I paid with crypto or a Bitcoin ATM

No bank, government agency, or company tells you to put cash in a Bitcoin ATM or buy crypto to keep your money safe. If someone told you to, it was a scam.

Crypto rarely comes back. Make the calls below today anyway. Some states now make crypto ATM companies refund scam victims, and those refunds have deadlines.

If it’s happening now

You’re at the machine, or on your way to one. Hang up. Don’t put in any more cash. Keep every receipt.

They want another deposit: tomorrow, at another machine, or as a fee or tax before you can withdraw. Stop sending. Paying to get money out is the next stage of the scam.

They’re messaging you. Stop replying. Screenshot the whole chat, with their name, number, or username, before you block anyone.

They’re on your computer. Hold the power button until it shuts off. Use your phone for the rest. Someone is on the line or on my screen right now.

What to say

• I was scammed into putting [amount] into one of your machines today. I have the receipt. Can you stop or reverse it and refund me? What do you need from me for a refund? Please flag the wallet address I sent it to. I need a case number.

• I sent crypto to a scammer from my account on [date]. Here's the transaction ID. It was fraud. Can you reverse it or refund it? I need a case number.

• I want to file a report. Someone pretending to be [who] got me to send [amount] in crypto [at a Bitcoin ATM at (address)]. I have the receipts and their messages. I need a report number. The company may need it for a refund.

• Can you send me that decision in writing?

If something already left your hands

You used a Bitcoin ATM

Call the company that runs the machine. Its name and support number are on the machine or your receipt. Use that number, not one from a search result or from the people who sent you there.

Have the receipt in front of you. Tell them it was a scam, ask them to reverse it and refund you, and ask what they need for a refund. Ask them to flag the wallet address so their machines block it. They’ll probably say it’s already gone. Write down the case number and who you talked to.

No receipt? Photograph the machine with the company’s name on it, and write down the store’s address and the time. Give the company both, plus the phone number you entered at the machine if it asked for one.

Took the cash out of your bank? Call the number on your card too, especially if the caller had you sign in to your bank or install anything.

You sent it from a crypto app (Coinbase, Cash App, PayPal, Robinhood, or similar)

Report it inside the app, under Help or Support, or on the site you type in yourself. Tell them it was fraud, give them the transaction ID (a long string of letters and numbers next to the payment in your history; some apps call it the transaction hash), and ask them to reverse it and refund you. Get a case number.

If the money went to an investment site that shows your balance growing, that balance isn’t money you can withdraw. An investment that can’t lose.

They got your recovery words, login, ID, or computer

The words that restore your wallet (the recovery or seed phrase), or its private key. Whoever has them can move everything in that wallet, and you can’t change them. Move what’s left to a new wallet with a new phrase, from a phone or computer they never touched. If you need help, ask someone you know in person.

Your crypto app password or a sign-in code. From a device you trust, change the password. If your email uses the same one, change that first: it’s where the app sends reset links. Then set up a passkey or an authenticator app for signing in. Ask the app to lock the account and check for devices you don’t recognize.

A photo of your ID, or your Social Security number. Freeze your credit with all three bureaus. It’s free. I gave out a code, password, or card number.

Your computer. Keep it off until it’s been cleaned. I let someone control my computer.

Keep the evidence

Keep the receipts, the QR code, screenshots of the chats, and your call log. Don’t delete the conversation. Save evidence without spiraling.

Report it to the police and the FBI today

Police. Call your department’s non-emergency number and file a report. Ask for the report number, even if they say they can’t investigate. Refunds can depend on it.

Some states, including Arizona, Colorado, and Wisconsin, make crypto ATM companies refund scam victims in some cases. Each has conditions and a deadline (30 days in Arizona and Wisconsin), and each wants you to have told the police or the state. In Arizona, tapping Accept on the machine’s warning doesn’t rule one out. Report now, then give the company your report number and ask for the refund. If the police won’t take a report, file with your state attorney general.

FBI. File at ic3.gov at the same time as you call the company. Include:

• every wallet address you sent to (check the receipt and the QR code they sent)
• the amount and type of crypto
• the transaction IDs, dates, and times
• the machine’s address
• every phone number, username, and website they used

The confirmation page is the only copy of your complaint you’ll get, so save or print it. To add something later, file a new complaint that says it adds to the first one.

Then report it at ReportFraud.ftc.gov. If you’re 60 or older, or helping someone who is, the National Elder Fraud Hotline can help you file.

If they say it’s final

They probably will. Crypto doesn’t come with the protections credit and debit cards do, and no federal rule makes them refund a payment you made yourself. Ask for the decision in writing. Then file a complaint with the CFPB, which takes complaints about virtual currency companies, with your state attorney general, and with your state’s banking or financial regulator.

What happens next

The company may take days to answer. You won’t hear from IC3: it passes reports to law enforcement and doesn’t give updates. If the FBI or police need more, someone from a local office will contact you.

That’s the urgent part. The rest can wait a few hours.

Once the calls are made

Expect a “recovery” offer. Lists of scam victims, with how much each one lost, get sold. Anyone who wants a fee, a tax, or your wallet login to get your crypto back is running a second scam, including people who say they’re lawyers, the FBI, or IC3. Someone offers to get my money back.

If you want to talk it through, the AARP Fraud Watch Network Helpline is free, for any age: 877-908-3360.

What it looks like

2:20 p.m. You're putting $100 bills into a Bitcoin ATM, still on the phone with the man who sent you. A second call comes in.

