The Scam Doesn't Start at the Kiosk: Why Crypto-ATM Laws Keep Missing Where Fraud Begins

A woman in her seventies drives to a gas station in Greenfield, Wisconsin, with $9,000 in cash she pulled from her bank an hour earlier. She stands at a Bitcoin ATM, scans a QR code a stranger texted her, and feeds in the bills. The machine prints a receipt. The money is gone.

By the time she reached that machine, the crime was almost finished. It had started that morning with a phone call. The caller ID said it was her bank's fraud department. A calm voice told her someone had drained her account, that she needed to move her money somewhere safe right now, and that the only way to protect it was to convert it to Bitcoin. She was told not to explain the withdrawal to the teller, because the teller might be in on it. She was coached through every step. The kiosk was the finish line, not the starting gun.

This is the part the new laws keep missing. In its own September 2024 report on Bitcoin ATMs, the Federal Trade Commission said these scams "many start with a call or message."¹ About 86 percent of people who reported a loss at a Bitcoin ATM had been caught in a government impersonation, business impersonation, or tech-support scam. Somebody called them first, pretending to be the IRS, Microsoft, their bank, or their grandson. The kiosk generated none of those lies. It processed the consequence.

What Wisconsin Got Right, and What It's Costing

Give the state credit on instinct. Wisconsin chose regulation over an outright ban, which is the better reflex. Its Act 226, in effect since April, requires customer ID and a receipt on every purchase, caps daily crypto-ATM transactions at $1,000, limits operator fees to the greater of $5 or 3 percent, and forces operators to refund victims who report a scam to law enforcement and to the operator within thirty days.² The state has more than 700 kiosks, and residents reported losing over $5.4 million to cryptocurrency scams in 2025.

Two of those provisions do real work. Greenfield Police Detective Scott Simons, a crypto investigator with a national reputation for clawing money back, said as much. The ID requirement stops a scammer from running many victims through a single account. The $1,000 daily cap kills the oldest trick in the playbook, walking a victim from one kiosk to the next all day to launder a five-figure loss in thousand-dollar bites. "The scammers are not wasting their time trying to get $1,000 from a victim in Wisconsin," Simons said. We have no quarrel with either rule. Identity checks and sensible limits target behavior that is actually part of the fraud.

The other two provisions are a different matter. They do not target fraud. They target the operator, and in Wisconsin we can already see what that does.

Start with the fee cap. Dictating the maximum a business may charge is price control, and here it lands on an industry that has spent a decade being quietly debanked. Bitcoin companies, kiosk operators included, routinely lose their bank accounts or pay punitive rates for the ones they keep, a hangover from Operation Choke Point-style pressure that regulators have never fully disowned.⁹ After those costs the margins are already thin, as the public filings of the largest listed U.S. Bitcoin ATM operator make clear. A statutory price ceiling on top of that protects no one from fraud. It simply declares, by fiat, that a lawful business may not charge what it costs to operate.

The refund mandate is the real problem. A Bitcoin transaction is irreversible, and by the time a victim reports the scam the coins are gone, forwarded through the scammer's wallets within minutes. The operator never held them. Yet the law orders the operator to make the "customer" whole out of its own pocket. Our machines warn about fraud and irreversibility at several points in the flow, and we place live calls to flagged customers that repeat the warning out loud. The customer proceeds anyway, under their own verified ID, and the operator is then told to absorb a loss it did everything in its power to prevent. That does not make the operator a bystander to the fraud. It makes the operator its second victim.

Picture the same rule at a bank. A customer wires money to a scammer after ignoring every warning, and the state forces the bank to open its vault and pay the claim back, no questions asked. We do not do that to banks, because a payment an institution faithfully processed is not that institution's theft to repay. A blanket refund mandate is also an open door to abuse. It hands a dishonest claimant and a cooperating scammer a clean way to pull cash out of the operator, and it gives scammers a reason to steer victims toward the one cash-out that carries a money-back guarantee paid by somebody else.

None of this reaches the parties closer to the crime. The telecom that delivered the spoofed call owes nothing. The bank that released the cash owes nothing. The gift-card rack at the same counter owes nothing. Only the Bitcoin ATM operator, who verified the customer, warned them repeatedly, and lives on the sliver left after the banks take their cut, is singled out to eat the loss. That is not consumer protection. It is disparate treatment of a lawful business, and it is quietly strangling the ones that stay.

