Organized Crime and Corruption Reporting Project

When Anne received an urgent email from an apparent Federal Trade Commission agent alleging there was a demand for payment and a warrant out for her arrest over fraudulent purchases, she nervously shared her phone number with the sender.

The 77-year-old followed instructions she received by text message to pay $9,000 in cash into an ATM at a gas station near her home in Chicago.

But the machine where she placed her money wasn’t a normal ATM connected to a bank — instead, it was what’s known as a crypto ATM, an increasingly common type of kiosk that converts cash into cryptocurrency.

Tucked away in low-key locations like gas stations, vape shops, and laundromats, crypto ATMs are touted by operators as an easy way to change cash to crypto. However, experts say crypto ATMs have become a vehicle for international criminal enterprise, and that millions of dollars’ worth of fraud is carried out using the machines in the U.S. alone.

A consumer tests a crypto ATM machine in a Latin bodega (corner store) in Asheville, N.C. on July 5th, 2024. (Photo: Kevin Hall/OCCRP)

In Anne’s case, her money disappeared into a wallet connected to an offshore crypto exchange within minutes, according to forensic experts who examined the incident for OCCRP. She has never recovered her money.

“I just can’t wrap my head around someone being so devious and so evil to do this to somebody who’s older who has worked all their life to try to provide for themselves and for their family,” Anne’s daughter said. OCCRP is using a pseudonym for Anne at the request of her family.

A small number of crypto ATMs allow users to sell bitcoin and take out cash, but the majority only convert cash to crypto. The machines have less stringent identification requirements than online crypto exchanges — and, as in Anne’s case, they allow large amounts of cash to be stolen long before law enforcement has even been notified about a scam. Inconsistent regulations across U.S. states and historically strained resources for fighting financial crimes exacerbate the issue.

(Photo: Edin Pašović/OCCRP)

The FBI, in its first public national estimate of the scope of the problem, told OCCRP that losses in the U.S. from scams carried out via crypto ATMs exceeded $120 million in 2023. And those numbers don’t even capture the national security and money-laundering risks associated with these hard-to-track transactions.

The U.S. Secret Service, which investigates illicit activity involving payment systems, told OCCRP it had found “transnational criminal networks that aim to exploit the United States’ financial systems often operate out of countries that lack legal agreements with the United States.”

“The Secret Service is committed to identifying, disrupting, and dismantling those networks,” the statement said.

A United Nations report from 2023 painted a broader picture of how online scams — from illegal gambling to crypto fraud — were linked to international human trafficking, estimating that more than 200,000 people in Myanmar and Cambodia may be held in situations where they are forced to carry out internet fraud.

A Financial Trends Analysis report from the U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) in February said it had received more than 2,300 reports from financial institutions referencing cryptocurrency in connection with human trafficking and child sexual exploitation in 2020 and 2021. Seventeen of those reports involved crypto ATMs, also known as crypto kiosks.

The ability of scammers to cover their tracks — especially when they’re based overseas — is a major challenge for U.S. investigators.

Matthew Hogan, a Connecticut State Police detective specializing in crypto investigations, said organized fraudsters who contact U.S. victims and convince them to pay cash into crypto ATMs tend to be based in Southeast Asia, India or West Africa, and that Ukrainian and Russian nationals have also been involved.

Hogan added that while crypto movements can be easier to follow than cash transfers because they use open source blockchain technology, scammers employ a variety of obfuscation tactics to make them hard to trace, such as “bridges” which transfer assets between different blockchain networks.

Erin West, a deputy district attorney in Santa Clara County, California, who specializes in cryptocurrency scams, said the crypto exchanges that ultimately receive money generated by fraud tend to be located offshore and do not have to cooperate with U.S. authorities. While some are now opting to do so, others are not. “There’s always going to be an exchange that will pull dirty money,” she said.

In the new figures supplied to OCCRP, the FBI said it had received more than 4,300 complaints in 2023 related to cryptocurrency ATMs. The FBI’s recent Elder Fraud report cited more than 2,000 complaints last year from people aged 60 or older saying they were victims of fraud involving crypto ATMs.

