank and convert it into cryptocurrency, sometimes framed, in the FTC’s own account of victim reports, as a “safety locker” that will keep the funds secure. The scammer then directs the target to a specific nearby Bitcoin ATM, often one they have used successfully before, and sends a QR code by text message for the target to scan at the machine, which routes the deposited cash directly into a wallet the scammer controls. Once the machine dispenses the cryptocurrency, the transaction is final, and there is no bank, card issuer, or payment network available to reverse it or investigate a dispute.
Who Is Most at Risk and How the Scams Work
The FTC’s data makes clear that this particular category of fraud does not fall evenly across the population, and older adults bear a dramatically disproportionate share of the harm. In the first half of 2024, people aged 60 and over were more than three times as likely as younger adults, adjusted for the relative size of each age group in the population, to report a financial loss involving a Bitcoin ATM. In dollar terms, the imbalance was even starker: people 60 and older accounted for $46 million of the $65 million in total reported Bitcoin ATM losses during that period, or roughly 71 percent of the total, meaning older adults absorbed more than two out of every three dollars lost to this specific category of fraud even though they make up a much smaller share of the population reporting fraud generally.
This concentration among older adults is closely tied to the specific scam scripts that dominate Bitcoin ATM fraud, since government impersonation and tech support scams, the two categories the FTC found most associated with Bitcoin ATM losses, have historically been shown in broader fraud research to disproportionately target and successfully deceive older victims, who may be less familiar with how cryptocurrency transactions work, less likely to have encountered similar scam attempts before, and in some cases more trusting of a caller who convincingly impersonates a government agency or a familiar technology brand. The FTC also found that phone calls were the initial point of contact in roughly 47 percent of the Bitcoin ATM fraud reports it examined, with online pop-up ads and emails accounting for most of the remainder, reinforcing that these scams typically begin with the scammer reaching out first rather than the victim searching for anything related to cryptocurrency.
A further detail from the FTC’s analysis is particularly instructive for anyone trying to protect a family member from this kind of fraud: victim reports showed that scammers frequently direct targets to specific Bitcoin ATM locations and, in many cases, specific operators by name, a pattern that suggests fraudsters have developed preferences for machines or locations where fraud-prevention controls are weaker, or where transaction limits, camera monitoring, or on-screen warning messages are less likely to interrupt the scam before it completes. This has put pressure on operators to strengthen in-machine warnings, transaction delays, and staff or remote-monitoring intervention for large or suspicious transactions, though the effectiveness of these measures varies considerably from one operator and one machine to the next, and none of them has come close to eliminating the underlying problem.
Victim accounts collected by consumer protection organizations and cited in state legislative hearings also describe a consistent pattern of the scammer staying on the phone with the target for the entire duration of the trip to the bank and then to the machine, a tactic that serves two purposes at once: it prevents the target from pausing to consult a family member, a bank teller, or anyone else who might recognize the scam and interrupt it, and it allows the scammer to walk the target through each screen of the machine’s interface in real time, including entering the wallet address the scammer has provided and confirming the transaction before any doubt has a chance to set in. This sustained-contact tactic is a large part of why brief, generic warning messages printed on a machine’s screen have proven only partially effective, since a target who has already been on a manipulative phone call for thirty or forty minutes and has been coached to expect and dismiss exactly this kind of warning is less likely to be stopped by it than someone encountering the same warning without that preceding context.
Regulation Catches Up: California’s Crypto ATM Law
Faced with fraud losses of this scale and a clear, documented pattern connecting Bitcoin ATMs to some of the fastest-growing scam categories tracked by federal regulators, state governments have begun moving to regulate the machines directly, and California has taken the most significant and closely watched action to date. On October 13, 2023, Governor Gavin Newsom signed Assembly Bill 39 and Senate Bill 401, which together created California’s Digital Financial Assets Law, a first-of-its-kind state framework specifically regulating cryptocurrency businesses, including the operators of crypto kiosks.