We can see it in our own operations. Since the new rules took hold, lawful volume in Wisconsin has fallen sharply and kiosks are quietly going dark, even as the fraud itself has not budged. The scammers simply moved to the rails the law left alone. What the law shrank was the legitimate business, and the access that came with it.

That access is the part worth mourning. The people who rely on these machines are often the ones the banking system already turned away, and for them a kiosk is the one place that turns cash into an asset they control. The fee looks high at the counter, but once the money is in Bitcoin, sending it across town or across the world costs almost nothing, which is more than a card network or a wire can claim.

So we are not writing because the law banned anything. We are writing because even Wisconsin's restrained version aims nearly all of its force at the operator and the cash-out. And the cash-out is the one place in the entire chain where the victim has already been defeated.

Follow the Money Backward

Trace one of these scams from the loss back to its origin and you pass through three sets of hands before you reach the criminal.

First, the kiosk. That is the last step, the one everyone legislates. Before that, the bank: every dollar fed into a Bitcoin ATM in one of these scams came out of a checking or savings account first. The victim stood at a teller window and withdrew cash, often an unusual amount, often while visibly nervous, often after being coached to lie about why. The bank touched the money before any kiosk did. And before the bank, the phone. The call, the text, the pop-up with a 1-800 number. That is where the crime is conceived and carried out. Everything downstream is a victim following instructions.

Now look at where the law has aimed its force. Almost entirely at the third hand, the smallest and newest and least politically protected one. Daily caps, fee limits, refund mandates, licensing, and in a handful of states an outright ban, all pointed at the cash-out point and none at the origination point.

The size of the mismatch is almost comic. Fraud losses at Bitcoin ATMs reached about $114 million in 2023, a real number growing fast, tenfold since 2020, and concentrated brutally on older adults, who absorbed roughly 71 percent of those losses at a median hit of $10,000.¹ Every one of those cases is someone's savings, and we take it seriously. But $114 million is a sliver of the roughly $16 billion Americans reported losing to fraud in 2025.³ When the FTC broke fraud down by how the money actually moved, crypto was not even the biggest rail. On government impersonation, business impersonation, romance, and family-impersonation scams, the exact categories that drive kiosk fraud, crypto ranked second. The costliest method was bank transfers.

So the rail that carries the most stolen money gets a lighter touch than the rail that carries a sliver of it. That should make a legislator uncomfortable.

The Layer Nobody Wants to Touch

Here is what the origination layer looks like, and why almost no state law goes near it. Americans received an estimated 52.5 billion robocalls in 2025, more than half of them scams or unwanted telemarketing, and the volume keeps climbing.⁴ Impersonation has been the single largest fraud category for five years running. The infrastructure that delivers those calls, spoofed caller ID that makes "Chase Fraud Prevention" light up a victim's screen, is run by telecom carriers, not by crypto companies.

There is a federal framework meant to fix this. It is called STIR/SHAKEN, and it is supposed to authenticate caller ID so a scammer cannot impersonate your bank's number. Its limits are by now well documented.⁵ It applies only to U.S. providers, so an overseas call center spoofing an American bank sails straight through. The FCC once traced more than 8 billion robocalls over four years to a single auto-warranty operation based in Panama, beyond its reach. It works only on modern IP networks, which leaves gaps. And it depends on carriers attesting honestly: in the Lingo Telecom case, a provider stamped its highest trust level on nearly 4,000 spoofed robocalls carrying a deepfaked voice of a sitting president.

The FCC does enforce. In August 2025 it removed more than 1,200 non-compliant voice providers from its mitigation database.⁵ But the blocking mechanics are clumsy, the worst actors sit offshore, and the spoofed "this is your fraud department" call still rings through to the seventy-year-old in Greenfield on the morning of the scam. That is the hour before the kiosk. It is where the crime actually happens, and it is governed by some of the largest, best-funded lobbies in Washington.

Now ask the obvious question. If you were a legislator who wanted to be seen doing something about fraud, and you could pick a fight with the telecom carriers, with the national banks, or with a few hundred crypto-ATM operators who have almost no lobbying muscle and a cloud of public suspicion already hanging over them, which fight would you choose?

The answer is written into the statute books. The chokepoint we regulate is not the one closest to the harm. It is the one with the least power to push back. Whether that is deliberate or just the path of least resistance barely matters, because the effect is the same. The parties who carry the call and release the cash get a pass, and the last machine in the chain gets the headline.

