FBI: Americans lost over $388 million to scams using crypto ATMs in 2025

The FBI says Americans have lost over $388 million last year to scams using cryptocurrency kiosks, also known as crypto ATMs or Bitcoin ATMs.

Cryptocurrency kiosks are physical, standalone electronic terminals (which may or may not require identity verification to prevent money laundering) that resemble bank ATMs and allow users to buy or sell crypto assets using cash or debit cards.

They are often found around gas stations, convenience stores, and other easily accessible locations. Cybercriminals ask potential victims to deposit their cash into crypto kiosks that then transfer the funds to attacker-controlled crypto wallets.

Earlier this month, Minnesota lawmakers banned cryptocurrency kiosks statewide, after similar moves from Indiana in March and Tennessee in April.

In a public service announcement published on Friday, the bureau warned of a nearly 60% surge in reported losses to crypto ATM scams compared with the previous year.

"In 2025, the IC3 received more than 13,400 complaints reporting the use of cryptocurrency kiosks, with losses over $388 million — a 23% increase in complaints and a 58% increase in losses from 2024. More than half of the complaints involved individuals over 50, with losses over $302 million," the FBI said.

"In typical IC3 complaints involving cryptocurrency kiosks, criminals give detailed instructions to individuals, including how to withdraw cash from their bank, how to locate a kiosk, and how to deposit and send funds using the kiosk."

According to complaint data and adjusted losses shared by the FBI, Americans from Texas, Florida, and California filed over 3,300 crypto ATM scam complaints and reported over $112 million in estimated losses.

The FBI also shared some measures that anyone can take to protect themselves from falling victim to such scams, including not sending money to people you only know online, never scanning QR codes or following payment instructions from unknown individuals, always verifying phone calls directly, and not sharing any personal information over the phone.

It also recommended being wary when anyone claiming to be from the government or law enforcement demands cryptocurrency payments, stopping transactions if a kiosk operator warns you of fraud, and always keeping receipts for cryptocurrency transactions.

The FBI's 2025 Internet Crime Report says the law enforcement agency received over 1 million complaints through its Internet Crime Complaint Center (IC3) last year, linked to almost $21 billion in losses from cyber-enabled crimes such as investment scams, tech support fraud, and business email compromise.

The Validation Gap: Automated Pentesting Answers One Question. You Need Six.

Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.

This guide covers the 6 surfaces you actually need to validate.

Download Now