Among the law’s most consequential provisions for everyday users is a hard cap limiting crypto kiosk operators from accepting or dispensing more than $1,000 per customer per day, a limit that took effect on January 1, 2024, alongside new location-reporting requirements for operators. The law separately imposed a cap on the fees operators may charge, limiting them to the greater of $5 or 15 percent of the transaction amount, which took effect on January 1, 2025, directly targeting the kind of high-margin transactions documented in the Kansas City Fed’s research described earlier in this article. Beginning July 1, 2025, the law goes further still, requiring any entity conducting digital financial asset business activity in California, including the operation of crypto kiosks, to hold a license from the state’s Department of Financial Protection and Innovation, bringing crypto ATM operators under a supervisory and enforcement framework similar to that governing other licensed money transmitters.
The daily transaction cap did not go unchallenged. An industry group calling itself the Alliance for the Fair Access to Cryptocurrency Terminals filed a lawsuit against the California Department of Financial Protection and Innovation, served in January 2024, arguing that the $1,000 daily limit was unreasonable and exceeded the state legislature’s authority. The Superior Court for Los Angeles County rejected that argument, ruling that the daily cap represented a reasonable method for limiting fraud, a decision the department’s commissioner, Clothilde Hewlett, described as validating the law’s “common-sense restrictions” protecting consumers from fraudulent transactions and limiting the use of kiosks for illicit purposes. The ruling let California’s daily limit stand as the most direct legal test, to date, of a state’s authority to impose transaction-size restrictions specifically targeted at crypto ATMs, and it is being watched closely by other states considering similar measures, several of which have introduced comparable legislation limiting daily transaction amounts or requiring enhanced warnings and fraud-prevention measures at crypto kiosks following California’s lead.
Several other states have since enacted their own versions of these restrictions, with meaningful variation in the specific limits chosen. Vermont passed a law in 2024 combining new operating requirements with a one-year moratorium on the installation of additional crypto ATMs while the state’s regulatory approach caught up with the industry’s growth. Illinois approved legislation requiring operators to report the physical location of every kiosk to state regulators, a measure aimed squarely at the more than 1,600 crypto kiosks reported to be operating in the state, alongside transaction limits and refund provisions for victims who report fraud quickly enough. Wisconsin set its own daily transaction cap at $1,000 per customer, matching California’s figure, while Oklahoma adopted a $2,000 cap specifically for new customers, reflecting a judgment that the highest fraud risk applies to a customer’s first few transactions before they have an established, presumably legitimate pattern of use. At the local level, the city of Spokane, Washington, went further than any state and banned crypto ATMs outright within city limits, citing scam concerns severe enough that regulation short of a ban was judged insufficient. Taken together, this wave of state and local action shows a policy conversation that has moved, within roughly two years of California’s original law, from a single, closely watched experiment to a genuine, if still uneven, patchwork of restrictions spreading across the country.
When a Crypto ATM Genuinely Makes Sense
Given everything documented above about elevated fees and a well-established fraud pattern, it is worth being direct about the narrow set of circumstances in which using a crypto ATM is actually a reasonable choice rather than an expensive mistake or a fraud waiting to happen. The clearest legitimate use case involves someone who genuinely lacks easier access to cryptocurrency exchanges, whether because they do not hold a bank account that can be linked to an online exchange, because they live in an area with limited broadband or banking infrastructure, or because a specific, time-sensitive need requires converting cash into cryptocurrency faster than a bank transfer or exchange verification process would allow. For the unbanked and underbanked population in the United States, which the Federal Deposit Insurance Corporation’s own surveys have consistently found represents a meaningful share of households, a cash-accepting kiosk that does not require a bank account can serve a genuine access function that a purely online exchange cannot, even at a real cost premium.
A second legitimate scenario involves relatively small, discretionary transactions where the dollar cost of the fee, while high in percentage terms, is low enough in absolute terms that the convenience is worth paying for, in much the same way a traveler might accept a poor currency-exchange rate at an airport kiosk for the convenience of having local cash immediately rather than searching for a better rate elsewhere. Someone converting $50 or $100 into cryptocurrency to complete a specific, immediate transaction is paying a real but bounded cost, quite different from someone who has been persuaded, under emotional duress from a scam call, to withdraw thousands of dollars from a bank account and feed it into a machine.
