Crypto ATM scam explained by Zavialov Ilia Nikolaevich: the call, the machine and the QR code

What the numbers actually describe

Losses of 389 million dollars in a year sit inside a much larger figure. Crypto linked losses overall reached 11,366,669,732 dollars across 181,565 complaints in 2025. The kiosk line is small by comparison and it grew faster than almost anything else, with losses up 58 percent against a 23 percent rise in complaints.

Losses rising much faster than complaints means the average loss per case went up. The same scheme is extracting more from each person it reaches, which usually indicates a script that has been refined rather than a new technique.

The age skew is extreme. The 60 and over group reported 6,188 complaints and 257,466,130 dollars. The 50 to 59 group reported 1,524 complaints and 44,584,724 dollars, less than a fifth of the money.

At the other end the numbers almost vanish. The 20 to 29 group reported 825 complaints and 6,474,240 dollars, and the under 20 group 58 complaints and 124,013 dollars. Whatever this scheme is, it is aimed with precision.

It starts with a call, not a machine

The machine is the last step and the least important one. The scheme begins with a telephone call, a text message or a pop up window claiming that something has gone wrong with an account, a device or a legal matter.

The caller is a bank security officer, a police investigator, a technical support agent from a large software company, or a government official about an unpaid obligation. The costume varies and the structure does not.

What all versions share is a story in which your money is currently at risk where it sits, and the only way to protect it is to move it somewhere the caller describes as safe. That inversion is the core of the whole thing.

There is no genuine institution anywhere that resolves a security problem by having a customer withdraw cash and feed it into a machine. Once that instruction appears, the rest of the call is theatre regardless of how professional it sounds.

Why a kiosk rather than a transfer

A bank transfer leaves a bank on both ends, with a compliance team, a recall procedure and a person to complain to. A cash deposit into a crypto machine leaves none of that.

The transaction is effectively final the moment it confirms. There is no chargeback, no recall window and no institution holding the money that can be asked to give it back.

The machine also removes the bank employee from the process. Withdrawing cash draws one question at the counter at most, and everything that happens afterwards happens without any professional present.

Convenience stores, petrol stations and shopping centres are the usual locations, which means the environment is noisy, unsupervised and populated by staff who have no responsibility for what a customer does with a machine.

Cash is the other half of the reason. It breaks the trail at the counter, so the bank sees a withdrawal rather than a payment to anybody, and the question of where the money went cannot be answered from the account statement afterwards.

The script at the machine

The caller stays on the line for the whole journey, which is the single most reliable indicator of the scheme. The stated reasons vary, from guiding you through the interface to keeping the case open, and the real reason is to prevent you from being alone with the decision for even a minute.

You will be told what to say if anybody asks. A gift for a grandchild, a purchase for a business, an investment you are making yourself. The instruction to have an answer ready is itself the confession, because a legitimate transaction needs no cover story.

Urgency is maintained continuously. A deadline, a case number about to expire, an account about to be frozen, an arrest warrant about to be issued. The pressure exists to prevent the one action that ends the scheme, which is hanging up and calling somebody back on a number you found yourself.

Large amounts are split across several visits and several machines, because kiosks have per transaction limits. Being asked to repeat the process at a second location should be decisive on its own.

The QR code is the whole trick

At the machine you are asked to scan a QR code the caller has sent you. That code contains the destination wallet address, and it is the only part of the transaction that determines where the money goes.

A wallet address is a long string that nobody can read or memorise, which is exactly why a code is used. It removes any possibility of noticing that the destination is not what you were told it is.

The address belongs to the operation. Every reassurance about a safe account, a federal wallet, a protected holding or a temporary escrow is describing something that does not exist as a category.

Once the cash is in and the transaction confirms, the funds are usually split and moved within minutes. Reporting has value in the first hour and loses most of it quickly after that.

What it looks like from outside

The pattern is visible to anybody paying attention. An older person at a crypto machine, on the phone continuously, feeding in cash in sequence, checking the screen against instructions being given verbally.

Several operators now display warnings on the machine itself, and staff in some locations are trained to intervene. Both help, and both are routinely defeated by the cover story the caller supplied in advance.

Family members are the most effective interruption available, which is why the caller works hard to prevent the conversation. Instructions not to discuss the matter with relatives, framed as confidentiality or as an active investigation, appear in almost every version.

If somebody close to you is standing at one of these machines on the phone, the useful intervention is not an argument about crypto. It is asking them to end the call and ring the institution back on a number from a card or a statement.

The first hour afterwards

Keep the receipt the machine prints. It carries the transaction reference and the destination address, and those are the two pieces of information that make a report actionable rather than descriptive.

Report to the police and to the kiosk operator immediately. Operators do respond to reports, occasionally hold funds that have not yet moved on, and are required to keep records that matter later.

Write down the phone number, the exact wording used, the name and title the caller gave, and the time of each call. Scripts repeat across many victims, and the wording is frequently what connects separate cases into one investigation.

Expect a follow up approach offering to recover the money. In 2025 the centre logged 10,516 complaints and 1.4 billion dollars of losses on recovery schemes, and people who have just lost money at a kiosk are on exactly the list those operations buy.

The rule that works better than knowledge

Understanding the scheme is not what protects people, because the call is engineered to suspend exactly that kind of thinking under time pressure. A rule agreed in advance works better than knowledge applied during the call.

The rule is one sentence. No cash goes into any machine because somebody on a telephone said so, with no exceptions and no urgency clause. A rule with an exception for genuine emergencies is not a rule, because every version of this scheme presents itself as a genuine emergency.

Agree it in the family out loud, with the older members present, and agree the second half as well: any call of this kind ends with hanging up and ringing a relative before anything else happens.

The age numbers explain why this conversation is worth having specifically with parents and grandparents. Two thirds of the money lost at these machines in 2025 came from people aged 60 and over, and almost none of it from people under 30.