Elliptic has published a report explaining the mechanics of Bitcoin ATM scams, with a focus on the transaction path after victims deposit cash at physical crypto kiosks.

The report describes how fraudsters manipulate victims, often elderly people, into withdrawing cash and using a Bitcoin ATM to convert that money into crypto. Once the transaction is completed, the funds are sent to wallets controlled by scammers. From there, the assets may be routed through additional addresses, services, or laundering pathways.

That path makes Bitcoin ATM fraud different from a typical card scam. A victim may begin with a cash withdrawal, but the loss quickly becomes an on-chain tracing problem. Financial institutions, compliance teams, and investigators then have to examine crypto transaction flows rather than focusing only on a bank transfer or card payment.

Elliptic’s central point is that blockchain analytics can help identify those flows, flag addresses linked to scams, and support recovery or law enforcement work when the relevant intermediaries are able to act. Elliptic provides analytics; it does not itself freeze funds or operate as an enforcement agency.

Why Scammers Use Bitcoin ATMs

Bitcoin ATMs connect physical cash with digital assets. That function can serve legitimate users, but it also creates an opening for fraudsters who want to move value quickly.

In a common scenario, a scammer pressures a victim to withdraw cash, travel to a kiosk, scan a QR code, and send funds without fully understanding the transaction. Once the crypto transfer is complete, reversing it is difficult. That is one reason scammers use the method: the money can move quickly, and the victim may not realize the transaction is effectively irreversible until after the funds have left their control.

The manipulation usually begins before the victim reaches the machine. Victims may be told that they owe money, that a bank account has been compromised, that a loved one is in danger, or that they must move funds to keep them safe. By the time they arrive at the ATM, the scammer has already created the fear or urgency needed to push the transaction forward.

In that sequence, the kiosk is the final step rather than the starting point. The fraud depends on social engineering first, and the Bitcoin ATM provides a way to turn that pressure into a digital transfer.

Cash Becomes an On-Chain Investigation

From a compliance perspective, the important shift is from cash to blockchain. The victim starts with physical money, but once the kiosk transaction is made, the movement of funds can be followed on a public ledger.

That does not mean recovery is easy. It does mean that the funds can leave a visible transaction trail. Blockchain analytics firms such as Elliptic can identify wallet clusters, trace flows, flag addresses associated with known scams, and help institutions detect suspicious deposits or withdrawals.

This matters for both banks and crypto businesses. A bank may see the cash withdrawal before the ATM transaction takes place. A crypto exchange may later receive funds from an address associated with scam activity. Law enforcement may need to connect both sides of the sequence: the cash withdrawal and the subsequent on-chain movement.

The faster those patterns are identified, the greater the opportunity to disrupt a laundering path. Analytics can show where funds moved, whether they interacted with known services, and which entities may be positioned to intervene.

For compliance teams, the issue is also one of timing. A suspicious cash withdrawal, a kiosk transaction, and a later crypto deposit may appear to different organizations as separate events. Connecting those signals quickly can determine whether an exchange, custodian, or investigator still has a useful opportunity to respond.

Elderly Victims Are Frequently Targeted

A significant concern in Bitcoin ATM fraud is the profile of many victims. Scammers frequently target elderly people because they may be more vulnerable to intimidation, less familiar with crypto transactions, or more likely to comply when someone falsely claims to represent a bank, government agency, or law enforcement.

This is not a crypto-only problem. Elder fraud also occurs through gift cards, wire transfers, payment apps, bank fraud, checks, and other payment methods. However, Bitcoin ATMs can make the final transfer especially difficult to reverse once the victim has sent crypto to an address controlled by the scammer.

That is why public education remains important. If someone is being instructed to deposit cash into a Bitcoin ATM to resolve a tax problem, secure a bank account, pay a fine, or help a family member, it is almost certainly a scam.

Kiosk operators, banks, and local authorities have used warnings, transaction limits, and compliance checks to reduce harm. The challenge is that scammers continue to adapt their scripts and methods.

Blockchain Analytics Helps, But It Does Not Freeze Funds

Elliptic’s report also highlights the need for realistic expectations about blockchain analytics. Analytics can help trace funds, screen addresses, and map laundering flows for institutions and law enforcement. But analytics alone does not freeze assets.

Freezing funds usually requires action by an exchange, custodian, stablecoin issuer, law enforcement agency, or another entity with control over an account, wallet, or address. If funds move through self-custody wallets or poorly regulated services, recovery becomes more difficult.

The value of analytics is speed and visibility. It can help show where the funds went, whether they touched known services, and which organizations may have the ability to act. That can turn a confused scam report into information that investigators, compliance teams, or law enforcement can use.

Even so, analytics does not undo the transfer by itself. It is a tool for tracing and response, not a substitute for preventive controls or legal authority.

A Broader Compliance Problem

Bitcoin ATM scams are sometimes framed as evidence that Bitcoin itself is broken. That framing overlooks how fraudsters operate across many payment rails. Criminals use whichever method helps them move value, including bank wires, gift cards, payment apps, cash couriers, checks, crypto, and other channels. Bitcoin ATMs are one tool within that broader fraud economy.

The practical question is how to reduce harm at each stage of the scam. That can include clearer warnings at kiosks, stronger transaction monitoring, faster communication between banks and crypto firms, public education for vulnerable users, and improved use of blockchain tracing when funds move on-chain.

That approach reflects the split nature of the problem. Prevention may happen before the cash leaves the bank or before the victim scans a QR code, while tracing and intervention usually begin after the crypto transaction is broadcast. Effective response therefore depends on both consumer-facing safeguards and post-transaction investigative tools.

Elliptic’s report gives compliance teams a clearer view of the mechanics. The scams begin with manipulation, move through physical cash, and end as digital transactions that can be traced across the blockchain. Stopping them requires attention to the victim interaction, the cash withdrawal, the kiosk transaction, and the subsequent movement of crypto.

This article is based on Elliptic’s report explaining how Bitcoin ATM scams work.

This article was written by the News Desk and edited by Samuel Rae. This report is based on information released in disclosures at primary source documentation.