Crypto ATM and QR Code Scams: Why Kiosk Payments Are a Favorite Pressure Tool
A guide to crypto ATM and QR-code payment scams, including how scammers coach victims, why older adults are often targeted, and what to do before scanning.
Key takeaways
- Crypto ATM payments can be irreversible once the transaction broadcasts.
- Scammers often keep victims on the phone or chat while they stand at the kiosk.
- A QR code is just a payment instruction; it does not prove who receives the funds.
The pressure pattern
In a crypto ATM scam, the victim is often told there is an emergency: a bank problem, law-enforcement issue, account compromise, investment deadline, tax issue, or family crisis. The scammer keeps the victim moving so they do not pause and ask for help.
The victim may be instructed to withdraw cash, drive to a kiosk, scan a QR code, and feed bills into the machine. The QR code sends crypto to a wallet controlled by the scammer. Once confirmed on-chain, the transaction is usually difficult to reverse.
Why QR codes are dangerous in scams
A QR code can hide the actual wallet address from the victim. The victim sees a square pattern, not the recipient identity, ownership, or platform legitimacy. A scammer can claim the code belongs to a bank, government agency, exchange support team, or secure wallet, while it actually points to their own address.
The FBI 2025 IC3 report listed crypto ATM and kiosk complaints separately, reporting 13,460 complaints and $389 million in losses. People over 60 reported the largest losses in that category.
Before scanning
No legitimate government agency, bank, exchange, or law-enforcement officer will require you to pay through a crypto ATM to fix an urgent problem.
How scammers coach victims
Scammers may tell victims to ignore kiosk warnings or lie to employees. They may say the warnings are only for other people, that the transaction is private, or that staff will block a legitimate security process. They may also tell victims to split payments across multiple machines.
This coaching is itself a red flag. A legitimate financial process does not require secrecy, panic, or scripted answers.
What to do if you already paid
Save the receipt, transaction hash, wallet address, kiosk location, time, phone number, chat logs, and any QR code image. Contact the kiosk operator immediately and report the transaction. Also report to IC3 and local law enforcement.
Do not pay a recovery agent who says they can reverse the transaction for an upfront fee. That is a common second-stage scam.
