Scammers exploit bitcoin ATMs. Will new California laws help crack down on fraud? (2024)

Jim Meduri answered a terrifying phone call in January from a man pretending to be his son.

The caller, who sounded on the verge of tears, said he’d been in a car accident. Meduri was convinced his son had been arrested for driving under the influence and injuring a pregnant woman and her daughter.

The San Jose resident later spoke to people impersonating a defense attorney and a courthouse clerk, who told him his son might be sent from the Bay Area to Nevada because of an mpox outbreak at the jail. Panicked and in a rush, Meduri agreed to send bail money through cryptocurrency. The fake lawyer directed Meduri, 65, to an ATM where people can buy the digital currency bitcoin. He inserted $15,000 in cash into the machine, scanned a code provided by the scammers and transferred the money.

When Meduri realized he’d been duped, his money was gone.

“They played on fear and what a parent would do to help their kid, and it was elaborate,” said Meduri, who was able to get most of his money back with help from the Santa Clara County district attorney’s office.

Meduri’s misfortune is just one example of how scammers are using bitcoin ATMs to swindle victims out of thousands of dollars, fraud that law enforcement officials warn is on the rise.

The machines, in convenience stores, gas stations and even bakeries, are an easy way for people to buy cryptocurrency quickly with cash, which is harder to track than a wire transfer or check. As scammers exploit the convenience these machines provide, bitcoin ATMs are also attracting the attention of lawmakers, regulators and consumer advocacy groups looking to protect people from fraud and exorbitant fees.

Starting in January, California will limit cryptocurrency ATM transactions to $1,000 per day per person under Senate Bill 401, which Gov. Gavin Newsom signed into law. Some bitcoin ATM machines advertise limits as high as $50,000. The new law also bars bitcoin ATM operators from collecting fees higher than $5 or 15% of the transaction, whichever is greater, starting in 2025. Legislative staff members visited a crypto kiosk in Sacramento and found markups as high as 33% on some digital assets when they compared the prices at which cryptocurrency is bought and sold. Typically, a crypto ATM charges fees between 12% and 25% over the value of the digital asset, according to a legislative analysis.

“This bill is about ensuring that people who have been frauded in our communities don’t continue to watch our state step aside when we know that these are real problems that are happening,” said state Sen. Monique Limón (D-Goleta), who co-authored the bill.

Although similar scams have existed long before the rising popularity of cryptocurrency, the use of these digital assets by fraudsters has been increasing, according to the Federal Trade Commission. Since 2021, more than 46,000 people reported losing over $1 billion in crypto to scams, the agency reported in 2022.

Victims of bitcoin ATM scams say limiting the transactions will give people more time to figure out they’re being tricked and prevent them from using large amounts of cash to buy cryptocurrency. But crypto ATM operators say the new laws will harm their industry and the small businesses they pay to rent space for the machines. There are more than 3,200 bitcoin ATMs in California, according to Coin ATM Radar, a site that tracks the machines’ locations.

“This bill fails to adequately address how to crack down on fraud, and instead takes a punitive path focused on a specific technology that will shudder the industry and hurt consumers, while doing nothing to stop bad actors,” said Charles Belle, executive director of the Blockchain Advocacy Coalition.

While California lawmakers have striven to balance the need to support the cryptocurrency industry and protect consumers, recent legislation has hewed toward tighter state regulation. Another law would by July 2025 require digital financial asset businesses to obtain a license from the California Department of Financial Protection and Innovation.

When signing the legislation, Assembly Bill 39, Newsom included a message that said the law needed further refinement to provide clarity to consumers, businesses and state regulators.

“It is essential that we strike the appropriate balance between protecting consumers from harm and fostering a responsible innovation environment,” he wrote.

In 2022, months before the collapse of cryptocurrency exchange FTX, Newsom vetoed a similar bill that would have required cryptocurrency companies to get a state license, citing concerns a new regulatory program would be costly and the actions were premature.

Erin West, a Santa Clara County deputy district attorney who helped Meduri recover his money, said scammers turn to bitcoin ATM machines because they accept large amounts of cash. The value of bitcoin can also rise, giving fraudsters a way to increase their plunder.

Scammers use different tactics to trick people into handing over their money, including creating a false sense of urgency and winning over their trust. Some befriend or seduce their victims through social media or dating apps, luring them into a web of lies that include fake emergencies. Other times, the scam starts with a text message directing victims to a fake cryptocurrency investment site.

West said her team has been able to recover $2.5 million for scam victims like Meduri by tracking down the cryptocurrency exchange that was involved in the transaction. After Meduri put $15,000 into a kiosk operated by Bitcoin ATM Services, the digital money ended up in the cryptocurrency exchange Binance. The exchange complied with a search warrant, allowing her team to retrieve the stolen funds from Binance and return them to Meduri.