The same lopsidedness shows up in how the harm is counted, and in whether anyone is ever punished for it. The government asks consumers to report robocalls and scams, then makes doing so almost comically hard. The FTC has no public API for scam reporting, so an organization that has already identified thousands of fraudulent numbers has to file them the way a grandmother does: one complaint at a time, into a web form built in 2003, picking the hour and minute from drop-down menus.¹⁰ Scammers rotate thousands of spoofed numbers an hour, so a complaint filed by hand describes an attack that is already over. Data flows out of these agencies easily and cannot flow back in at scale, which guarantees the official picture is always last week's. Enforcement is no better: of roughly $208 million in FCC robocall fines announced since 2015, about $6,790 has actually been collected. The penalties, like the mandates, land everywhere except on the people placing the calls.

The Experiment Indiana Is Running

Indiana took the argument to its conclusion. In March 2026, House Enrolled Act 1116 banned virtual-currency kiosks outright, one sentence, no licensing, no limits, just a prohibition.⁶ Roughly 900 machines went dark immediately.

Set aside the businesses and the jobs for a moment and ask the only question that should matter to a lawmaker: did Indiana's fraud losses fall, or did they move? A scammer on the phone with a victim does not hang up when the Bitcoin machine disappears. The script simply changes. "Go to the Bitcoin ATM" becomes "buy $500 in gift cards at three stores," or "let me walk you through a wire transfer," or "download this app and send it by Zelle," or in the most brazen cases "put the cash in an envelope and a courier will come to your door." The FTC's own data shows gift cards, bank transfers, and payment apps sitting right there as substitutes, several of them carrying more fraud volume than crypto already.

If a kiosk ban produced a clean drop in total elder-fraud losses, that would be powerful evidence, and we would say so. If it produced a shift, the same victims and the same callers on different rails, then the ban protected no one. It relocated the loss and declared victory. That is the number every state considering a ban should demand before it votes, and almost none ask for it.

What We See at the Machine

We operate one of the largest Bitcoin ATM networks in the country, and we run its compliance in-house: identity verification, transaction limits, continuous sanctions screening, on-screen fraud warnings, live holds on suspicious activity, and refunds when a victim comes forward. We are not neutral observers. We watch this happen in our own transaction data, and we have learned where the ceiling is.

Here is the hard truth from the operator's side of the glass. The controls regulators love most are the ones a coached victim defeats most easily. Identity verification stops a scammer from reusing one account across many victims. It does nothing when the victim transacts under her own real ID, which is exactly what happens in an impersonation scam. She is not a launderer. She is a target doing what the voice on the phone told her to do. On-screen warnings get read aloud and then dismissed, because the scammer warned her in advance that the machine would "try to stop her," and that stopping was proof the threat was real. Limits slow a determined criminal and break the kiosk-hopping play, which is worth doing, but a limit is a speed bump on the cash-out. It is not a stop on the scam.

The one intervention that reliably works is a human on the phone before the money moves. Byte Federal places a live validation call to every flagged senior customer, and those calls stop 84 percent of attempted scams before the transaction completes.⁷ That number is the whole argument in miniature. What saves the victim is a conversation that interrupts the scammer's conversation. The machine's job is to create the pause; the save happens in the call.

Where the Fix Actually Lives

A quieter school of thought starts in the right place. Companies like PhoneShield.ai build their entire approach around a single premise: the phone is where fraud starts, so the phone is where you stop it.⁸ Screen the unknown call before the victim ever hears the script. Block the number already in the complaint databases, match the scam script even after the caller swaps numbers, and feed the call transcript upstream to the carrier traceback groups that can shut the originating provider down. Put a layer between the robocall and the grandmother, before the conversation that does the real damage can begin.

If you want fewer victims, you intervene in this order.

Stop the call. Enforce caller-ID authentication with real teeth, close the offshore gateway loophole, and hold carriers accountable for the spoofed impersonation traffic they deliver. The highest-leverage move is the one that keeps the scammer from ever reaching the target.

Slow the withdrawal. The bank is the second line, not the last. A sudden, out-of-pattern cash withdrawal by an elderly customer who seems rehearsed is a signal banks are well equipped to catch, and they touch the money before any kiosk does.

Guard the cash-out. Regulate the kiosk too. ID, limits that defeat kiosk-hopping, live interdiction, refunds for victims. This layer is real and we operate inside it. But it is the last net, not the first, and no serious fraud strategy should treat it as the main event.

