When Iowa Attorney General Brenna Bird filed lawsuits against CoinFlip and Bitcoin Depot earlier this year, a few astroturf voices shouted that this consumer protection effort was “anti-crypto.” They are wrong. Crypto ATMs – physical kiosks that let users buy crypto – have become a vehicle for fraud and they need reform.
Law enforcement, regulators and consumer advocates have all raised concerns about these machines for years. DC AG Brian Schwalb sued Athena Bitcoin in September. Pennsylvania AG Dave Sunday has warned that BATMs are a “magnet for scammers.” Arizona AG Kris Mayes even posted “STOP” signs on some crypto machines.
Congressional scrutiny is also increasing. Senator Cynthia Lummis (R-WY), a longtime Bitcoin advocate, has called for stronger security measures. Earlier this year, Senate Judiciary Ranking Member Dick Durbin highlighted abuses, and a few weeks ago Senator Elizabeth Warren called out crypto-ATM operators, signaling that regulatory pressure will only intensify.
The proof
Nationally, the FBI estimates that in the first half of 2025, Americans lost $240 million to crypto ATM fraud. The Iowa AG’s office contacted the top 50 Bitcoin Depot users in Iowa between 2021 and 2024, representing more than $2.4 million in transactions. Of the 34 who responded, every single one confirmed that they had been cheated. Likewise, an investigation by the DC Attorney General revealed that 93% (!) of Athena ATM deposits in the District of Columbia over a five-month period were fraudulent transactions.
The stories follow a predictable pattern: romance scams, fake police calls, fake tech support. Scammers play on panic and direct victims to crypto ATMs where they are asked to deposit cash and send crypto to wallets run by criminals. Store clerks at the convenience stores and smoke shops where the kiosks are located have tried to intervene, but to do so effectively they need training from the ATM companies.
Who are these victims? – in DC their median age was 71.
More protection is needed
Companies’ internal data reveals red flags that they systematically ignore. An elderly Iowa user sent $291,075 using 205 different addresses, which only ended when CoinFlip finally closed his account to prevent further scams. According to the Iowa AG’s office, when Bitcoin Depot identifies suspicious wallets, they simply ask users to provide a different address, making it trivially easy for fraudsters to continue operating.
Several former employees of crypto ATMs told CNN that their employers failed to adequately prevent fraud or help victims. One described the ethos of his former company as “it’s not my problem if someone is stupid and gets ripped off.” Another said: “If there was a way to prevent 100% of fraud, there is no way this industry would survive.”
Customer service agents are trained to tell defrauded customers to contact the local police, but police can do little to help once the money is collected by kiosk operators. CNN reported a case in Jasper County, Texas, where a sheriff’s deputy resorted to sawing open a kiosk to retrieve the cash a lucky victim had just deposited.
The model is the problem
The louder these companies protest regulation, the clearer it becomes that something is wrong.
The answer can be found in the nature of their business models: they profit from every fraudulent transaction and are prevented from changing. CoinFlip’s fee for buying crypto is 21.90% of the total transaction amount. Bitcoin Depot’s terms list fees between 17.3% and 50%. For context, buying bitcoin on Coinbase or similar reputable exchanges typically costs around 1-4%, depending on payment type. According to the DC Attorney General, Athena charges fees of up to 26% per transaction.
These companies bury real fees deep in the fine print, advertising a nominal “service fee” that mimics a traditional ATM fee while hiding the hefty commission that drives their profits. One sneaky way they confuse customers is by charging significantly more than the market price on the day of purchase and maintaining the spread. (See, for example, Athena’s Terms of Service, section 7.5.)
When Bitcoin Depot’s revenue fell 25% after California enacted consumer protections that limited daily transactions to $1,000, the company explicitly blamed the “adverse legislation” in its earnings report. Consider that admission: their business model apparently depends on customers losing amounts well in excess of $1,000 per day.
Crypto ATM operators say they honorably serve the unbanked. The data from the state AG cases says otherwise. Could crypto ATMs theoretically work legitimately with adequate safeguards for the penniless? Perhaps. But instead of fighting government enforcement, these companies could start by implementing serious anti-fraud measures that actually work.
The future depends on trust
Crypto ATM operators should first make all fees much more transparent at the time of purchase. Second, they should impose additional verification and friction for large transactions (or those with suspicious speed). Third, they should significantly strengthen compliance defenses against customers sending crypto to suspicious addresses. In some corners of crypto, users know or should know that no central controlling intermediary polices fraud; at a physical, personal ATM controlled by a for-profit company, consumers expect more.
The future of the crypto ATM industry does not have to be exploitative. There are real opportunities in money transfers, bill payment and stablecoin access for the unbanked, but these opportunities depend on earning trust. It starts with transparency, compliance and design choices that make fraud harder, not easier.
In the meantime, rest assured that the cases against crypto ATMs are backed by overwhelming evidence. Brenna Bird and other leaders working on this issue are not anti-crypto; they are anti-fraud. Attorney General Bird, in particular, has repeatedly supported industry where it counts: she joined 18 other state AGs to sue the SEC for overstepping its authority and has signed critical amicus briefs in industry cases.
Ultimately, if crypto doesn’t police itself, regulators will do it for us, painting us all with the same brush. Cleaning up problems is not anti-innovation; it is the only way to make innovation sustainable.