Although it’s possible for cryptocurrency victims to get their money back even if it travels overseas, West said it’s rare. Some cryptocurrency exchanges are more cooperative with law enforcement than others, she said.

“This whole thing is a speed game,” said West, who is part of a task force called REACT — Regional Enforcement Allied Computer Team — that combats high-tech crimes. “Can we get the victim in front of a competent investigator who knows how to find things on the blockchain in the least amount of time?” Blockchain is a type of shared digital database that stores information about crypto transactions.

An 80-year-old retired teacher in Los Angeles, whom The Times previously interviewed, said she hasn’t been able to recover $69,000 she sent to scammers through a bitcoin ATM over multiple days in May. The stolen funds ended up in Seychelles-based cryptocurrency exchanges KuCoin and Huobi.

The scam started when Mrs. K, who wants to remain anonymous because she’s more wary about giving out her personal information, got a loud pop-up alert that her computer was infected with a virus. After calling a fake tech support number and later talking to a person impersonating the FBI, Mrs. K thought her Chase bank account had been taken over by foreign Chinese hackers involved in a child p*rnography case. To keep up the elaborate ruse, the scammers also sent Mrs. K fake Chase bank emails.

“If it wasn’t this convoluted mishmash, I probably would have been a little smarter and not fallen into this trap,” Mrs. K said. “I feel so disappointed in myself that I just fell hook, line and sinker.”

Mrs. K said the FBI impersonator told her to withdraw $75,000 in cash over three days from her Chase checking account and not tell anyone. If workers at the bank asked, the scammer told Mrs. K to say that she was withdrawing cash for construction.

The FBI impersonator convinced Mrs. K she could help law enforcement catch the child predators if she converted the cash to cryptocurrency and transferred the funds to a digital wallet the agency would monitor. The intricate lie eventually led Mrs. K to a Coinhub Bitcoin ATM machine at a doughnut shop in Highland Park that accepts up to $25,000 in cash daily per person.

By the time she realized it was a scam, Mrs. K had sent $69,000 to the fraudsters. She reported the crime to police but hasn’t been able to recover her money.

Under federal law, bitcoin ATM operators are typically considered money services businesses, so they’re required to register with the U.S. Department of Treasury’s Financial Crimes Enforcement Network, or FinCEN. The agency collects and analyzes financial information to combat money laundering and other illegal uses. The businesses must also maintain an anti-money-laundering program and report suspicious activity to the agency.

Logan Short, the chief executive of LSGT Services, which does business as Coinhub Bitcoin ATM, said in an email the company does “everything in its power to protect consumers, but unfortunately fraud is not 100% preventable in any industry.” The Las Vegas company is registered with FinCEN but faced allegations that it operated crypto ATM machines in Connecticut without the required state license.

Bitcoin ATM Services, which operates the kiosk used by Meduri, says on its website that it is registered with FinCEN. The Times couldn’t find a record of Bitcoin ATM Services being registered as a money services business with FinCEN. A company called Cash ATM Services that has the same mailing address as Bitcoin ATM Services was registered. Bitcoin ATM Services did not respond to a request for comment.

Law enforcement has cracked down on unlicensed crypto ATMs,but it can be tough for consumers to tell how serious the industry is about addressing the concerns. In 2020, a Yorba Linda man pleaded guilty to charges of operating unlicensed bitcoin ATMs and failing to maintain an anti-money-laundering program even though he knew criminals were using the funds. The illegal business, known as Herocoin, allowed people to buy and sell bitcoin in transactions of up to $25,000 and charged a fee of up to 25%.

Cryptocurrency regulations vary by state. California has long exempted crypto ATMs from licensing requirements for businesses engaged in money transmission.

Crypto ATM machines serve people who don’t have a bank account or just want the convenience of buying cryptocurrency at a gas station, convenience store or other shop, said Ayman Rida, CEO of Cash2Bitcoin, who works with cryptocurrency ATM operators including in California on complying with state regulations. The fees ATM charge are higher than online exchanges, he said, to cover certain expenses. That includes the cost of leased space, machine maintenance and cash management.

Crypto ATM operators aren’t opposed to having clearer rules and guidelines, he said, but they are against capping fees and transactions. Crypto ATM operators typically require more forms of identification if a customer makes a transaction of more than $1,000, and in some cases flag high-value transactions, which could help stop scammers.

“Scammers are getting smarter,” he said. “My question for the regulators is, why are you killing an industry when scams also happen to other industries but they’re not doing anything about it as well?”

As for Meduri, he’s just relieved his son wasn’t really arrested and in a car accident. Oddly enough, finding out it was all an elaborate lie came with a sense of relief.

“My wife and I were just wrecked that day,” he said. “I didn’t even care. I was happy he was OK.”