Stop the call, slow the withdrawal, guard the cash-out, in that order, because that is the order in which the money travels. A law that only does the third thing is treating the symptom at the point farthest from the disease.

We are not against regulation. We live under it, we help the victims it is meant to protect, and we think Wisconsin's instinct to regulate rather than ban was the right one. But a policy that ends at the kiosk has decided, consciously or not, to leave the phone alone. And the phone is where the woman in Greenfield lost everything, an hour before she ever got in the car. If the goal is fewer victims and not fewer headlines, the mandates and the money have to move upstream to where the fraud begins. Until they do, every new kiosk law is a well-drafted answer to the wrong question.

---

Notes & Sources

1. Federal Trade Commission, Data Spotlight, "Bitcoin ATMs: A payment portal for scammers," September 2024. BTM fraud losses rose from $12M (2020) to $114M (2023) and topped $65M in the first half of 2024; adults 60+ accounted for ~71% of BTM losses at a median loss of $10,000; ~86% of BTM-loss reports involved government impersonation, business impersonation, or tech-support scams; crypto ranked second behind bank transfers on most impersonation categories. ftc.gov
2. PBS Wisconsin, "How much is Wisconsin's crypto ATM law limiting scams?" Act 226: $1,000 daily cap, fees limited to the greater of $5 or 3%, mandatory receipts and customer ID, and refunds for victims who report to law enforcement and the operator within 30 days; 700+ kiosks statewide; $5.4M reported lost to crypto scams in 2025. Detective Scott Simons, Greenfield PD, quoted. pbswisconsin.org. See also MinnPost coverage. minnpost.com
3. Federal Trade Commission, Consumer Sentinel Network fraud totals. Reported fraud losses reached record levels in 2025 (approximately $16 billion); the FTC notes actual losses are far higher because most fraud goes unreported. Figures as reported by the FTC and summarized in consumer-protection coverage.
4. Robocall volume estimates for 2025 (approximately 52.5 billion U.S. robocalls, more than half unwanted or fraudulent) as compiled by industry robocall trackers and cited by consumer scam-protection resources. Impersonation has been the FTC's top reported fraud category for five consecutive years.
5. FCC enforcement and STIR/SHAKEN coverage: the framework applies only to U.S. providers and modern IP networks; gateway and offshore traffic remain a gap (the FCC traced 8B+ robocalls over four years to a single Panama-based operation); the Lingo Telecom case involved A-level attestations on ~3,978 spoofed robocalls carrying a deepfaked presidential voice; in August 2025 the FCC removed 1,200+ non-compliant providers from the Robocall Mitigation Database. malwarebytes.com; FCC "Know-Your-Upstream-Provider" rulemaking, July 2026. federalregister.gov
6. Indiana House Enrolled Act 1116 (2026): "A person may not operate a virtual currency kiosk in Indiana." Signed March 9, 2026, with emergency clause; roughly 900 machines shut down. legiscan.com; iga.in.gov
7. Byte Federal internal compliance data. Byte Federal conducts live validation calls with flagged senior customers; these interventions stop approximately 84% of attempted scams before the transaction completes.
8. PhoneShield.ai, "Why the phone is where fraud starts." A call-screening approach that intercepts and triages unknown calls before they reach the user. PhoneShield is a startup launched with support from Byte Federal to confront phone fraud at its source, reflecting our conviction that the right place to stop a scam is before it ever reaches the victim, not at the last machine in the chain. phoneshield.ai
9. On debanking: crypto businesses, including Bitcoin ATM operators, have widely reported losing bank accounts or paying elevated fees, a pattern critics have termed "Operation Choke Point 2.0" that drew Congressional scrutiny in 2023–2024. On margins: public filings from Bitcoin Depot (Nasdaq: BTM), the largest listed U.S. Bitcoin ATM operator, disclose the thin net margins the sector runs on after banking, compliance, and cash-logistics costs.
10. PhoneShield, "The asymmetric war: why the government is losing to scammers." Documents the FTC's lack of a public scam-reporting API (consumers file one complaint at a time into a form-based system built in 2003), the mismatch against scammers who rotate thousands of spoofed numbers per hour, and enforcement data showing roughly $208M in FCC robocall fines announced since 2015 versus about $6,790 actually collected; it also notes that ~89.8% of calls from prolific robocall senders carried top-level STIR/SHAKEN attestation (March 2026). phoneshield.ai/academy/asymmetric-war