Hogan said only around 10 percent of reported cases get some amount of restitution.

However, while cases of individual fraud can be hard to prosecute, a handful of major convictions in U.S. courts indicate the potential scale of crypto ATMs’ role in broader criminality.

The most prominent was the case of Victoria Jacobs, jailed for 18 years in April after a jury trial in New York City for funneling $18,000 to a tactical training group that supports Syria’s Hay’at Tahrir al-Sham, designated as a foreign terror group by the State Department. She used a crypto ATM in the heart of the city as part of the scheme.

Victoria Jacobs caught on camera by the Police department City of New York. (Photo: Police department city of New York)

A month later, Robert Taylor was convicted by a New York State Supreme Court jury for running a network of more than 40 unlicensed crypto ATMs out of laundromats in the city. He is awaiting sentencing. The Manhattan DA described his machines, which were marketed as providing complete anonymity to users, as “intentionally targeted toward criminal clientele.”

Prosecutors said Taylor converted more than $5.6 million in cash into cryptocurrency via his clandestine network and investigators found $250,000 in cash in his apartment. He also had operations in New Jersey and Miami.

Taylor was charging up to 20 percent in fees for transactions carried out on his machines, as was former Bitcoin of America CEO Sonny Meraban, who was convicted last year for violating licensing requirements on his network of crypto ATMs in Ohio and benefiting from scams carried out at his machines.

Headshot of Sonny Meraban, former Bitcoin of America CEO. (Photo: Cuyahoga County Sheriff’s Department)Meraban, who was arrested in Miami, was sentenced to five years of probation and forfeited assets including the equivalent of $3.9 million in Bitcoin at the time and a cigarette speedboat.

Prosecutors said that Bitcoin of America had annual nationwide transaction volumes of at least $250 million in 2022, keeping $50 million of the money moved as fees.

The ATM where Anne, the elderly Chicago woman, was instructed to place her cash was owned and operated by Bitcoin of America. The company announced it had ceased operating in March 2023 and warned impostors were using its name and logo.

According to industry database CoinATMRadar, which compiles figures provided by ATM operators, thereare more than 31,000 crypto ATMs in the U.S. and almost 7,000 more around the world. The majority were installed in 2021 and 2022 as cryptocurrency prices reached all-time highs.

Under federal law, operators of crypto ATMs must register with the Treasury Department’s FinCEN, which obliges them to monitor activity on their machines and report anything suspicious. Apart from that, regulations for operators are set at state level. Some states explicitly require crypto ATM operators to obtain a money transmitter license. Others, like Illinois, don’t consider cryptocurrency to be money because it isn’t issued by a government.

Felix Shipkevich, a New York-based attorney specializing in cryptocurrency and money transmitter law, said state regulators are stretched for resources and have other priorities than to proactively make sure crypto ATM operators are following anti-money laundering rules.

“I don’t think that the states do such a great job of forcing some of these operators from operating without a license or from doing the proper protection of consumers,” he said. “That opens up room for fraud.”

Crypto ATM fraud has grown steadily since the explosion of popularity in crypto trading during the Covid-19 pandemic, said Sgt. Bridget Duran from the Miami-Dade Police Department’s cyber crimes investigations unit.

Duran said the machines allow criminals to work almost invisibly because of the difficulty in identifying the ultimate owners of wallets receiving fraudulent money.

OCCRP reviewed hundreds of complaints about crypto ATMs filed to the U.S. Federal Trade Commission, the federal agency charged with consumer protection, and police and state attorneys general offices in four states since 2019. Many involved a scammer impersonating law enforcement, bank officials, or tech company customer support, following similar tactics used in gift card or money wire scams.

Miami’s Duran said investigators are hindered in chasing down scam perpetrators because the dollar amount of losses is often below the threshold needed to request the help of a foreign country to freeze assets in an offshore crypto exchange, which is where experts believe victims’ money often ends up.

