2026-09-20 · Illicit Finance
Two figures for 2025 crypto kiosk losses are in circulation, $333.5 million and $389 million, and they are usually printed as though somebody is wrong. Neither is. One is eleven months of the other, and the agency that published both says its own total overstates the machines’ role.
Key findings
- The FBI’s Internet Crime Complaint Center recorded 13,460 cryptocurrency kiosk complaints in 2025 with adjusted losses of $388,981,267, a 23% rise in complaints and a 58% rise in losses over 2024.
- $333.5 million and $389 million are not competing estimates. The lower figure is the through-November cut of the dataset that closes the year at the higher one.
- IC3 disclaims its own headline number, stating that overall losses “cannot be solely attributed to cryptocurrency kiosks” because complaints may involve other transaction types.
- At the top of the loss distribution, crypto is not the main rail. FTC data show that when an older adult lost more than $100,000 to an imposter scam in 2024, the most frequently reported payment method was a bank transfer, at 32%.
- Indiana banned the machines outright in House Enrolled Act 1116, signed 9 March 2026, and made the premises owner liable alongside the operator.
- The growth is in the tail, not the average. FTC reports from older adults losing $100,000 or more to imposter scams rose nearly sevenfold from 2020 to 2024, with combined losses up eightfold.
Case file
| Field | Value |
|---|---|
| Matter | Cryptocurrency kiosk fraud, United States, 2025 reporting year |
| Primary datasets | FBI IC3 complaint data; FTC Consumer Sentinel reports |
| IC3 complaints, 2025 | 13,460 |
| IC3 adjusted losses, 2025 | $388,981,267 |
| Change on 2024 | Complaints +23%, losses +58% |
| Losses, victims over 50 | Over $302 million, more than half of all complaints |
| Leading states | Texas 1,179 complaints / $56.8m; Florida 1,213 / $32.8m; California 978 / $24.0m |
| Statute | Indiana House Enrolled Act 1116, signed 9 March 2026 |
| Posture as of 3 August 2026 | Indiana ban in force. No federal statute enacted |
What the record shows
What is a cryptocurrency kiosk, and how does the scam work?
The FBI’s Internet Crime Complaint Center defines them plainly: “Cryptocurrency kiosks are ATM-like devices or electronic terminals that allow users to exchange cash and cryptocurrency.” [P]
IC3 describes the typical complaint it receives: “criminals give detailed instructions to individuals, including how to withdraw cash from their bank, how to locate a kiosk, and how to deposit and send funds using the kiosk.”
That sequence is the whole mechanism. The machine is the last step, not the first. Everything that matters has already happened by the time the victim is standing in front of it.
What are the actual 2025 numbers?
In 2025 IC3 received 13,460 complaints involving cryptocurrency kiosks, with adjusted losses of $388,981,267. That is a 23% increase in complaints and a 58% increase in losses over 2024.
More than half the complaints involved people over 50, with losses over $302 million.
By state, IC3 gives Texas 1,179 complaints and $56.8 million, Florida 1,213 complaints and $32.8 million, and California 978 complaints and $24.0 million. Florida leads on complaint count while Texas leads on losses by a wide margin, which means the average Texas loss is roughly $48,000 against roughly $27,000 in Florida.
Why two different totals are circulating
Coverage through late 2025 and 2026 cites $333.5 million for the year. Coverage from 2026 cites $388,981,267, or $389 million rounded. These are routinely set against each other as if two agencies had produced conflicting estimates.
They are the same dataset at two cutoffs. The $333.5 million figure is the FBI’s total through November 2025. The $388,981,267 figure is the full calendar year as published in the IC3 kiosk data release. There is no methodological dispute, no second agency, and nothing to reconcile. An article that presents them as rival numbers has invented a disagreement.
The caveat the agency attaches to its own figure
IC3 states that overall losses “cannot be solely attributed to cryptocurrency kiosks”, because a complaint counted in this dataset may involve other transaction types alongside the kiosk.
This matters because the number is used to justify statutes. The publishing agency’s position is that the total is an upper bound on kiosk-attributable loss rather than a measurement of it. Nothing in the dataset separates the two.