For anyone who does decide a crypto ATM transaction makes sense for their situation, a handful of practical habits meaningfully reduce risk. Comparing the machine’s displayed cryptocurrency amount against the current market price on a mainstream exchange app before confirming a transaction reveals the true cost, including the portion hidden in the exchange rate rather than an itemized fee. Treating any unsolicited instruction to use a crypto ATM, whether from a caller, a text message, or a computer pop-up, as an unambiguous sign of fraud, regardless of how urgent or official the request sounds, closes off the single most common pathway into this category of scam. And recognizing that a completed transaction cannot be reversed, disputed, or recalled under any circumstances means treating the moment of confirmation on the machine’s screen with the same seriousness as handing cash directly to a stranger, because functionally, that is close to what is happening.
Two further habits round out a reasonably safe approach for someone who has decided a transaction is worth making. Double-checking a wallet address character by character, or relying on the QR-code scan rather than manual entry whenever possible, matters because a single mistyped character sends funds to an address that may belong to no one at all, permanently, with no way to recall them. And checking whether a specific operator holds an active money-transmitter license in the relevant state, information most state financial regulators publish in a searchable database, provides at least some assurance that the machine is subject to the compliance obligations and periodic examination described earlier in this article, rather than operating outside the oversight structure entirely. None of these habits eliminates risk, but each closes off a specific, well-documented way that a crypto ATM transaction goes wrong, whether through simple error or deliberate fraud.
Final Thoughts
Crypto ATMs sit at an uncomfortable intersection of genuine financial utility and predictable, well-documented harm, and neither half of that description cancels out the other. The machines exist and have spread as quickly as they have because they solve a real problem for a real, if relatively small, set of users: people who need a fast, cash-based way to acquire or liquidate cryptocurrency without a bank account, without waiting for an exchange transfer, or without the friction of setting up an account with a platform that may take days to verify their identity. Dismissing that use case entirely would be inaccurate and would ignore the specific role these machines play for the unbanked and underbanked populations that traditional financial infrastructure has historically underserved. At the same time, no honest accounting of crypto ATMs can treat that legitimate use case as the primary story, when federal data shows fraud losses tied to these machines climbing nearly tenfold in three years and concentrating overwhelmingly among older adults targeted by some of the most emotionally manipulative scam scripts in circulation.
The regulatory response now taking shape, starting with California’s daily transaction caps, fee limits, and licensing requirements, represents a recognition that the industry’s rapid, largely unconstrained growth over the past several years outpaced the consumer protections needed to match it. A $1,000 daily limit does not eliminate fraud, and a determined scammer can still direct a victim to make repeated smaller transactions across several days if the relationship persists long enough, but it meaningfully caps the damage any single moment of panic or manipulation can cause, which is precisely the theory the Los Angeles Superior Court endorsed when it upheld the law against industry challenge. Fee caps address a separate but related concern: an industry charging a median of 15 to 16 percent per transaction, more than an order of magnitude above ordinary financial service costs, was always going to draw scrutiny once regulators started asking whether such fees could be justified by anything other than the fact that a captive, often frightened, customer had nowhere better to go in the moment they needed the transaction completed.
What happens next will likely be shaped by two forces moving somewhat independently of each other. On one side, additional states are watching California’s experience and considering similar restrictions, and federal agencies including the FTC will likely continue publishing data that keeps pressure on both regulators and operators to tighten fraud-prevention controls. On the other side, the industry itself, led by publicly traded operators like Bitcoin Depot who now answer to shareholders and securities regulators in addition to state money-transmission licensors, has some incentive to invest in the kind of in-machine warnings, transaction delays, and staff intervention that could meaningfully reduce fraud losses without waiting for every state legislature to act. Whether that incentive proves strong enough to change outcomes at the scale the FTC’s data suggests is needed remains an open question, and the honest answer, for now, is that crypto ATMs will likely keep serving both of the roles documented in this article for some time to come: a genuine, if expensive, convenience for a specific set of users, and a documented, still-growing vector for financial fraud that disproportionately harms the people least equipped to recognize it before the money is gone.