“I don’t want to say ‘not worth it’, but the juice isn’t worth the squeeze,” she said

However, although the amounts involved are typically small, crypto ATMs are sometimes used for far larger fraud.

The consumer division of the Maryland Attorney General’s office registered a case last year of a man who fell victim to a false virus pop-up and believed he was working with officials from Microsoft, Wells Fargo, and the FBI.

The fraudsters initially persuaded him to deposit nearly $40,000 into a crypto ATM for “safekeeping.” Over the next four months, they convinced him to move more money into cryptocurrency wallets, culminating in him depositing $900,000 in retirement savings through a wire transfer service that converts dollars into bitcoin.

The case of Anne in Chicago illustrates both the cruelty of scam tactics and the way in which victims’ money can be quickly spirited away.

After receiving the email warning her about the warrant out for her arrest in late 2022 and sharing her phone number, a scammer who introduced themselves as an FTC investigator called her at her suburban home, then sent a screenshot of his government-issued ID .

Communicating mostly by text, he guided her to withdraw $9,000 in cash from her bank and deposit it at the gas station crypto ATM machine near her home.

About 10 minutes after Anne inserted the bills, the money was transferred to a wallet connected to OKX, a crypto exchange in the Seychelles. (Crypto exchanges allow users to trade one type of cryptocurrency for another or to convert it into money issued by governments.) The trail went cold from there, according to an analysis for OCCRP by the forensics firm Crystal Intelligence.

OKX is the third-largest crypto exchange by volume in the world. It did not respond to a request for comment about the case.

The Crystal analysis suggested the wallet where Anne’s money was last seen likely belonged to a peer-to-peer service, possibly a smaller crypto broker. Such services often allow their users to buy and sell crypto without extensive know-your-customer checks and are nested within larger centralized crypto exchanges.

Without proper oversight, illicit actors can run money laundering services without the larger exchange knowing, said Nicholas Smart, Crystal’s director of intelligence and security.

Anne’s family filed a police report with the Chicago Police Department’s financial crimes division but the case has since been suspended, the department confirmed to OCCRP, with no reason listed.

Another case shared with OCCRP by the Maryland Attorney General’s office showed how a crypto wallet used in a similar scam sent a victim’s money offshore.

In May 2023, the victim paid $4,500 into a Bitcoin Depot ATM at a gas station near Baltimore after being told their bank account had been compromised. They transferred the money to a bitcoin wallet they believed belonged to representatives from Microsoft and Bank of America.

An analysis for OCCRP by Crystal showed the bitcoin was moved to a second wallet less than three hours later.

Between April 2022 and July 2023, that wallet processed assets worth somewhere between $1.4 million and $3.6 million, according to the analysis. It sent cryptocurrency to multiple other wallets during that time and is now empty.

The wallet sent nearly 14 bitcoins to wallets associated with 1xBet, an online betting company with Russian origins which holds its gaming licenses in the Dutch Caribbean island of Curacao. Its Curacao-based entities were sanctioned by Ukraine last year as part of its response to Russia’s full-scale invasion.

1xBet office in Voronezh, Russia. (Photo: VPales/Alamy Stock Photo)

The wallet also made multiple transactions to HitBTC, a small-scale exchange with unclear legal standing. (According to its own website, HitBTC is registered in the island nation of Saint Vincent and the Grenadines. However, that country’s financial authority recently denied that, and warned “against engaging in any business transactions with this entity, as individuals may become vulnerable to fraudulent activities.”)

Bitcoin Depot had not responded to a request for comment on the specific case at the time of publication.

Connecticut detective Hogan and California deputy district attorney West both identified HTX, KuCoin and MEXC, all domiciled in the Seychelles, as exchanges where the money trail frequently runs cold in their investigations. The three exchanges did not respond to requests for comment.

“If you really want to make a significant change, we need the partnership of the locations where these exchanges are located, whether it’s Southeast Asia or the Seychelles, or wherever they’re actually based,” Hogan said.