Constantly evolving technologies and artificial intelligence make it more difficult for the public to discern what is a scam and what is not, but it has not diminished reliance upon the internet in our daily lives. Criminals, as usual, have found a way to exploit our dependence and cybercrime rates have increased exponentially. In the 2025 Internet Crime Report, the Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3) details the continued rise in cybercrime, with losses last year at $20.877 billion, an increase of nearly 400% since 2020.
What is Cryptocurrency?
According to the IC3, over half of the cybercrime losses in 2025 involve cryptocurrency fraud or scams. Crypto is a form of digital currency which is secured by cryptography, or coding, on a decentralized network not controlled by a single entity, bank or government. The network uses blockchain to secure transactions; this allows transaction data to be spread across the network as blocks that cannot be replicated, and are therefore not vulnerable to counterfeiting, as is fiat currency. Each transaction block or record incorporates a portion of the previous transaction (called a hash) imbedded within it and includes a timestamp and transaction data. Modifying a transaction would entail changes to every transaction prior in the chain which would require network permissions, which makes transactions essentially impossible to alter. However, although the transactions are safe, they cannot be reversed and are difficult to track. Some digital wallets used to store crypto do not require identification, therefore transactions are anonymous.
Scams involving cryptocurrency kiosk transactions more than doubled from 2024 to 2025, amounting to $389 million in losses across the United States. Scammers have used various schemes to lure their victims into depositing money into a digital wallet using a cryptocurrency kiosk. Since the transactions cannot be reversed and most digital wallets are anonymous, there is very little, if anything, that can be done to recover the stolen funds. In response to this disturbing trend, many states have enacted legislation to combat consumer losses, from requiring kiosk registration to a complete ban in some states.
Kiosk Laws
Four states have completely banned cryptocurrency kiosks: Indiana, Minnesota, Tennessee, and Vermont. Hawaii has banned all kiosks that accept deposits (effective October 1, 2026), but not those that dispense currency. Idaho, Nevada, New Mexico, Oregon, Texas, and Wyoming have no specific laws at all and rely upon their current money transmission laws. Massachusetts and Montana are addressing the need for legislation. There are eight states which currently have pending legislation that has not been passed (Michigan, Pennsylvania, Washington, Ohio, Rhode Island, New Jersey, New York, South Carolina). The remaining 29 states have all developed a framework of regulations designed to protect consumers from being scammed.
The laws which were drafted exclusively for cryptocurrency kiosks have similar categories of restrictions or requirements. Many establish daily transaction limits for new customers, ranging from $1,000 to $2,500 per day for a specified period of time, typically 30 days, and some limiting the amount which can be deposited or the number of transactions within a specified period of time. Alabama, for example, limits new users to $1,000 per day or $10,000 per month for a new customer, for all kiosks statewide. This means all kiosks must have the capacity to identify new users within that time frame. Similarly, many states have transaction limits for existing users; Georgia limits established users to $10,000 per day.
Most states require refund provisions and/or transaction holds for new users. The transaction holds range from 48 to 96 hours for new users in the event the user decides not to proceed with the transaction or realizes they have been lured into a scam. To get a refund, the user must meet all detailed requirements, such as providing receipts and proof of contacting law enforcement regarding a probable scam. Of the 29 states, California, Missouri, and Utah do not have refund provisions. Virginia is the only state which does not require the kiosk operator to provide a receipt. The other 28 states provide either physical or digital receipts, or both.
Live customer support is required by all but 7 of the 29 states. Guidelines range from support being available for questions to mandating a customer support agent to speak with any new user over the age of 60 prior to completing their first transaction. The conversation must be recorded and retained by the kiosk operator and include discussion of the transaction and types of fraud schemes involving digital currencies, and a review of the posted or displayed warnings, which are required by all but two states. The warnings, either posted materially adjacent to the kiosk or electronically onscreen, caution the user, describe scams associated with the use of cryptocurrency kiosks, and the actors who may perpetrate those schemes, and most require a physical attestation. Additionally, most states require kiosk operators to verify the user’s identity prior to a transaction.
Twenty-five states require the operator to employ blockchain analytic software to assess each transaction in real time. Based on previous scam reports, some digital wallets may be flagged as being linked to criminal activity. The software blocks transactions to those wallets. In addition, the software keeps a record of all transactions which must be archived by the operator. Should law enforcement be notified of a scam, the transaction record is available for review. Although the owner of a digital wallet may not be revealed, the wallet can be flagged to prevent future transactions.
Other common elements from state to state are requirements for anti-fraud policies and procedures, reporting kiosk locations on a regular basis to the state regulatory authority, designating a consumer protection officer, training operators on recognizing fraud, and surety bonds in varying amounts.
Similar legislation has been introduced in the US Senate, titled Crypto ATM Fraud Prevention Act of 2025. It has been referred to the Committee on Banking, Housing, and Urban Affairs. It, too, aims to cap transactions, offer live support, mandate refunds, and provide fraud warnings and tracking. As with other federal laws, states may choose to be more restrictive.
How Does Florida Compare?
The state of Florida recently passed House Bill 505, which will be effective as of January 1, 2027. Florida limits new users to $2,000 in transactions per day for seven days, then $10,000 per day thereafter. In addition, registration is required for each kiosk in addition to the federal licensing required for money services businesses. Kiosk operators are required to display standard warnings, utilize blockchain analytics software, and provide receipts. All transactions are subject to refund provisions. The regulatory authority for kiosks is the Office of Financial Regulation. The bill does not compel operators to provide live customer support or live review of the attestations.
In February 2026, Florida residents were warned of the marked increase in digital currency kiosk fraud. The state has more than 3,100 kiosks in operation – the second highest number of any state in the U.S. Scammers favor the anonymity of crypto transactions and kiosks are readily available in almost every community; when those two factors are combined with the fact that nearly 25% of the population is over 65, a demographic considered more vulnerable to fraud, it makes the state an ideal environment for scams involving the use of a crypto kiosk. The National Council on Aging reports that scams involving cryptocurrency are one of the top five cons which target the elderly. Unlike other segments of the population, when elderly people fall victim to a scam, they lack the ability to earn and recover their losses. While the population as a whole deserves to be protected, those most at risk should be considered first.