FAQs
- Is a crypto ATM connected to my bank account the way a regular ATM is?
No. A crypto ATM does not connect to any bank account. It accepts physical cash, and sometimes a debit card, and sends cryptocurrency to a digital wallet address you provide, or in the case of a two-way machine, accepts cryptocurrency and dispenses cash. There is no link to your checking or savings account at any point in the transaction. - Why are crypto ATM fees so much higher than using an online exchange?
Federal Reserve Bank of Kansas City research found the median fee for buying Bitcoin at a crypto ATM runs around 16 percent of the transaction, compared to a small fraction of a percent at most online exchanges. The higher cost reflects the expense of physical hardware, cash handling, compliance infrastructure, and revenue-sharing with the retail host, on top of the underlying markup on the cryptocurrency itself. - How do I know what a transaction will actually cost before I confirm it?
Compare the amount of cryptocurrency the machine says it will give you for your cash against the current market price shown on a mainstream exchange app on your phone. A meaningful part of the real cost is often built into the exchange rate the machine offers rather than listed as a separate, clearly labeled fee. - Can a crypto ATM transaction be reversed if I realize I made a mistake?
No. Once a cryptocurrency transaction is confirmed on the blockchain, it cannot be reversed, recalled, or disputed the way a credit card charge or bank transfer sometimes can. This finality is a core feature of how cryptocurrency works, and it applies regardless of whether the mistake was an error on your part or the result of being deceived by a scammer. - Why do scammers specifically direct victims to crypto ATMs instead of asking for a bank transfer or gift cards?
The Federal Trade Commission has found that scammers favor crypto ATMs because the resulting transaction is immediate and permanently irreversible, unlike a bank wire, which can sometimes be recalled, or a credit card charge, which can be disputed. Scammers have also described the machines to victims as “safety lockers,” falsely claiming that depositing cash into one will protect their money. - Who is most likely to be targeted by crypto ATM scams?
FTC data shows adults 60 and older are targeted disproportionately, accounting for about 71 percent of reported dollar losses involving Bitcoin ATMs in the first half of 2024, despite representing a much smaller share of the population reporting fraud overall. Government impersonation, business impersonation, and tech support scams make up the large majority of these reports. - Has any state actually limited how crypto ATMs can operate?
Yes. California’s Digital Financial Assets Law, signed in October 2023, caps daily transactions at crypto kiosks at $1,000 per customer, a limit that took effect January 1, 2024 and was upheld by a Los Angeles County court against an industry legal challenge. The same law caps fees and, starting July 1, 2025, requires kiosk operators to hold a state license. - Is it illegal to operate or use a crypto ATM?
No, operating and using crypto ATMs is legal in most states, though operators must register as money service businesses and comply with federal anti-money-laundering rules, along with any additional state-specific licensing and transaction limits, such as those now in effect in California. - Are there any legitimate reasons to use a crypto ATM despite the high fees?
Yes, mainly for people without easy access to a bank account or online exchange, or for small, time-sensitive transactions where the dollar cost of the fee, though high as a percentage, is low in absolute terms. The convenience can be worth the premium in these narrower situations, much like accepting a poor exchange rate at an airport kiosk for immediate access to cash. - What is the single most reliable warning sign that a crypto ATM is being used as part of a scam?
Any unsolicited call, text, or computer pop-up instructing you to withdraw cash and deposit it into a crypto ATM is a scam, without exception. Legitimate government agencies, banks, and technology companies never ask anyone to resolve a problem or protect their money by using a cryptocurrency ATM, and this single fact is enough to identify and stop the overwhelming majority of these schemes before any money is lost.