What the FTC data show about who is losing money and how
The Federal Trade Commission’s August 2025 Data Spotlight examines government and business imposter scams against older adults, which is the category most kiosk losses sit inside.
Between 2020 and 2024 the number of reports from older adults losing $10,000 or more to these scams rose more than fourfold: 1,790 in 2020, 3,516 in 2021, 5,559 in 2022, 7,091 in 2023, and 8,269 in 2024. For losses over $100,000, reports rose nearly sevenfold over the same period and combined reported losses rose eightfold.
Normalized for population, in 2024 losses of $10,000 or more were more than twice as likely to be reported by older adults than younger ones, and losses over $100,000 were three times as likely.
On payment method, among older adults reporting losses of $10,000 or more in 2024:
| Payment method | Share of reports |
|---|---|
| Cryptocurrency | 33% |
| Bank transfer | 20% |
| Cash | 16% |
| Gold (written in) | about 5% |
The FTC notes that most reports identifying cryptocurrency as the payment method mentioned Bitcoin ATMs in the narrative.
The distribution changes at the top. When losses exceeded $100,000, bank transfer was the most frequently reported method, at 32%, and gold was written in on about 21% of those reports.
The scam depends on a phone call
The FTC records that in 2024, 41% of older adults losing $10,000 or more to these scams said a phone call was the initial contact, 15% an online advertisement or pop-up, and 13% an email. It observes that even when the approach does not begin with a call, the goal is to get the target onto the phone, because a call sustains urgency and keeps the person from consulting anyone else. [P]
The agency groups the opening stories into three: someone is using your accounts; your information is being used to commit crimes; there is a security problem with your computer. It also records that scammers impersonate the FTC itself, sometimes using the names of real staff, and instruct people to deposit cash into Bitcoin ATMs.
What Indiana did
Indiana House Enrolled Act 1116 was signed by Governor Mike Braun on 9 March 2026, prohibiting the operation of virtual currency kiosks in the state and making a violation actionable under the Indiana Deceptive Consumer Sales Act. Reported as the first outright state ban.
The enforcement design is the part worth noting. The attorney general may act against the kiosk operator and against the owner of the premises where the machine sits, if that owner knowingly or intentionally permitted the violation. A knowing violator may be ordered to forfeit the charges assessed to users during the violation period, the kiosks themselves, or both.
Cite as: Max Avery, “The crypto ATM numbers everyone cites are the same number twice”, maxavery.org, 20 September 2026. Primary sources: FBI IC3 cryptocurrency kiosk complaint data for 2025; FTC Data Spotlight, August 2025.
What I think is going on
I want to separate two things that keep getting welded together: the machines are a genuine problem, and the case being made against them is sloppy in ways that will produce bad law.
Start with the number. A $389 million figure, growing 58% in a year, is doing heavy political work right now. It is in the Indiana debate, it is in every state bill, and it is in the AARP coverage. The agency that published it says in the same document that the losses cannot be solely attributed to the kiosks. That is not a footnote. It means the headline figure counts complaints where a kiosk appeared somewhere in a scam that also moved money by other means, and nothing in the dataset tells you how much of the $389 million actually went through a machine.
Then look at what happens as the losses get larger. At $10,000 and up, crypto leads at 33% and most of those mention Bitcoin ATMs. Above $100,000, the leading method is a bank transfer at 32%, and gold appears on roughly a fifth of reports. The largest thefts from older people in this category are not going through crypto kiosks. They are going through wire transfers from bank branches, and through couriers collecting metal from doorsteps.
That inverts the policy story. If your objective is to stop the biggest losses, banning kiosks addresses the tail least well. A kiosk has a cash-in limit, a fee, and a physical queue. Moving $400,000 through one is impractical, which is precisely why the six-figure losses go by wire.
So why do the machines attract the legislation? Because they are legible. There are about 800 of them in Indiana, they belong to a small number of identifiable companies, none of those companies is a bank, and banning them costs a legislature nothing politically. Restricting how a bank executes a customer’s own wire instruction costs a great deal and reaches the larger harm. I understand entirely why Indiana did the first thing. I do not think anyone should describe it as addressing the $389 million.
