Cash in, fraud out: Criminals target bitcoin ATMs as crypto popularity surges
- As the number of bitcoin ATMs around the country skyrockets, criminals have increasingly used the machines in schemes including money laundering and drug trafficking.
- The ease of transactions and relative anonymity allowed when using them has contributed to abuses of the ATMs.
- Some in the industry are pushing for uniform standards to prevent crime amid a patchwork of rules and state laws.
Criminals are cashing in on bitcoin ATMs around the country, using the convenient, largely anonymous transactions for drug trafficking, money laundering and a variety of fraud, law enforcement officials say.
The machines, mostly located in convenience stores and owned by private companies, allow customers to easily buy bitcoin and other cryptocurrencies using cash. The funds are then sent to that customer's crypto wallet.
But that convenience also means easy money for fraudsters.
The fraud, according to law enforcement, has become more pervasive as bitcoin ATM installations in the U.S. have skyrocketed in recent years. More than 26,000 machines stand today, a spike from 4,212 in January 2020, according to Coin ATM Radar. Well-known companies such as Walmart and Circle K have started installing them.
The FBI warned last week of fraud schemes using cryptocurrency ATMs and quick response, or QR, codes to facilitate payments.
"The FBI has seen an increase in scammers directing victims to use physical cryptocurrency ATMs and digital QR codes to complete payment transactions," the bureau said in a public service announcement. QR codes can be used at the crypto ATMs to direct payments to intended recipients.
Here's how this particular fraud works, according to the FBI: "The scammers provide a QR code associated with the scammer's cryptocurrency wallet for the victim to use during the transaction. The scammer then directs the victim to a physical cryptocurrency ATM to insert their money, purchase cryptocurrency, and use the provided QR code to auto-populate the recipient address."
One state has recently targeted the lack of oversight of the machines.
"There are scams, there's fraud," said Lisa Cialino, counsel for the New Jersey State Commission of Investigation. "The most alarming thing is that there are owners and operators of these machines that truly know nothing about what they should be doing under the Bank Secrecy Act."
Bitcoin ATM operators are required to register with the U.S. Treasury Department's Financial Crimes Enforcement Network. However, an investigation by the New Jersey commission released earlier this year found actual regulation was lax, which is similar to many states.
"Many machines permit near anonymity on purchases of up to $900 worth of cryptocurrency by allowing users to provide only a cellphone number," the commission's report said. "Some require no identifying information at all."
That's alarming to law enforcement officials, who told CNBC that the ATMs are being used for a wide range of criminal activity. Drug traffickers, money launderers and people trying to get unwitting victims to send money to a crypto wallet have employed the machines. A 2020 DEA report warned the ATMs can "aid in the movement of illicit bulk currency."
Criminals appear to have an easy time exploiting the ATMs, Cialino told CNBC.
"It seems like it's very simple because a lot of these machines aren't collecting information on the person doing the transaction," she said.
The New Jersey commission's report found more than $70 million deposited for cryptocurrency purchases in the state between 2015 and 2020.
Marc Grens, president of Chicago-based bitcoin ATM operator DigitalMint, said the report's findings mirror what his company discovered when it investigated where some crypto transactions ended up.
"It leads us to believe, based on our due diligence, that these exchanges are great havens for those who are scamming an individual in the United States to send the fund out of the U.S. borders, that allows them to sort of claim the money and get full control over it," he said.
Just this month, state police in Pennsylvania warned of a bitcoin scam in which people would receive text messages about unauthorized charges on their PayPal account, get asked for personal information, and then be told to buy bitcoin at an ATM and send it to someone.
A study by Chainalysis found nearly 75% of all illicit funds leaving the ATMs wound up being used at fraud shops, sites on the dark web that sell stolen credit card information.
In an effort to crack down on fraud and establish universal compliance standards, DigitalMint recently launched a Cryptocurrency Compliance Cooperative.
The consortium was "put together by like minds in this space, in traditional financial services, blockchain forensics companies, banks and other bitcoin ATM organizations that wanted to create a universally accepted standard to improve the industry," Grens said.
"There is crime. It's never going to stop. This is just a new medium that has happened and that is happening, and we have real data that it is happening. And we want to work together to stop it," he added.
Grens said companies should not allow transactions with just a phone number for up to $900.
Executives at CoinFlip, another major crypto ATM operator based in Chicago, say the $900 threshold is not an issue. The company allows crypto purchases of up to $900 with just a name and phone number. Higher amounts require additional identification.
CoinFlip CEO Ben Weiss said the company has a risk-based tier approach depending on the amount of crypto a customer buys.
"At every single level, there's additional pieces of KYC [know your customer] that are required," he said.
In addition, Weiss said the company uses blockchain analytics tools to detect fraud. Crypto wallets associated with nefarious activity are blocked.
"The same way it shows where bitcoin is going, it also shows where bitcoin is coming from. That's the cool thing about bitcoin being a public ledger," he said.
Weiss said asking for just a phone number for transactions below $900 allows more potential customers to buy crypto.
"You have to have an approach an AML [anti-money-laundering] KYC approach that's commensurate with the risk, and for lower transactions, we don't want to disenfranchise people," Weiss said. "We want everyone to be able to buy $50, $100, $200 of bitcoin, regardless of their immigration status and regardless if they have an ID."
Weiss said that "everyone in the industry, especially us, want to do our part to make sure this is the cleanest industry possible."
Kris Dayrit, president of CoinFlip, said customer service agents are trained to spot red flags such as a customer getting coerced into a transaction.
Other bitcoin ATM companies say they take anti-fraud measures seriously.
Doug Carrillo, co-founder and chief strategist at Bitstop, said that "like any industry there are bad apples. ... Many ATMs will let you buy anonymously, you know, with no identification."
He said the ATMs have simply allowed fraudsters to branch out.
"That is no different than bad actors in the check cashing space, the money transmission space, MSBs [money service businesses] that run scams on a weekend, collect money from people and disappear," Carrillo said.
Brandon Mintz is CEO of Atlanta-based Bitcoin Depot, the country's largest ATM network. The company announced a partnership with Circle K to install kiosks in stores.
Mintz said the relatively new industry has left the door open for loose standards.
"Regulation, to a certain extent, is good," Mintz said. "Regulation that prevents innovation is not good. So we feel right now that there are other companies out there who are not even close to our standards and they're flying under the radar for now. Now over time, we imagine things will get cleaned up and based on enforcement actions, they'll be forced to comply with hopefully the level where we are at today."
High-profile enforcement actions have followed the proliferation of bitcoin ATMs. They include a guilty plea last year by a California man who laundered millions of dollars of bitcoin and cash through unlicensed ATMs, according to the U.S. Attorney's Office for the Central District of California.
Regulations vary on the state level. For example, New York's Department of Financial Services requires businesses or individuals engaged in any virtual currency activity to obtain a BitLicense.
Nevada does not have a specific regulatory carve-out for cryptocurrency, but if an entity serves as a digital custodian of any form of digital currency, the business may be regulated as a trust company.
In contrast, New Hampshire and Wyoming have laws specifically exempting virtual currencies from their money transmission statutes, according to the National Conference of State Legislatures.
Following the commission's report in New Jersey, a bill is pending that would regulate digital asset activity. It would require operators to get a license from the state Department of Banking and Insurance.
"That's a big industry and for the state to have absolutely no handle or control over is crazy," Cialino said.
— CNBC's Nadine El-Bawab and Angelica Serrano-Roman contributed to this report.
Please email tips to investigations@cnbc.com