(866) 555-0163

Incoming call · 2:20 PM

1. Caller Hi, this is Maria with customer support for the Bitcoin ATM you're using. Our number is on the front of the machine.
2. Caller This deposit looks like a scam we see a lot. Is anyone on the phone telling you what to do?

He told you to say it's for your own investment. What do you do?

• Say it's for your own investment, like he told you
• Tell her the truth and stop putting cash in
• Hang up on her and finish. You didn't call her

Show the answers

• Wrong move Say it's for your own investment, like he told you That line is what gets the money through. Someone who coaches you on what to tell the company is the scam.
• Best move Tell her the truth and stop putting cash in She's asking you to stop, not to pay or share anything, so stopping is safe whoever she is. The FBI says that if the kiosk operator calls to say your transactions look like fraud and tells you to stop, stop.
• Wrong move Hang up on her and finish. You didn't call her She isn't asking you for anything. He is: your cash. Hang up on him.

A call that asks you to stop sending money costs nothing to obey. Tell the company the truth.

Two weeks after you lost $5,800 at a Bitcoin ATM, this arrives.

Re: IC3 complaint - recoverable funds identified (Ref. HW-26-0417)

H

Hollis & Wray LLP, Digital Asset Recovery <[email protected]>

Oct 1, 10:42 AM

Dear Claimant,

Our firm is an officially authorized recovery partner working with federal agencies on cryptocurrency fraud cases. Your name appears on a confirmed victim list shared with our office.

Our forensic team traced your deposits totaling $5,800.00 on September 16, 17, and 18 at a Bitcoin ATM in Lakewood, CO to the wallet bc1q8f3…k2xw. The funds are being held at a regulated exchange and can be frozen and returned to you through legal channels.

To file the freeze order, a refundable retainer of $950.00 is required. You will then be added to a secure WhatsApp group with your case attorney and the bank processing officer.

Funds not claimed within 5 business days will be released back to the holding wallet.

They have the amount, the dates, and the town. What do you do?

• Pay the $950. Nobody else could know those details
• Reply that they can take their fee out of whatever they recover
• Look up the firm yourself and call it
• Don't reply. Report the email at ic3.gov and ReportFraud.ftc.gov

Show the answers

• Wrong move Pay the $950. Nobody else could know those details The people who took your money know them best. The CFTC says lists of scam victims, with the amount each one lost, get kept and sold. And anyone can look up where crypto went: the record is public.
• Wrong move Reply that they can take their fee out of whatever they recover They'll agree, then ask for a 'bank fee' before anything is released. The FBI describes fake law firms putting victims into WhatsApp groups with supposed bank processors and attorneys who say bank fees must be paid to withdraw funds.
• Okay Look up the firm yourself and call it Safe, as long as the number didn't come from this email. Scammers copy real firms' names and letterhead, so finding a real firm proves nothing about this email.
• Best move Don't reply. Report the email at ic3.gov and ReportFraud.ftc.gov IC3 never asks for payment to recover money, and it doesn't work with law firms or crypto services to get it back. File the email as a new complaint that mentions your first one.

Seeing where crypto went is easy. Anyone who offers to get it back for a fee, lawyers and "FBI agents" included, is running a second scam.

Nine days after you filed at ic3.gov, your phone rings.

(303) 555-0119

Incoming call · 11:05 AM

1. Caller Hi, this is Special Agent Dana Whitlock with the FBI's Denver field office. I'm following up on the complaint you filed with IC3 about a Bitcoin ATM.
2. Caller I'd like to set up a time to go over what happened. Please hold on to your receipts and the texts they sent you.
3. You Do I need to pay anything?
4. Caller No. There's no cost to you.

He hasn't asked for money, a code, or your wallet. What do you do?

• Hang up and ignore it. IC3 says it never contacts people
• Say you'll call back, then call the Denver field office at the number on fbi.gov and ask for him
• Set up the meeting and answer his questions now

Show the answers

• Wrong move Hang up and ignore it. IC3 says it never contacts people IC3 itself doesn't call. It also says that when more information is needed, FBI employees from local field offices or other police will contact you. This could be one of them.
• Best move Say you'll call back, then call the Denver field office at the number on fbi.gov and ask for him That works whether he's real or not. The FBI says to verify a caller using the agency's public contact information, not the number they give you.
• Okay Set up the meeting and answer his questions now Probably harmless as long as he never asks for money, a code, a login, or your wallet's recovery words. Fake agents start the same way and bring up a fee later. Checking first takes five minutes.

Police and the FBI may call after you report. They won't charge you anything. Calling the office back on its listed number tells you which kind of call it was.

What they’ll ask for

Each of these is the scam.

“Take out cash and put it in a Bitcoin ATM to protect it.” There’s no government Bitcoin account and no federal safety locker. Anyone who sends you to a crypto ATM is a scammer.

“Scan the QR code I sent you.” The code is their wallet address. Only a scammer hands you one to deposit your savings.

“It’s your wallet. It’s registered in your name.” Whoever set up a wallet controls it. They set this one up.

“If the bank asks, say it’s for a family member.” A caller who tells you to lie to the bank is the scam. Tell the teller what the caller said.

“Read me your recovery words so I can secure your wallet.” Anyone with them owns the wallet.

What not to waste time on

Tracing the crypto, or paying someone to. Crypto transfers sit on a public record, so seeing where it went is the easy part. Seizing it takes law enforcement, and your IC3 report gives them the addresses.