The FTC’s own framing is closer to the truth than the enforcement response is. Read the three opening lies and notice that not one of them is about cryptocurrency. Somebody is using your accounts. Your information is linked to a crime. Your computer is compromised. The payment rail is chosen at the end, by the criminal, for convenience. Ban the convenient rail and the next call directs the victim to a bank counter, which is where the largest losses already go.
There is one detail in the FTC material I keep returning to. The scammers impersonate the FTC. They use the names of real staff at the consumer protection agency, and they tell people to feed cash into Bitcoin ATMs to keep it safe. The defense the agency offers against this is that the real FTC will never ask you to do that, which is true and which requires the target to already know what the real FTC does. The people being called are, by the FTC’s own data, the group reporting the largest losses, and the attack works precisely because they are conscientious. Vigilance is the vulnerability being exploited. That is a hard thing to legislate against and an easy thing to be sanctimonious about afterward.
My view on where this lands: kiosk bans will spread, because they are cheap and the number is scary, and they will move a modest share of losses onto other rails without reducing the total much. The measurable effect will show up as a fall in the kiosk line item and no fall in the imposter-scam line item, and that will be reported as a success.
What reduces your exposure
This is a targeting problem rather than a structure problem, and I am not going to pretend otherwise. No entity, trust, or custody arrangement stops a person from being talked into withdrawing their own cash and feeding it into a machine. The useful answers are procedural and they are about the phone.
The rule that defeats the entire category is one sentence: nobody legitimate will ever ask you to move money to protect it. No bank, no police force, no tax authority, no regulator. There is no version of a real security problem whose remedy is you personally transferring funds somewhere. If a call reaches that instruction, the call is the fraud, regardless of how much the caller already knows about you.
Hang up and dial a number you found yourself. Not the number they gave you, not the number in the pop-up, not the number in the email. The FTC’s advice is exactly this, and it works because the attack depends on keeping the target on one continuous call.
Install a delay you cannot talk your way out of. For anyone with substantial assets and an older parent, the practical intervention is a standing agreement that any transfer over an agreed figure waits until a named second person has been reached, in person or on a number they already have. Not a permission, a delay. The scam’s whole operating requirement is that the victim never gets off the phone and never speaks to anyone calmer.
Watch the bank counter, not the kiosk. If the concern is a six-figure loss, the FTC data say the exposure is a wire transfer, not a crypto machine. Ask the bank what its own callback and hold procedures are for large outbound wires initiated by customers over 60, and whether they can be set tighter on a specific account.
None of this reduces the chance of the call arriving, and a determined operator can work around a delay given enough sessions. It removes the single condition every one of these scams depends on, which is speed.
Sources
- FBI Internet Crime Complaint Center, cryptocurrency kiosk complaint data by state, PSA reference PSA260515-2. https://www.ic3.gov/PSA/2026/PSA260515-2
- Federal Trade Commission, Data Spotlight, “False alarm, real scam: how scammers are stealing older adults’ life savings”, August 2025. https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2025/08/false-alarm-real-scam-how-scammers-are-stealing-older-adults-life-savings
- Federal Bureau of Investigation, “Cryptocurrency and AI Scams Bilk Americans of Billions”. https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions
- Indiana General Assembly, House Bill 1116 (2026), “Virtual currency kiosks”. https://iga.in.gov/legislative/2026/bills/house/1116
- National Law Review, “Indiana Law Prohibits Virtual Currency Kiosks”. https://natlawreview.com/article/indiana-prohibits-virtual-currency-kiosks
Related on this desk
- What laundering crypto actually costs you, according to five sentences — what the state does to the people who move this money once it catches them.
- United States v. Chen Zhi: how 127,271 bitcoin became the largest forfeiture — the industry on the other end of the phone call.
- Mirror Trading International: 29,421 bitcoin and a trading bot that never existed — the fake balance, which is the mechanism every one of these schemes depends on.
Disclosure. Max Avery is affiliated with Digital Ascension Group (DAG). Investment advisory services are offered through DAG Wealth, an SEC-registered investment adviser (CRD No. 328627). Registration does not imply a certain level of skill or training. DAG is not a law firm and does not provide legal or tax advice. Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. Nothing here is investment, legal, or tax advice, or a recommendation to buy or sell any asset. This article describes matters of public record; charges are allegations and defendants are presumed innocent unless and until proven guilty.